Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.771...7.21.0-rc.772

• https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77 - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8 - insufficient entropy in netty-resolver-dns
• https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x - unbounded memory usage in netty-codec-http2
• https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj - insufficient control character neutralization in netty-codec-http
• https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948 - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q - unbounded memory usage in netty-codec-mqtt
• https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc - mTLS auth bypass via session resumption in netty-handler

• Auto-port 4.1: Reject Redis lines that start with LF by @netty-project-bot in https://github.com/netty/netty/pull/17806
• Auto-port 4.1: Do not let a negatively cached search domain shadow a positive one by @netty-project-bot in https://github.com/netty/netty/pull/17805
• Port 4.1: Choose server key types from client's signature algorithms for TLS 1.3 (#17764) by @normanmaurer in https://github.com/netty/netty/pull/17809
• Port 4.1: LocalChannel: Deliver data written by the peer before it closed (#17814) by @normanmaurer in https://github.com/netty/netty/pull/17815
• Port 4.1: Validate padding of HEADERS frames without priority (#17817) by @normanmaurer in https://github.com/netty/netty/pull/17819
• Port 4.1: Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing (#17728) by @normanmaurer in https://github.com/netty/netty/pull/17822
• Port 4.1: Preserve invalid SNI names in ReferenceCountedOpenSslEngine (#17781) by @normanmaurer in https://github.com/netty/netty/pull/17824
• Auto-port 4.1: Optimize redundant bounds checking in ByteBuf.setBytes by @netty-project-bot in https://github.com/netty/netty/pull/17827
• Port 4.1: Release the DNS response when a query future loses a cancel race (#17475) by @normanmaurer in https://github.com/netty/netty/pull/17828
• Auto-port 4.1: Fix HpackDynamicTable losing entries when filled to capacity by @netty-project-bot in https://github.com/netty/netty/pull/17846
• Port 4.1: Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address (#17820) by @normanmaurer in https://github.com/netty/netty/pull/17842
• Port 4.1: Handle ed25519 and ed448 names in SignatureAlgorithmConverter (#17689) by @normanmaurer in https://github.com/netty/netty/pull/17850
• Auto-port 4.1: HAProxyMessage: validate the length of all TLV types by @netty-project-bot in https://github.com/netty/netty/pull/17845
• Port 4.1: Validate bzip2 Huffman code lengths before building decode tables (#17812) by @normanmaurer in https://github.com/netty/netty/pull/17855
• Port 4.1: Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders (#17841) by @normanmaurer in https://github.com/netty/netty/pull/17854
• Port 4.1: Fix typos in comments/javadoc (#17390) by @normanmaurer in https://github.com/netty/netty/pull/17863
• Auto-port 4.1: HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by @netty-project-bot in https://github.com/netty/netty/pull/17860
• Port 4.1: Throw DecompressionException on JdkZlib preset dictionary mismatch (#17838) by @normanmaurer in https://github.com/netty/netty/pull/17864
• Port 4.1: Fix silent failures and optimize error short-circuit in multi-threaded tests (#17106) by @normanmaurer in https://github.com/netty/netty/pull/17865
• Port 4.1: Apply certificate list size floor (#17674) by @normanmaurer in https://github.com/netty/netty/pull/17861
• Auto-port 4.1: Reject HTTP version numbers that overflow int by @netty-project-bot in https://github.com/netty/netty/pull/17859
• Port 4.1: HAProxyMessage: decode TLVs with an empty value at the end of the header (#17835) by @normanmaurer in https://github.com/netty/netty/pull/17877
• Port 4.1: Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by @normanmaurer in https://github.com/netty/netty/pull/17881
• Auto-port 4.1: Reject invalid content-length in PUSH_PROMISE with a stream error by @netty-project-bot in https://github.com/netty/netty/pull/17875
• Auto-port 4.1: HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by @netty-project-bot in https://github.com/netty/netty/pull/17882
• Auto-port 4.1: IpSubnetFilter: Add tests for overlapping rules by @netty-project-bot in https://github.com/netty/netty/pull/17889
