• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

• Auto-port 4.1: Use X509ExtendedTrustManager in SSLErrorTest by @netty-project-bot in https://github.com/netty/netty/pull/17224
• Auto-port 4.1: Validate chunked-must-be-last regardless of HTTP version by @netty-project-bot in https://github.com/netty/netty/pull/17228
• Update junit version by @normanmaurer in https://github.com/netty/netty/pull/17233
• Auto-port 4.1: Add system property to disable RFC 6761 localhost resolution by @netty-project-bot in https://github.com/netty/netty/pull/17230
• Update setup-testlens to v1.9.4 (#17223) by @chrisvest in https://github.com/netty/netty/pull/17229
• Auto-port 4.1: Adjust failsafe plugin version to be in sync with surefire plugin by @netty-project-bot in https://github.com/netty/netty/pull/17241
• Auto-port 4.1: Release unsent LastHttpContent in HttpChunkedInput by @netty-project-bot in https://github.com/netty/netty/pull/17251
• Auto-port 4.1: HTTP/2: Release compressors after failed headers writes by @netty-project-bot in https://github.com/netty/netty/pull/17265
• Auto-port 4.1: HTTP/2: Prevent reentrant flush on writability change by @netty-project-bot in https://github.com/netty/netty/pull/17268
• Respect max messages per read in LocalServerChannel (#17255) by @normanmaurer in https://github.com/netty/netty/pull/17269
• Auto-port 4.1: HTTP: Preserve encoder state after header encoding failures by @netty-project-bot in https://github.com/netty/netty/pull/17275
• Bzip2: Correctly detect overflow during block size bound check (#17261) by @normanmaurer in https://github.com/netty/netty/pull/17273
• Auto-port 4.1: HTTP/2: Drain queued frames stranded by a writability change during flush by @netty-project-bot in https://github.com/netty/netty/pull/17280
• Port to 4.1: Add clock skew tolerance to OcspServerCertificateValidator by @normanmaurer in https://github.com/netty/netty/pull/17282
• Extract Bootstrap and ServerBootstrap setup to a common method (#15134) by @normanmaurer in https://github.com/netty/netty/pull/17289
• Release channel when FixedChannelPool acquire is cancelled (#17287) by @normanmaurer in https://github.com/netty/netty/pull/17291
• Auto-port 4.1: HTTP: Release content encoder after header mutation failure by @netty-project-bot in https://github.com/netty/netty/pull/17294
• Auto-port 4.1: Add a script that can download GHSA vulnerability reports by @netty-project-bot in https://github.com/netty/netty/pull/17302
• Auto-port 4.1: FileRegion: Remove outdated JDK upgrade warning by @netty-project-bot in https://github.com/netty/netty/pull/17311
• Auto-port 4.1: codec-dns: Fix query OPCODE bit offset and mask by @netty-project-bot in https://github.com/netty/netty/pull/17316
• Auto-port 4.1: Install patchelf as part of awslc docker image generation by @netty-project-bot in https://github.com/netty/netty/pull/17322
• Auto-port 4.1: POOL: Close active unhealthy channels on release by @netty-project-bot in https://github.com/netty/netty/pull/17319
• Update to use graal 21 by @normanmaurer in https://github.com/netty/netty/pull/17327
• Auto-port 4.1: Add more logging to CompositeBufferGatheringWriteTest to help diagnose flaky test by @netty-project-bot in https://github.com/netty/netty/pull/17329
• Fix graal docker file usage by @normanmaurer in https://github.com/netty/netty/pull/17333
• Auto-port 4.1: codec-dns: Report and allow setting full 16-bit EDNS(0) flags field by @netty-project-bot in https://github.com/netty/netty/pull/17332
• Kqueue: Continue reading when EOF is received before notify about channel inactivity by @normanmaurer in https://github.com/netty/netty/pull/17309
• Auto-port 4.1: Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch) by @netty-project-bot in https://github.com/netty/netty/pull/17338
• Auto-port 4.1: Increase timeout in test to address flakyness by @netty-project-bot in https://github.com/netty/netty/pull/17345
• Auto-port 4.1: DatagramUnicastIpv6MappedTest should explicit bind to ipv4 address to make test less flaky by @netty-project-bot in https://github.com/netty/netty/pull/17347
• Close Channel when connect is cancelled during resolution (#17321) by @normanmaurer in https://github.com/netty/netty/pull/17349
• Auto-port 4.1: Channel: Add unit tests for AbstractChannel edge-case failures and buffer releases by @netty-project-bot in https://github.com/netty/netty/pull/17351
• Auto-port 4.1: Http2: Cleanup child channel method signatures by @netty-project-bot in https://github.com/netty/netty/pull/17355
• Auto-port 4.1: Update to latest netty-tcnative release by @netty-project-bot in https://github.com/netty/netty/pull/17361
• Auto-port 4.1: Update to latest netty-jni-util release by @netty-project-bot in https://github.com/netty/netty/pull/17365
• Fix JdkZlibDecoder silently truncating highly compressible streams by @renechoi in https://github.com/netty/netty/pull/17364
• Auto-port 4.1: ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is enough by @netty-project-bot in https://github.com/netty/netty/pull/17369
• Auto-port 4.1: Update to latest netty tcnative version by @netty-project-bot in https://github.com/netty/netty/pull/17398
• Bulk merge for 4.1 by @normanmaurer in https://github.com/netty/netty/pull/17403

