Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.662...7.21.0-rc.663

• 9846631: [js][bidi] Add vendor specific class generation (#18125) (Puja Jagani) #18125
• e431cc8: [build] Automated Browser Version Update (#18107) (Selenium CI Bot) #18107
• af9e5cf: [java] assert setFiles uploads reach the server in SetFilesCommandTest (#18058) (Yash Pardeshi) #18058
• ceec8bf: [java][bidi] Decode nested RemoteValues from the parsed tree instead of re-serializing each subtree (#18095) (Yash Pardeshi) #18095
• 788fcf3: [rb] type a field-less synthetic map record as a validated map (#18121) (Augustin Gottlieb) #18121
• e420863: [java] remove guava from client bindings #12737 (#13739) (joerg1985) #13739
• e0c56c9: [rb] update test guard for different bidi error in Chrome beta (Titus Fortner)
• 5026a72: [build] clean up IntelliJ project files and align .editorconfig with formatters (#18119) (Titus Fortner) #18119
• b5aacd7: [build] SM production release skips debug jobs and builds Mac binaries in parallel (Titus Fortner)
• 4961c4f: [javascript] Create @seleniumhq/atoms npm package from TypeScript atoms (#17459) (David Burns) #17459
• 229a802: [java][bidi] Add BiDi code generator (#17777) (Puja Jagani) #17777
• 13920ed: [java][bidi] Export the generated protocol classes from selenium-remote-driver (Titus Fortner)
• 21e7241: [build] download prebuilt SBOM tools instead of compiling them for Selenium Manager releases (Titus Fortner)
• 6fcc54c: [rust] bump the crate version in Cargo.lock directly instead of repinning through Bazel (Titus Fortner)

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.661...7.21.0-rc.662

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.660...7.21.0-rc.661

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.659...7.21.0-rc.660

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

• CVE-2026-XXXXX : parser desync in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http
• CVE-2026-XXXXX : origin validation error in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http2
• CVE-2026-XXXXX : request/response smuggling in io.netty:netty-codec-http
• CVE-2026-XXXXX : time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : SNI routing bypass in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-xml
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-base
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http
• CVE-2026-XXXXX : input misinterpretation in io.netty:netty-codec-socks
• CVE-2026-XXXXX : improper access control in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-dns

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Specific changes worth calling out:

Validation in FileUpload.setContentType. Previously, the FileUpload.setContentType methods did not validate their inputs. They now throw an IllegaalArgumentException if the given string is not formatted as a plausible MIME content type.