• Auto-port 4.1: Skip JNDI nameserver lookup on IBM i by @netty-project-bot in https://github.com/netty/netty/pull/17892
• Auto-port 4.1: Reset the h2c upgrade stream if the request can not be converted by @netty-project-bot in https://github.com/netty/netty/pull/17893
• Auto-port 4.1: Fix NPE in Http2FrameCodec when h2c upgrade fails by @netty-project-bot in https://github.com/netty/netty/pull/17899
• Auto-port 4.1: Don't size ZstdDecoder output buffers from the frame content size by @netty-project-bot in https://github.com/netty/netty/pull/17900
• Auto-port 4.1: Allow adaptive allocator magazine cleanup in BlockHound by @netty-project-bot in https://github.com/netty/netty/pull/17905
• Auto-port 4.1: Don't lose frames when a delimiter is split across reads by @netty-project-bot in https://github.com/netty/netty/pull/17909
• Port 4.1: Read SOCKS5 length octets unsigned in the legacy socks decoders (#17912) by @normanmaurer in https://github.com/netty/netty/pull/17916
• Port 4.1: Fix truncated output in Brotli decoders (#17870) by @normanmaurer in https://github.com/netty/netty/pull/17923
• Auto-port 4.1: Use assertInstanceOf/assertThrows instead of assertTrue/fail idioms in tests (#17633) by @normanmaurer in https://github.com/netty/netty/pull/17918
• Port: Wrap trailing ';' in Content-Disposition as ErrorDataDecoderException (#17895) by @chrisvest in https://github.com/netty/netty/pull/17931
• Port 4.1: Limit the number of queued tasks in NioEventLoopTest.testTaskRemovalOnShutdownThrowsNoUnsupportedOperationException (#17924) by @normanmaurer in https://github.com/netty/netty/pull/17930
• Kqueue: Deregister filters before closing the fd to avoid hitting a reused fd by @normanmaurer in https://github.com/netty/netty/pull/17939
• Auto-port 4.1: Keep WINDOW_UPDATE credit of reserved HTTP/2 streams on activation by @netty-project-bot in https://github.com/netty/netty/pull/17935
• Accept empty non-final fragments in PerMessageDeflateEncoder (#17943) by @chrisvest in https://github.com/netty/netty/pull/17953
• Verify toolchain downloads in release Dockerfiles against pinned SHA-256 (#17935) (#17940) by @normanmaurer in https://github.com/netty/netty/pull/17956
• Increase poll timeout in HttpContentCompressorTest.testExecutorPreserveOrdering by @normanmaurer in https://github.com/netty/netty/pull/17962
• Auto-port 4.1: HTTP/2: Don't pass the close promise to a deferred close by @netty-project-bot in https://github.com/netty/netty/pull/17959
• Port 4.1: Fix flaky Http2MultiplexTest.unhandledHttp2FramesShouldBePropagated (#17958) by @normanmaurer in https://github.com/netty/netty/pull/17964
• Auto-port 4.1: Kqueue: Add testsuite on macOS during PR validation by @netty-project-bot in https://github.com/netty/netty/pull/16471
• Auto-port 4.1: Fix endless value iterators in ReadOnlyHttpHeaders by @netty-project-bot in https://github.com/netty/netty/pull/17978
• Auto-port 4.1: Don't drop the last character in AsciiString.trim(CharSequence) by @netty-project-bot in https://github.com/netty/netty/pull/17993
• Auto-port 4.1: Fix the region copied by Unpooled.copiedBuffer(CharSequence, int, int, Charset) by @netty-project-bot in https://github.com/netty/netty/pull/17995
• Auto-port 4.1: Add HpackDecoder test for non-token HTTP/2 header names by @netty-project-bot in https://github.com/netty/netty/pull/17992
• Auto-port 4.1: Fix AsciiString.contains(...) false negatives after a partial match by @netty-project-bot in https://github.com/netty/netty/pull/17986
• Port 4.1: Fix flaky DatagramUnicastIPv6MappedTest on macOS (#17981) by @normanmaurer in https://github.com/netty/netty/pull/17989
• Auto-port 4.1: Treat DATA frames on reserved HTTP/2 streams as a connection error by @netty-project-bot in https://github.com/netty/netty/pull/17998
• Auto-port 4.1: Reject reply codes with non-digit characters in SmtpResponseDecoder by @netty-project-bot in https://github.com/netty/netty/pull/18005
• Port 4.1: Don't loop forever in AbstractDiskHttpData when the file is short (#17973) by @normanmaurer in https://github.com/netty/netty/pull/18004
• Auto-port 4.1: Http2: reject generic frames whose payload exceeds SETTINGS_MAX_FRAME_SIZE by @netty-project-bot in https://github.com/netty/netty/pull/18000
• Auto-port 4.1: Return null or the default from read-only headers for invalid values by @netty-project-bot in https://github.com/netty/netty/pull/18017