Full Changelog: https://github.com/netty/netty/compare/netty-4.1.137.Final...netty-4.1.138.Final

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

• Use X509ExtendedTrustManager in SSLErrorTest by @normanmaurer in https://github.com/netty/netty/pull/17221
• Update setup-testlens to v1.9.4 by @marcphilipp in https://github.com/netty/netty/pull/17223
• Update lz4-java to 1.11.2 by @yawkat in https://github.com/netty/netty/pull/17222
• Validate chunked-must-be-last regardless of HTTP version by @husseinvr97 in https://github.com/netty/netty/pull/17055
• Add system property to disable RFC 6761 localhost resolution by @BoxJReilly in https://github.com/netty/netty/pull/17100
• Use VarHandle JCTools queues without Unsafe by @arnabnandy7 in https://github.com/netty/netty/pull/17185
• Adjust failsafe plugin version to be in sync with surefire plugin by @normanmaurer in https://github.com/netty/netty/pull/17236
• Fix NPE in AbstractNioChannel.removeReadOp() after concurrent deregistration by @seonwooj0810 in https://github.com/netty/netty/pull/17104
• Fix codec-native-quic published POM packaging by @arnabnandy7 in https://github.com/netty/netty/pull/17235
• http3: marshal QPACK resume/drain to stream event loop (fixes #17234) by @arnabnandy7 in https://github.com/netty/netty/pull/17232
• Release unsent LastHttpContent in HttpChunkedInput by @Gimini-3 in https://github.com/netty/netty/pull/17240
• Ensure OCSP is also tested with out native implementation by @normanmaurer in https://github.com/netty/netty/pull/17220
• QUIC: Delete local references as soon as possible in the JNI layer by @normanmaurer in https://github.com/netty/netty/pull/17258
• Decouple QUIC token validation from ODCID derivation by @Zhengcy05 in https://github.com/netty/netty/pull/17035
• HTTP/2: Release compressors after failed headers writes by @Gimini-3 in https://github.com/netty/netty/pull/17253
• HTTP/2: Prevent reentrant flush on writability change by @arnabnandy7 in https://github.com/netty/netty/pull/17266
• Respect max messages per read in LocalServerChannel by @Gimini-3 in https://github.com/netty/netty/pull/17255
• Bzip2: Correctly detect overflow during block size bound check by @normanmaurer in https://github.com/netty/netty/pull/17261
• HTTP: Preserve encoder state after header encoding failures by @Gimini-3 in https://github.com/netty/netty/pull/17271
• HTTP/2: Drain queued frames stranded by a writability change during flush by @bryce-anderson in https://github.com/netty/netty/pull/17279
• OSCP: Add clock skew tolerance to OcspServerCertificateValidator by @chrisvest in https://github.com/netty/netty/pull/17277
• Release channel when FixedChannelPool acquire is cancelled by @Gimini-3 in https://github.com/netty/netty/pull/17287
• HTTP: Release content encoder after header mutation failure by @Gimini-3 in https://github.com/netty/netty/pull/17292
• Correctly mark org.jctools:jctools-core-jdk11 as non optional by @normanmaurer in https://github.com/netty/netty/pull/17263
• Update flatten plugin and use flattenDependecyMode direct by @normanmaurer in https://github.com/netty/netty/pull/17296
• Add a script that can download GHSA vulnerability reports by @chrisvest in https://github.com/netty/netty/pull/17297
• FileRegion: Remove outdated JDK upgrade warning by @arnabnandy7 in https://github.com/netty/netty/pull/17308