• Auto-port 4.1: perf: Use LinkedHashSet to deduplicate search domains by @netty-project-bot in https://github.com/netty/netty/pull/17407
• Auto-port 4.1: Handle non-positive skip lengths in ByteBufInputStream by @netty-project-bot in https://github.com/netty/netty/pull/17410
• Protobuf: Update protobuf-javanano to non alpha release (#17330) by @normanmaurer in https://github.com/netty/netty/pull/17335
• Socket: Add half-closure tests to SocketHalfClosedTest (#17394) by @normanmaurer in https://github.com/netty/netty/pull/17434
• Auto-port 4.1: HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by @netty-project-bot in https://github.com/netty/netty/pull/17436
• Auto-port 4.1: codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by @netty-project-bot in https://github.com/netty/netty/pull/17459
• Update GitHub Actions to Node.js 24 to fix deprecation warning by @normanmaurer in https://github.com/netty/netty/pull/17488
• Remove not used tools from docker image by @normanmaurer in https://github.com/netty/netty/pull/17490
• Auto-port 4.1: HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by @netty-project-bot in https://github.com/netty/netty/pull/17494
• Auto-port 4.1: Fix buffer leak when recvmmsg returns single UDP_GRO batch by @netty-project-bot in https://github.com/netty/netty/pull/17500
• Auto-port 4.1: Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by @netty-project-bot in https://github.com/netty/netty/pull/17501
• Auto-port 4.1: Add regression test for close() cascade reentering flush() by @netty-project-bot in https://github.com/netty/netty/pull/17505
• Port: Fix UDP_GRO segment size is lost when reading with recvmmsg (#17492) by @normanmaurer in https://github.com/netty/netty/pull/17506
• Auto-port 4.1: Make CompositeBufferGatheringWriteTest robust against write/close race by @netty-project-bot in https://github.com/netty/netty/pull/17510
• Auto-port 4.1: Add workflow that will cancel running workflows for merged PRs by @netty-project-bot in https://github.com/netty/netty/pull/17519
• Auto-port 4.1: Harden DnsNameResolverTest against transient null localAddress from TestDnsServer by @netty-project-bot in https://github.com/netty/netty/pull/17522
• Cache docker build images in ghcr.io to speed up CI for 4.1 by @normanmaurer in https://github.com/netty/netty/pull/17533
• Auto-port 4.1: HTTP/2: Remove failed SETTINGS from ACK queue by @netty-project-bot in https://github.com/netty/netty/pull/17534
• Port: Fix compilation on latest macOS 27.0 (#17529) by @normanmaurer in https://github.com/netty/netty/pull/17542
• Http2ConnectionRoundtripTest: Reduce timing sensitivity to fix CI flakiness (#17540) by @normanmaurer in https://github.com/netty/netty/pull/17552
• Auto-port 4.1: ProtobufVarint32FrameDecoder must wait for more data when the length prefix is incomplete by @netty-project-bot in https://github.com/netty/netty/pull/17553
• Auto-port 4.1: Fix missing readable-bytes check in SmtpResponseDecoder by @netty-project-bot in https://github.com/netty/netty/pull/17556
• Auto-port 4.1: Guard against out-of-bounds reads when parsing ClientHello SNI extension by @netty-project-bot in https://github.com/netty/netty/pull/17558
• Auto-port 4.1: Http2: Reserve promised stream before running the request verifier by @netty-project-bot in https://github.com/netty/netty/pull/17563
• Port: Use random generated LocalAddress in tests that use local transport (#17570) by @normanmaurer in https://github.com/netty/netty/pull/17579
• Port: DnsAddressResolverGroupTest: Use a mock DNS server instead of resolving netty.io over the network (#17566) by @normanmaurer in https://github.com/netty/netty/pull/17577
• [4.1] Use isLengthEqual method in HttpObjectDecoder by @rsvoboda in https://github.com/netty/netty/pull/17575
• Port: Use 2 EventLoops when running our tests by default (#17567) by @normanmaurer in https://github.com/netty/netty/pull/17587
• Auto-port 4.1: Reject incomplete PUSH_PROMISE request headers when validateRequiredPseudoHeaders is enabled by @netty-project-bot in https://github.com/netty/netty/pull/17582
• Auto-port 4.1: POOL: Release Channel when SimpleChannelPool acquire is cancelled by @netty-project-bot in https://github.com/netty/netty/pull/17578
• Auto-port 4.1: Fix flaky HttpToHttp2ConnectionHandlerTest.testChunkedRequestWithBodyAndTrailingHeaders by @netty-project-bot in https://github.com/netty/netty/pull/17593
• Auto-port 4.1: Http2ConnectionHandler: report at most one stream error for a CompositeStreamException by @netty-project-bot in https://github.com/netty/netty/pull/17595
• Port: Http2MultiplexTransportTest: Fix possible SslContext leak in tests (#17597) by @normanmaurer in https://github.com/netty/netty/pull/17599
• Auto-port 4.1: Support creating a PropertyKey that is not tied to a specific Http2Connection by @netty-project-bot in https://github.com/netty/netty/pull/17615