• Port 4.1: Check the second gzip magic byte in JdkZlibDecoder (#17972) by @normanmaurer in https://github.com/netty/netty/pull/18007
• Fix server-initiated WebSocket close handshake failing with "promise already done" (#17983) by @chrisvest in https://github.com/netty/netty/pull/18032
• Auto-port 4.1: Fix Snappy.encode(...) for input with a non-zero reader index by @netty-project-bot in https://github.com/netty/netty/pull/18031
• Auto-port 4.1: Cancel queued runs and runs of fork PRs when a PR is merged by @netty-project-bot in https://github.com/netty/netty/pull/18033
• Port 4.1: Don't use the network in the OCSP tests (#17908) (#17933) by @normanmaurer in https://github.com/netty/netty/pull/18038
• Port 4.1: MqttEncoder: Reject Variable Byte Integers larger than 268435455 (#17984) by @normanmaurer in https://github.com/netty/netty/pull/18025
• Port 4.1: Add test for DefaultFileRegion beyond 2 GiB and 4 GiB (#18018) by @normanmaurer in https://github.com/netty/netty/pull/18050
• Port 4.1: Only delete socket files when binding and closing UDS channels (#17980) by @normanmaurer in https://github.com/netty/netty/pull/18044
• Auto-port 4.1: Return the haystack's reader index from ByteBufUtil.indexOf(...) for an empty needle by @netty-project-bot in https://github.com/netty/netty/pull/18082
• Auto-port 4.1: Return -1 from StringUtil.decodeHexNibble(byte) for non-ASCII bytes by @netty-project-bot in https://github.com/netty/netty/pull/18083
• Auto-port 4.1: Fail to encode DNS messages that are too large for TCP by @netty-project-bot in https://github.com/netty/netty/pull/18081
• Auto-port 4.1: Don't return an entry twice when removing while iterating a primitive map by @netty-project-bot in https://github.com/netty/netty/pull/18087
• Auto-port 4.1: Mark disk-based HttpData as completed after setting empty content by @netty-project-bot in https://github.com/netty/netty/pull/18088
• Fix out-of-bounds read when validating UDS paths in the native code by @normanmaurer in https://github.com/netty/netty/pull/18016
• Auto-port 4.1: Release a SPDY DATA frame that exceeds the session window by @netty-project-bot in https://github.com/netty/netty/pull/18094
• Auto-port 4.1: Send zero-length datagrams instead of dropping or duplicating them by @netty-project-bot in https://github.com/netty/netty/pull/18107
• Auto-port 4.1: Reject request-only and response-only pseudo-headers in invalid contexts (RFC 9113) by @netty-project-bot in https://github.com/netty/netty/pull/18113
• Port 4.1: Read all pending data when the EOF is received before the connect is complete in kqueue (#18091) by @normanmaurer in https://github.com/netty/netty/pull/18116
• Port: Keep throttling the producer while the executor is shutting down in NioEventLoopTest (#18110) by @chrisvest in https://github.com/netty/netty/pull/18117
• Auto-port 4.1: Read the 4 byte Snappy literal length as unsigned by @netty-project-bot in https://github.com/netty/netty/pull/18120
• Port 4.1: Deliver all data a LocalChannel peer wrote before it closed (#18127) by @normanmaurer in https://github.com/netty/netty/pull/18128
• Port 4.1: Update sdkman sha (#18133) by @normanmaurer in https://github.com/netty/netty/pull/18136
• Auto-port 4.1: Update central-publishing-maven-plugin to 0.12.0 by @netty-project-bot in https://github.com/netty/netty/pull/18142
• Auto-port 4.1: Close an HTTP/2 stream only after its last merged DATA frame was written by @netty-project-bot in https://github.com/netty/netty/pull/18144
• Add JDK27 profiles by @chenrui333 in https://github.com/netty/netty/pull/18099
• Skip certificate verification when downloading the aarch64 toolchain by @normanmaurer in https://github.com/netty/netty/pull/18150
• Port 4.1: Use IP_MULTICAST_IF in leaveGroup and block without an interface (#18122) by @normanmaurer in https://github.com/netty/netty/pull/18152
• Auto-port 4.1: Don't lose the alert when the handshake fails in ReferenceCountedOpen… by @netty-project-bot in https://github.com/netty/netty/pull/18157
• Auto-port 4.1: Add guidance for LLM agents by @netty-project-bot in https://github.com/netty/netty/pull/18177
• Auto-port 4.1: Add a change review skill by @netty-project-bot in https://github.com/netty/netty/pull/18176
• Auto-port 4.1: Send bad_certificate alert when the TrustManager rejects the certificate by @netty-project-bot in https://github.com/netty/netty/pull/18181
• Quote revapi argument by @chrisvest in https://github.com/netty/netty/pull/18185