• codec-dns: Fix query OPCODE bit offset and mask by @hyperxpro in https://github.com/netty/netty/pull/17314
• POOL: Close active unhealthy channels on release by @Gimini-3 in https://github.com/netty/netty/pull/17306
• QPACK: Correctly encode varint even when remainder is 128 by @normanmaurer in https://github.com/netty/netty/pull/17310
• Install patchelf as part of awslc docker image generation by @normanmaurer in https://github.com/netty/netty/pull/17317
• Add more logging to CompositeBufferGatheringWriteTest to help diagnose flaky test by @normanmaurer in https://github.com/netty/netty/pull/17313
• codec-dns: Report and allow setting full 16-bit EDNS(0) flags field by @hyperxpro in https://github.com/netty/netty/pull/17325
• Protobuf: Update protobuf-javanano to non alpha release by @normanmaurer in https://github.com/netty/netty/pull/17330
• Port EOF handling test by @normanmaurer in https://github.com/netty/netty/pull/17336
• Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch) by @dometec in https://github.com/netty/netty/pull/17105
• io_uring: do not release write memory that the kernel still owns by @HwangRock in https://github.com/netty/netty/pull/17238
• DatagramUnicastIpv6MappedTest should explicit bind to ipv4 address to make test less flaky by @normanmaurer in https://github.com/netty/netty/pull/17343
• Auto-port 4.2: Increase timeout in test to address flakyness by @netty-project-bot in https://github.com/netty/netty/pull/17344
• Close Channel when connect is cancelled during resolution by @Gimini-3 in https://github.com/netty/netty/pull/17321
• Channel: Add unit tests for AbstractChannel edge-case failures and buffer releases by @rajan-github in https://github.com/netty/netty/pull/17340
• Http2: Cleanup child channel method signatures by @normanmaurer in https://github.com/netty/netty/pull/17350
• QPACK: Only call firstByteEquals(...) when we actually have readables bytes in decodeLiteralValue(...) by @normanmaurer in https://github.com/netty/netty/pull/17352
• Update to latest netty-tcnative release by @normanmaurer in https://github.com/netty/netty/pull/17359
• Update to latest netty-jni-util release by @normanmaurer in https://github.com/netty/netty/pull/17363
• Make the Linux codec-native-quic artifacts loadable on musl (Alpine) by @fredericgermain in https://github.com/netty/netty/pull/17348
• ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is enough by @panchenko in https://github.com/netty/netty/pull/17357
• IoUring: Expose tcp_info by @normanmaurer in https://github.com/netty/netty/pull/17354
• Auto-port 4.2: Fix JdkZlibDecoder silently truncating highly compressible streams by @netty-project-bot in https://github.com/netty/netty/pull/17370
• Add missing EOF handling test for io_uring by @normanmaurer in https://github.com/netty/netty/pull/17374
• QUIC: Add missing NULL checks in native code to handle gracefully OOM by @normanmaurer in https://github.com/netty/netty/pull/17378
• Fix JZlibDecoder truncating highly compressible streams by @renechoi in https://github.com/netty/netty/pull/17392
• Fix typos in comments/javadoc by @TianHengZhuang in https://github.com/netty/netty/pull/17390
• Update to latest netty tcnative version by @normanmaurer in https://github.com/netty/netty/pull/17395
• Update quiche to 0.29.2 by @normanmaurer in https://github.com/netty/netty/pull/17393
• Bulk merge for 4.2 by @normanmaurer in https://github.com/netty/netty/pull/17402