• Auto-port 4.1: Reset LengthFieldBasedFrameDecoder state when the frame is shorter than initialBytesToStrip by @netty-project-bot in https://github.com/netty/netty/pull/17621
• Port: Fix ByteBuf.setBytes(int, ByteBuffer) when the source is the buffer's own internal NIO buffer (#17618) by @normanmaurer in https://github.com/netty/netty/pull/17626
• Auto-port 4.1: Fix connection error scope for SETTINGS_INITIAL_WINDOW_SIZE overflow issue by @netty-project-bot in https://github.com/netty/netty/pull/17640
• Auto-port 4.1: Add missing bounds check to AdaptiveByteBuf.getBytes(...) channel variants by @netty-project-bot in https://github.com/netty/netty/pull/17629
• Port: Update lz4-java to 1.12.0 (#17631) by @normanmaurer in https://github.com/netty/netty/pull/17638
• Auto-port 4.1: HTTP/2: Fix stream stall when toggling auto-read on a child channel by @netty-project-bot in https://github.com/netty/netty/pull/17646
• Port: No need to call clear() on ByteBuffer after AdaptiveByteBuf.internalNioBuffer() (#17619) by @normanmaurer in https://github.com/netty/netty/pull/17653
• Auto-port 4.1: PendingWriteQueue: unlink the write before failing it in removeAndFail by @netty-project-bot in https://github.com/netty/netty/pull/17658
• Port: Don't lose HashedWheelTimer timeouts that race with stop() (#17610) by @normanmaurer in https://github.com/netty/netty/pull/17660
• Port: LocalChannel: complete connect() when the accepted channel dies before registration (#17656) by @normanmaurer in https://github.com/netty/netty/pull/17666
• Port: Don't leak FixedChannelPool slots on unrelated IllegalArgumentException (#17609) by @normanmaurer in https://github.com/netty/netty/pull/17668
• Auto-port 4.1: Don't corrupt the pipeline when a handler context is removed twice by @netty-project-bot in https://github.com/netty/netty/pull/17670
• Auto-port 4.1: Don't leak queued writes in ChunkedWriteHandler on removal or cancel by @netty-project-bot in https://github.com/netty/netty/pull/17676
• Port: Honour the needle's reader index in ByteBufUtil.indexOf(ByteBuf, ByteBuf) (#17682) by @normanmaurer in https://github.com/netty/netty/pull/17687
• Auto-port 4.1: Close idle outbound HTTP/2 child channels when the parent closes by @netty-project-bot in https://github.com/netty/netty/pull/17694
• Auto-port 4.1: Only fail in ZlibDecoder when the decompression buffer is full by @netty-project-bot in https://github.com/netty/netty/pull/17698
• Auto-port 4.1: Use LocalIoHandler instead of DefaultEventLoop for LocalChannel tests in codec-http2 by @netty-project-bot in https://github.com/netty/netty/pull/17708
• Auto-port 4.1: Add script that allows to check if a user has signed the icla by @netty-project-bot in https://github.com/netty/netty/pull/17713
• Port: Fail pending writes of ProxyHandler when it is removed (#17691) by @normanmaurer in https://github.com/netty/netty/pull/17707
• Auto-port 4.1: Complete HTTP/2 graceful close when the connection closes the last stream by @netty-project-bot in https://github.com/netty/netty/pull/17720
• Auto-port 4.1: Don't count STOMP headers again when the header block is replayed by @netty-project-bot in https://github.com/netty/netty/pull/17716
• Port 4.1: Don't corrupt ChannelOutboundBuffer when a cancelled write makes the channel writable (#17702) by @normanmaurer in https://github.com/netty/netty/pull/17733
• Auto-port 4.1: Fail ChunkedNioFile instead of spinning when the file is shorter than requested by @netty-project-bot in https://github.com/netty/netty/pull/17734
• Port 4.1: Arm force-close timeout when an inbound CLOSE frame is echoed (#17574) by @normanmaurer in https://github.com/netty/netty/pull/17710
• Port 4.1: MqttDecoder accepts malformed MQTT 5 property sections and reclassifies payload bytes as properties (#17714) by @normanmaurer in https://github.com/netty/netty/pull/17732
• Port 4.1: Only build and test the affected modules when validating PRs (#17736) by @normanmaurer in https://github.com/netty/netty/pull/17744
• Port 4.1: Validate bzip2 Huffman table selector index before use (#17705) by @normanmaurer in https://github.com/netty/netty/pull/17738
• Port 4.1: Fix racy DnsNameResolverTest.testNegativeTtl lifecycle observer checks (#17737) by @normanmaurer in https://github.com/netty/netty/pull/17748
• Auto-port 4.1: Fix retainedSlice() of non-retained pooled derived buffers by @netty-project-bot in https://github.com/netty/netty/pull/17761
• Port 4.1: Reset the permessage-deflate compressor after an empty final fragment (#17681) by @normanmaurer in https://github.com/netty/netty/pull/17741
• Try to fix/stabilize a number of flaky tests (#16934) by @normanmaurer in https://github.com/netty/netty/pull/17763
• Auto-port 4.1: Build using powershell on Windows by @netty-project-bot in https://github.com/netty/netty/pull/17768
• Bulk merge changes for 4.1 by @normanmaurer in https://github.com/netty/netty/pull/17771