• Port: SslHandler: Size the unwrap output buffer for the plaintext, not the record (#18028) by @chrisvest in https://github.com/netty/netty/pull/18182
• Port: Add opt-in Origin validation to WebSocketServerProtocolHandler (hardening) (#17944) by @chrisvest in https://github.com/netty/netty/pull/18184
• Fix reporting of the wrong error when setting flags on an accepted fd fails by @normanmaurer in https://github.com/netty/netty/pull/18196
• Epoll: Verify the FileChannel is a FileChannelImpl before reading its fd by @normanmaurer in https://github.com/netty/netty/pull/18190
• KQueue: Verify the FileChannel is a FileChannelImpl before reading its fd by @normanmaurer in https://github.com/netty/netty/pull/18191
• Do not send uninitialized stack memory when sending a fd over a domain socket by @normanmaurer in https://github.com/netty/netty/pull/18197
• Fix read of uninitialized memory when accepting a connection on a domain socket by @normanmaurer in https://github.com/netty/netty/pull/18195
• Epoll: Fix signed integer overflow when calculating the epoll_wait timeout by @normanmaurer in https://github.com/netty/netty/pull/18194
• Fix underflow detection in netty_unix_util_timespec_subtract_ns by @normanmaurer in https://github.com/netty/netty/pull/18193
• Auto-port 4.1: Avoid reverse DNS lookup in IpSubnetFilterTest.testIpFilterRuleHandler by @netty-project-bot in https://github.com/netty/netty/pull/18200
• Port 4.1: Fix flaky SSLEngineTest.testSessionInvalidate with Conscrypt (#18198) by @normanmaurer in https://github.com/netty/netty/pull/18217
• Auto-port 4.1: Update to latest netty-jni-util release by @netty-project-bot in https://github.com/netty/netty/pull/18208
• Port 4.1: Don't encode Snappy copies with an offset that does not fit into 16 bits (#18055) by @normanmaurer in https://github.com/netty/netty/pull/18224
• Auto-port 4.1: Don't truncate binary memcache key and extras lengths by @netty-project-bot in https://github.com/netty/netty/pull/18225
• Auto-port 4.1: Revert "Update central-publishing-maven-plugin to 0.12.0 (#18140)" by @netty-project-bot in https://github.com/netty/netty/pull/18232
• Auto-port 4.1: Update to latest netty-tcnative release by @netty-project-bot in https://github.com/netty/netty/pull/18236
• 4.1 Merge fixes by @chrisvest in https://github.com/netty/netty/pull/18238

• @chenrui333 made their first contribution in https://github.com/netty/netty/pull/18099

Full Changelog: https://github.com/netty/netty/compare/netty-4.1.139.Final...netty-4.1.140.Final

• https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77 - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-v2v6-vch9-4pcg - inefficient CPU computation in netty-codec-http3
• https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8 - insufficient entropy in netty-resolver-dns
• https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x - unbounded memory usage in netty-codec-http2
• https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj - insufficient control character neutralization in netty-codec-http
• https://github.com/netty/netty/security/advisories/GHSA-w53r-xhgx-8582 - use-after-free in netty-codec-classes-quic
• https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948 - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q - unbounded memory usage in netty-codec-mqtt
• https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc - mTLS auth bypass via session resumption in netty-handler and netty-codec-quic

• IoUring: Fix empty writev submissions after sendmsg_zc by @dreamlike-ocean in https://github.com/netty/netty/pull/17782
• Do not let a negatively cached search domain shadow a positive one by @akilegaspi in https://github.com/netty/netty/pull/17623
• Fix musl verify job by @normanmaurer in https://github.com/netty/netty/pull/17801
• Reject Redis lines that start with LF by @yawkat in https://github.com/netty/netty/pull/17793
• Choose server key types from client's signature algorithms for TLS 1.3 by @eager-signal in https://github.com/netty/netty/pull/17764
• Port 4.2: LocalChannel: Deliver data written by the peer before it closed (#17814) by @normanmaurer in https://github.com/netty/netty/pull/17816
• Validate padding of HEADERS frames without priority by @bryce-anderson in https://github.com/netty/netty/pull/17817
• Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing by @allthingssecurity in https://github.com/netty/netty/pull/17728