• @marcphilipp made their first contribution in https://github.com/netty/netty/pull/17223
• @BoxJReilly made their first contribution in https://github.com/netty/netty/pull/17100
• @arnabnandy7 made their first contribution in https://github.com/netty/netty/pull/17185
• @Gimini-3 made their first contribution in https://github.com/netty/netty/pull/17240
• @Zhengcy05 made their first contribution in https://github.com/netty/netty/pull/17035
• @dometec made their first contribution in https://github.com/netty/netty/pull/17105
• @fredericgermain made their first contribution in https://github.com/netty/netty/pull/17348
• @panchenko made their first contribution in https://github.com/netty/netty/pull/17357
• @TianHengZhuang made their first contribution in https://github.com/netty/netty/pull/17390

Full Changelog: https://github.com/netty/netty/compare/netty-4.2.17.Final...netty-4.2.18.Final

Java     |     Python     |     DotNet     |     Ruby     |     JavaScript

• [build] improve pre-release workflow ordering by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17963
• [build] track the generated BiDi schema by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17962
• [dotnet] [bidi] Fix various missing fields in DTO by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17961
• [dotnet] [bidi] Fix mismatch of proxy json property names by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17960
• [dotnet] [bidi] Fix realm type enum serialization by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17959
• [dotnet] [bidi] Fix NamespaceUri json property name by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17958
• [dotnet] [bidi] Avoid massive command descriptors allocation by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17965
• [dotnet] [bidi] Add browsing context screencast support by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17941
• [js][py] Capitalize non-Latin text in the getVisibleText atom by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17964
• [js][py][rb] derive BiDi field names and enum value types in the schema by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17966
• [py] chore fix for unreachable mypy warnings by @iampopovich in https://github.com/SeleniumHQ/selenium/pull/17969
• [py] wire print_pdf_tests.py into the browser test suites by @diemol in https://github.com/SeleniumHQ/selenium/pull/17976
• [build] generate compact execution log by @iamricard in https://github.com/SeleniumHQ/selenium/pull/17977
• [py] chore: enable mypy disallow untyped decorators and update type hints by @iampopovich in https://github.com/SeleniumHQ/selenium/pull/17974
• [grid] Fix 500 when downloading a file whose name contains spaces by @ashrafiucse in https://github.com/SeleniumHQ/selenium/pull/17968
• [java] add the LICENSE and NOTICE files to the jars created by @joerg1985 in https://github.com/SeleniumHQ/selenium/pull/17601
• [java] Remove deprecated GET /session/{sessionId}/se/files/{fileName} endpoint by @diemol in https://github.com/SeleniumHQ/selenium/pull/17982
• [java] shrink published javadoc jars by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17957
• [build] pin the rules_rs zlib bootstrap to an immutable snapshot by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17985
• [build] add a daily workflow to update the pinned CDDL specs by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17972
• [rust] fix Windows architecture detection under WOW64 by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17987
• [build] build Selenium Manager Linux binaries natively and pin the Rust toolchain by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17988
• [py] run the BiDi tests against the Grid server by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17980
• [py] fix flaky BiDi input tests that raced the page's autofocus by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17981
• [py] raise typed WebDriver errors for BiDi wire error codes by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17952
• [build] bump rules_rs to 0.0.108 by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17997
• [py] remove stale xfail markers from python tests by @aayushisabharwal in https://github.com/SeleniumHQ/selenium/pull/18002
• [build] populate linux bazel cache from gh-cache workflow instead of RBE by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/18003
• [dotnet] only embed the git revision in SourceLink metadata when stamping by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/18004
• [build] run Rust tests and build Selenium Manager from source on Windows by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17998
• [build] ship prebuilt Selenium Manager Linux arm64 binary in all bindings by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17999
• [java] remove try-catch while opening a new window #17754 by @joerg1985 in https://github.com/SeleniumHQ/selenium/pull/17996
• [build] add Launchpad fallback for the rules_rs zlib .deb fetch by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18006
• [build] Upgrade rules_rs to 0.0.109 and @llvm to 0.8.19 by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17929
• [py] add BiDi upload tests that verify files actually reach the server by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18007
• [rust] Add license and notice links to Selenium Manager help by @shubmittal in https://github.com/SeleniumHQ/selenium/pull/17986
• [rust] Add support for Chrome arm64 on Linux by @dennisameling in https://github.com/SeleniumHQ/selenium/pull/17915
• [java] remove let's guess URI encoding by @joerg1985 in https://github.com/SeleniumHQ/selenium/pull/17995
• [py] adopt the worthwhile ruff 0.16 rule families (tranches 1 and 2) by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17992