• @rsvoboda made their first contribution in https://github.com/netty/netty/pull/17575

Full Changelog: https://github.com/netty/netty/compare/netty-4.1.138.Final...netty-4.1.139.Final

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

• CVE-2026-XXXXX : parser desync in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http
• CVE-2026-XXXXX : origin validation error in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http2
• CVE-2026-XXXXX : request/response smuggling in io.netty:netty-codec-http
• CVE-2026-XXXXX : time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : SNI routing bypass in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-xml
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-base
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http
• CVE-2026-XXXXX : input misinterpretation in io.netty:netty-codec-socks
• CVE-2026-XXXXX : improper access control in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-dns
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http3
• CVE-2026-XXXXX : use-after-free in io.netty:netty-transport-classes-io_uring
• CVE-2026-XXXXX : memory leak in io.netty:netty-transport-native-io_uring

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Specific changes worth calling out:

Validation in FileUpload.setContentType. Previously, the FileUpload.setContentType methods did not validate their inputs. They now throw an IllegaalArgumentException if the given string is not formatted as a plausible MIME content type.

• perf: Use LinkedHashSet to deduplicate search domains by @JunggiKim in https://github.com/netty/netty/pull/17400
• Handle non-positive skip lengths in ByteBufInputStream by @cuishuang in https://github.com/netty/netty/pull/17388
• Avoid double promise allocation in SslHandler.wrap() by @doom369 in https://github.com/netty/netty/pull/17382
• Socket: Add half-closure tests to SocketHalfClosedTest by @rajan-github in https://github.com/netty/netty/pull/17394
• HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by @hunseonglee in https://github.com/netty/netty/pull/17386
• codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by @hyperxpro in https://github.com/netty/netty/pull/17373
• transport: Avoid io_uring completion callback allocation by @massiccio in https://github.com/netty/netty/pull/17457
• QUIC: Ensure writable events reflect stream capacity by @yawkat in https://github.com/netty/netty/pull/17431
• OcspServerCertificateValidatorTest: Fix possible leak in test by @normanmaurer in https://github.com/netty/netty/pull/17469
• Use github to download cmake and also remove tar file after unpacking by @normanmaurer in https://github.com/netty/netty/pull/17482
• build: Upgrade GitHub Actions to fix Node.js 20 deprecation warnings by @normanmaurer in https://github.com/netty/netty/pull/17484
• HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by @ohchanKyu in https://github.com/netty/netty/pull/17456
• Fix buffer leak when recvmmsg returns single UDP_GRO batch by @octa-one in https://github.com/netty/netty/pull/17493
• Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by @fudianchn in https://github.com/netty/netty/pull/17438
• Add regression test for close() cascade reentering flush() by @normanmaurer in https://github.com/netty/netty/pull/17497
• Fix UDP_GRO segment size is lost when reading with recvmmsg by @octa-one in https://github.com/netty/netty/pull/17492
• KQueueDatagramChannel: rewrite IPv4-wildcard bind to IPv6-any on dual-stack sockets by @normanmaurer in https://github.com/netty/netty/pull/17498