• Preserve invalid SNI names in ReferenceCountedOpenSslEngine by @gavinbunney in https://github.com/netty/netty/pull/17781
• Optimize redundant bounds checking in ByteBuf.setBytes by @vpelikh in https://github.com/netty/netty/pull/17023
• Respect SETTINGS_QPACK_BLOCKED_STREAMS for unacknowledged QPACK entries by @allthingssecurity in https://github.com/netty/netty/pull/17754
• Release the DNS response when a query future loses a cancel race by @watson-ryan in https://github.com/netty/netty/pull/17475
• Lazily instantiate VarHandle JCTools queues via holder class by @arnabnandy7 in https://github.com/netty/netty/pull/17750
• Keep reading a closed QUIC stream until the end of its input by @allthingssecurity in https://github.com/netty/netty/pull/17755
• Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address by @normanmaurer in https://github.com/netty/netty/pull/17820
• HAProxyMessage: validate the length of all TLV types by @yawkat in https://github.com/netty/netty/pull/17834
• Fix HpackDynamicTable losing entries when filled to capacity by @yawkat in https://github.com/netty/netty/pull/17831
• Make AdaptiveByteBuf.memoryAddress() faster by @lhotari in https://github.com/netty/netty/pull/17767
• Validate bzip2 Huffman code lengths before building decode tables by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/17812
• Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders by @normanmaurer in https://github.com/netty/netty/pull/17841
• Throw DecompressionException on JdkZlib preset dictionary mismatch by @yawkat in https://github.com/netty/netty/pull/17838
• Reject HTTP version numbers that overflow int by @yawkat in https://github.com/netty/netty/pull/17836
• Apply certificate list size floor by @arnabnandy7 in https://github.com/netty/netty/pull/17674
• HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by @yawkat in https://github.com/netty/netty/pull/17837
• HAProxyMessage: decode TLVs with an empty value at the end of the header by @yawkat in https://github.com/netty/netty/pull/17835
• Reject invalid content-length in PUSH_PROMISE with a stream error by @yawkat in https://github.com/netty/netty/pull/17867
• Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by @yawkat in https://github.com/netty/netty/pull/17866
• HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by @yawkat in https://github.com/netty/netty/pull/17832
• IpSubnetFilter: Add tests for overlapping rules by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/17765
• Avoid allocating NIO buffer views in AdaptiveByteBuf.setBytes(int, ByteBuf, int, int) by @lhotari in https://github.com/netty/netty/pull/17840
• Skip JNDI nameserver lookup on IBM i by @manish-9245 in https://github.com/netty/netty/pull/17872
• Reset the h2c upgrade stream if the request can not be converted by @yawkat in https://github.com/netty/netty/pull/17869
• Don't size ZstdDecoder output buffers from the frame content size by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/17896
• Fix NPE in Http2FrameCodec when h2c upgrade fails by @yawkat in https://github.com/netty/netty/pull/17871
• Allow adaptive allocator magazine cleanup in BlockHound by @cj848 in https://github.com/netty/netty/pull/17849
• GroupsConverter: fix the x25519mlkem768 group name by @normanmaurer in https://github.com/netty/netty/pull/17898
• Don't count insertions twice in QPACK Insert Count Increments by @allthingssecurity in https://github.com/netty/netty/pull/17756
• Don't lose frames when a delimiter is split across reads by @allthingssecurity in https://github.com/netty/netty/pull/17665
• Register JFR events only once a Flight Recorder exists by @yawkat in https://github.com/netty/netty/pull/17614
• Improve OcspServerCertificateValidatorTest.connectUsingHttpAndValidateCertificateUsingOcspTest() by @normanmaurer in https://github.com/netty/netty/pull/17913
• Don't use the network in OcspClientTest.simpleOcspQueryTest by @normanmaurer in https://github.com/netty/netty/pull/17908
• Read SOCKS5 length octets unsigned in the legacy socks decoders by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/17912
• Fix truncated output in Brotli decoders by @yawkat in https://github.com/netty/netty/pull/17870
• Reject truncated QPACK prefixed integers in field section decode by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/17778
• Resolve malloc/free via dlsym(RTLD_DEFAULT) in CleanerJava24Linker by @jwils in https://github.com/netty/netty/pull/17811