• @iamricard made their first contribution in https://github.com/SeleniumHQ/selenium/pull/17977
• @ashrafiucse made their first contribution in https://github.com/SeleniumHQ/selenium/pull/17968
• @aayushisabharwal made their first contribution in https://github.com/SeleniumHQ/selenium/pull/18002
• @shubmittal made their first contribution in https://github.com/SeleniumHQ/selenium/pull/17986

Full Changelog: https://github.com/SeleniumHQ/selenium/compare/selenium-4.48.0...selenium-4.49.0

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.581...7.21.0-rc.582

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.580...7.21.0-rc.581

• f4721fd: [build] Automated Dependency Update (#17991) (Selenium CI Bot) #17991
• 6776d37: [build] Automated CDDL Spec Update (#17990) (Selenium CI Bot) #17990
• 2914f73: [build] Automated Browser Version Update (#18000) (Selenium CI Bot) #18000
• 6147f47: [py] remove stale xfail markers from python tests (#18002) (aayushisabharwal) #18002
• fb8ae46: [build] populate linux bazel cache from gh-cache workflow instead of RBE (#18003) (Titus Fortner) #18003
• 59ea9e0: [rb] stop serializing BiDi and DevTools specs under remote execution (Titus Fortner)
• c756287: [dotnet] only embed the git revision in SourceLink metadata when stamping (#18004) (Titus Fortner) #18004
• e92d6a3: [build] verify Java releases by Sonatype deployment state instead of Maven Central sync (Titus Fortner)
• 438558b: [build] run Rust tests and build Selenium Manager from source on Windows (#17998) (Titus Fortner) #17998
• 0aaee1e: [build] ship prebuilt Selenium Manager Linux arm64 binary in all bindings (#17999) (Titus Fortner) #17999
• 52cc0e8: [build] update Selenium Manager pins to the arm64-named release (Titus Fortner)
• 96a38b5: [java] remove try-catch while opening a new window #17754 (#17996) (joerg1985) #17996
• 70689a4: [build] fetch CDP protocol files through the GitHub API when a token is available (Titus Fortner)

• build(deps): bump the github-actions group across 1 directory with 15 updates by @dependabot[bot] in https://github.com/Activiti/Activiti/pull/5526
• build(deps): bump actions/setup-java from 5.7.0 to 6.0.0 in /.github/actions/setup-java-maven by @dependabot[bot] in https://github.com/Activiti/Activiti/pull/5528
• build(deps): bump actions/setup-java from 5.7.0 to 6.0.0 by @dependabot[bot] in https://github.com/Activiti/Activiti/pull/5527
• build(deps-dev): bump org.owasp:dependency-check-maven from 12.2.2 to 13.0.0 by @dependabot[bot] in https://github.com/Activiti/Activiti/pull/5508

• AAE-49678 Update Supply Chain Review GH AW to latest by @dsibilio in https://github.com/Activiti/Activiti/pull/5530
• AAE-51268 Improve output mapping expression error message and add test coverage by @eromano with @Copilot in https://github.com/Activiti/Activiti/pull/5531
• AAE-51133 Fix taskAssigneeLike in OR queries by @souvikpanda99 in https://github.com/Activiti/Activiti/pull/5525

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.579...7.21.0-rc.580

Added

• chore: update bouncycastle version #801 (tanya732)
• Bump com.fasterxml.jackson.core:jackson-core from 2.22.1 to 2.22.2 in /lib #797 (dependabot[bot])
• chore: remove unused imports #794 credits - Zichen1028 🙌