• Make CompositeBufferGatheringWriteTest robust against write/close race by @normanmaurer in https://github.com/netty/netty/pull/17508
• Add option to ignore MaxDirectMemorySize JVM argument by @franz1981 in https://github.com/netty/netty/pull/17177
• Only build affected Maven modules for PR verification by @normanmaurer in https://github.com/netty/netty/pull/17512
• Add workflow that will cancel running workflows for merged PRs by @normanmaurer in https://github.com/netty/netty/pull/17518
• Harden DnsNameResolverTest against transient null localAddress from TestDnsServer by @normanmaurer in https://github.com/netty/netty/pull/17514
• Fix flaky memory leak detection in OcspServerCertificateValidatorTest by @normanmaurer in https://github.com/netty/netty/pull/17524
• Cache docker build images in ghcr.io to speed up CI by @normanmaurer in https://github.com/netty/netty/pull/17530
• HTTP/2: Remove failed SETTINGS from ACK queue by @Gimini-3 in https://github.com/netty/netty/pull/17387
• Fix compilation on latest macOS 27.0 by @normanmaurer in https://github.com/netty/netty/pull/17529
• Make IoEventLoopGroup.isCompatible/isIoType side-effect free by @idelpivnitskiy in https://github.com/netty/netty/pull/17544
• Fix flaky memory leak detection in OcspServerCertificateValidatorTest by @normanmaurer in https://github.com/netty/netty/pull/17536
• Reset busy counters after triggering an auto-scale-up decision by @normanmaurer in https://github.com/netty/netty/pull/17538
• Http2ConnectionRoundtripTest: Reduce timing sensitivity to fix CI flakiness by @normanmaurer in https://github.com/netty/netty/pull/17540
• ProtobufVarint32FrameDecoder must wait for more data when the length prefix is incomplete by @ohchanKyu in https://github.com/netty/netty/pull/17550
• QpackEncoder.sectionAcknowledgment must not NPE when dynamic table is disabled by @normanmaurer in https://github.com/netty/netty/pull/17537
• Fix missing readable-bytes check in SmtpResponseDecoder by @normanmaurer in https://github.com/netty/netty/pull/17516
• Guard against out-of-bounds reads when parsing ClientHello SNI extension by @normanmaurer in https://github.com/netty/netty/pull/17532
• Fix IndexOutOfBoundsException from mismatched varint length in Http3FrameCodec by @normanmaurer in https://github.com/netty/netty/pull/17523
• Fix missing readable-bytes checks in QuicHeaderParser by @normanmaurer in https://github.com/netty/netty/pull/17515
• Http2: Reserve promised stream before running the request verifier by @normanmaurer in https://github.com/netty/netty/pull/17495
• Fix HTTP/3 decoding of frames with zero length payloads by @violetagg in https://github.com/netty/netty/pull/17564
• DnsAddressResolverGroupTest: Use a mock DNS server instead of resolving netty.io over the network by @normanmaurer in https://github.com/netty/netty/pull/17566
• Use random generated LocalAddress in tests that use local transport by @normanmaurer in https://github.com/netty/netty/pull/17570
• POOL: Release Channel when SimpleChannelPool acquire is cancelled by @renechoi in https://github.com/netty/netty/pull/17569
• Fix missing per-entry clamp in IoUringBufferRing.useBuffer by @normanmaurer in https://github.com/netty/netty/pull/17568
• Reject incomplete PUSH_PROMISE request headers when validateRequiredPseudoHeaders is enabled by @normanmaurer in https://github.com/netty/netty/pull/17460
• Add regression tests for CANCEL_PUSH/GOAWAY/MAX_PUSH_ID trailing bytes by @normanmaurer in https://github.com/netty/netty/pull/17571
• Use 2 EventLoops when running our tests by default by @normanmaurer in https://github.com/netty/netty/pull/17567
• Fix flaky HttpToHttp2ConnectionHandlerTest.testChunkedRequestWithBodyAndTrailingHeaders by @normanmaurer in https://github.com/netty/netty/pull/17590
• Http2ConnectionHandler: report at most one stream error for a CompositeStreamException by @normanmaurer in https://github.com/netty/netty/pull/17470
• Http2MultiplexTransportTest: Fix possible SslContext leak in tests by @normanmaurer in https://github.com/netty/netty/pull/17597
• Restore configurable ioRatio-based task scheduling in SingleThreadIoEventLoop by @normanmaurer in https://github.com/netty/netty/pull/17481
• Support creating a PropertyKey that is not tied to a specific Http2Connection by @normanmaurer in https://github.com/netty/netty/pull/17594
• Reset LengthFieldBasedFrameDecoder state when the frame is shorter than initialBytesToStrip by @allthingssecurity in https://github.com/netty/netty/pull/17606
• Auto-port 4.2: SingleThreadEventExecutor: fix race between suspend and cancellation … by @netty-project-bot in https://github.com/netty/netty/pull/17601
• Fix ByteBuf.setBytes(int, ByteBuffer) when the source is the buffer's own internal NIO buffer by @laosijikaichele in https://github.com/netty/netty/pull/17618
• Add missing bounds check to AdaptiveByteBuf.getBytes(...) channel variants by @laosijikaichele in https://github.com/netty/netty/pull/17620
• SingleThreadEventExecutor: fix remaining suspend/cancellation race by @normanmaurer in https://github.com/netty/netty/pull/17627
• Update lz4-java to 1.12.0 by @yawkat in https://github.com/netty/netty/pull/17631
• Fix connection error scope for SETTINGS_INITIAL_WINDOW_SIZE overflow issue by @skyguard1 in https://github.com/netty/netty/pull/17602
• HTTP/2: Fix stream stall when toggling auto-read on a child channel by @pandareen in https://github.com/netty/netty/pull/17617
• Run the Linux test legs on ubuntu-24.04 so io_uring buffer ring tests execute by @franz1981 in https://github.com/netty/netty/pull/17637
• Update quiche to a new version 0.30.0 by @sanjomo in https://github.com/netty/netty/pull/17642
• No need to call clear() on ByteBuffer after AdaptiveByteBuf.internalNioBuffer() by @laosijikaichele in https://github.com/netty/netty/pull/17619
• Don't strand tasks when trySuspend() races with startThread() by @allthingssecurity in https://github.com/netty/netty/pull/17608
• Use assertInstanceOf/assertThrows instead of assertTrue/fail idioms in tests by @normanmaurer in https://github.com/netty/netty/pull/17633
• PendingWriteQueue: unlink the write before failing it in removeAndFail by @allthingssecurity in https://github.com/netty/netty/pull/17657
• Don't lose HashedWheelTimer timeouts that race with stop() by @allthingssecurity in https://github.com/netty/netty/pull/17610
• Don't corrupt the pipeline when a handler context is removed twice by @allthingssecurity in https://github.com/netty/netty/pull/17643
• LocalChannel: complete connect() when the accepted channel dies before registration by @allthingssecurity in https://github.com/netty/netty/pull/17656
• Don't leak FixedChannelPool slots on unrelated IllegalArgumentException by @allthingssecurity in https://github.com/netty/netty/pull/17609
• Don't leak queued writes in ChunkedWriteHandler on removal or cancel by @allthingssecurity in https://github.com/netty/netty/pull/17663
• Honour the needle's reader index in ByteBufUtil.indexOf(ByteBuf, ByteBuf) by @allthingssecurity in https://github.com/netty/netty/pull/17682
• Close idle outbound HTTP/2 child channels when the parent closes by @allthingssecurity in https://github.com/netty/netty/pull/17679
• Only fail in ZlibDecoder when the decompression buffer is full by @allthingssecurity in https://github.com/netty/netty/pull/17692
• Fail pending writes of ProxyHandler when it is removed by @allthingssecurity in https://github.com/netty/netty/pull/17691
• Use LocalIoHandler instead of DefaultEventLoop for LocalChannel tests in codec-http2 by @normanmaurer in https://github.com/netty/netty/pull/17697
• Arm force-close timeout when an inbound CLOSE frame is echoed by @normanmaurer in https://github.com/netty/netty/pull/17574
• Don't count STOMP headers again when the header block is replayed by @allthingssecurity in https://github.com/netty/netty/pull/17664
• Add script that allows to check if a user has signed the icla by @normanmaurer in https://github.com/netty/netty/pull/17711
• Complete HTTP/2 graceful close when the connection closes the last stream by @allthingssecurity in https://github.com/netty/netty/pull/17683
• Handle ed25519 and ed448 names in SignatureAlgorithmConverter by @eager-signal in https://github.com/netty/netty/pull/17689
• MqttDecoder accepts malformed MQTT 5 property sections and reclassifies payload bytes as properties by @normanmaurer in https://github.com/netty/netty/pull/17714
• common: initialize SystemTicker at runtime in native images by @Asthenia0412 in https://github.com/netty/netty/pull/17677
• Don't corrupt ChannelOutboundBuffer when a cancelled write makes the channel writable by @allthingssecurity in https://github.com/netty/netty/pull/17702
• Fail ChunkedNioFile instead of spinning when the file is shorter than requested by @allthingssecurity in https://github.com/netty/netty/pull/17727
• Validate bzip2 Huffman table selector index before use by @normanmaurer in https://github.com/netty/netty/pull/17705
• Reset the permessage-deflate compressor after an empty final fragment by @allthingssecurity in https://github.com/netty/netty/pull/17681
• Only build and test the affected modules when validating PRs by @normanmaurer in https://github.com/netty/netty/pull/17736
• Fix racy DnsNameResolverTest.testNegativeTtl lifecycle observer checks by @normanmaurer in https://github.com/netty/netty/pull/17737
• Fix retainedSlice() of non-retained pooled derived buffers by @lhotari in https://github.com/netty/netty/pull/17759
• Build using powershell on Windows by @chrisvest in https://github.com/netty/netty/pull/17766
• Bulk merge changes for 4.2 by @normanmaurer in https://github.com/netty/netty/pull/17770

• @JunggiKim made their first contribution in https://github.com/netty/netty/pull/17400
• @hunseonglee made their first contribution in https://github.com/netty/netty/pull/17386
• @massiccio made their first contribution in https://github.com/netty/netty/pull/17457
• @ohchanKyu made their first contribution in https://github.com/netty/netty/pull/17456
• @octa-one made their first contribution in https://github.com/netty/netty/pull/17493
• @fudianchn made their first contribution in https://github.com/netty/netty/pull/17438
• @allthingssecurity made their first contribution in https://github.com/netty/netty/pull/17606
• @eager-signal made their first contribution in https://github.com/netty/netty/pull/17689
• @Asthenia0412 made their first contribution in https://github.com/netty/netty/pull/17677

Full Changelog: https://github.com/netty/netty/compare/netty-4.2.18.Final...netty-4.2.19.Final

• 8ba36d4: [build] Automated Dependency Update (#18124) (Selenium CI Bot) #18124
• 77e3a5f: [build] Automated Selenium Manager Update (Selenium CI Bot)
• 9fc36cc: [dotnet] [build] Escape macOS Edge browser path (#18126) (Nikolay Borisenko) #18126