• Wrap trailing ';' in Content-Disposition as ErrorDataDecoderException by @HwangRock in https://github.com/netty/netty/pull/17895
• Auto-port 4.2: Limit the number of queued tasks in NioEventLoopTest.testTaskRemovalOnShutdownThrowsNoUnsupportedOperationException by @netty-project-bot in https://github.com/netty/netty/pull/17927
• Avoid reflection when obtaining the process ID on Java 9+ by @zsewasdsdsd in https://github.com/netty/netty/pull/17873
• Keep WINDOW_UPDATE credit of reserved HTTP/2 streams on activation by @allthingssecurity in https://github.com/netty/netty/pull/17611
• IoUring: Apply IOV_MAX to each write instead of to all writes until submit by @dreamlike-ocean in https://github.com/netty/netty/pull/17932
• Add consistent TLS certificate compression support by @arnabnandy7 in https://github.com/netty/netty/pull/17548
• Port 4.2: Don't use the network in OcspServerCertificateValidatorTest.connectUsingHttpAndValidateCertificateUsingOcspTest (#17933) by @normanmaurer in https://github.com/netty/netty/pull/17941
• Avoid unnecessary String allocation in WebSocketServerProtocolHandshakeHandler by @fru1tworld in https://github.com/netty/netty/pull/16666
• Port 4.2: io_uring: Don't let msgHdrMemoryArray() clear the iovecs of a pending zero-copy write (#17937) by @normanmaurer in https://github.com/netty/netty/pull/17946
• Refresh CA bundle before downloading the aarch64 GCC toolchain by @normanmaurer in https://github.com/netty/netty/pull/17948
• Accept empty non-final fragments in PerMessageDeflateEncoder by @normanmaurer in https://github.com/netty/netty/pull/17943
• Exclude the ProcessHandle stub from Surefire in common and buffer by @franz1981 in https://github.com/netty/netty/pull/17949
• Verify toolchain downloads in release Dockerfiles against pinned SHA-256 (#17935) by @normanmaurer in https://github.com/netty/netty/pull/17940
• HTTP/2: Don't pass the close promise to a deferred close by @idelpivnitskiy in https://github.com/netty/netty/pull/17955
• Port 4.2: Fix flaky Http2MultiplexTest.unhandledHttp2FramesShouldBePropagated (#17958) by @normanmaurer in https://github.com/netty/netty/pull/17966
• Fix endless value iterators in ReadOnlyHttpHeaders by @CCCLL in https://github.com/netty/netty/pull/17961
• Hash all 8-byte blocks in SipHash.macHash(...) when position is not 0 by @Marti2203 in https://github.com/netty/netty/pull/17974
• Fix AsciiString.contains(...) false negatives after a partial match by @CCCLL in https://github.com/netty/netty/pull/17975
• Auto-port 4.2: Increase poll timeout in HttpContentCompressorTest.testExecutorPreserveOrdering by @netty-project-bot in https://github.com/netty/netty/pull/17976
• Don't invert IP_MULTICAST_LOOP_DISABLED in NioDatagramChannelConfig by @Marti2203 in https://github.com/netty/netty/pull/17969
• Fix flaky DatagramUnicastIPv6MappedTest on macOS by @normanmaurer in https://github.com/netty/netty/pull/17981
• Add HpackDecoder test for non-token HTTP/2 header names by @normanmaurer in https://github.com/netty/netty/pull/17979
• Don't drop the last character in AsciiString.trim(CharSequence) by @Marti2203 in https://github.com/netty/netty/pull/17968
• Fix the region copied by Unpooled.copiedBuffer(CharSequence, int, int, Charset) by @Marti2203 in https://github.com/netty/netty/pull/17971
• Port 4.1: Don't invert IP_MULTICAST_LOOP_DISABLED in NioDatagramChann… by @normanmaurer in https://github.com/netty/netty/pull/17991
• Treat DATA frames on reserved HTTP/2 streams as a connection error by @yawkat in https://github.com/netty/netty/pull/17868
• Http2: reject generic frames whose payload exceeds SETTINGS_MAX_FRAME_SIZE by @AbhishekShukla1289 in https://github.com/netty/netty/pull/17779
• Don't loop forever in AbstractDiskHttpData when the file is short by @Marti2203 in https://github.com/netty/netty/pull/17973
• Check the second gzip magic byte in JdkZlibDecoder by @Marti2203 in https://github.com/netty/netty/pull/17972
• Reject reply codes with non-digit characters in SmtpResponseDecoder by @Marti2203 in https://github.com/netty/netty/pull/17970
• Return null or the default from read-only headers for invalid values by @CCCLL in https://github.com/netty/netty/pull/17967
• MqttEncoder: Reject Variable Byte Integers larger than 268435455 by @normanmaurer in https://github.com/netty/netty/pull/17984
• Fix server-initiated WebSocket close handshake failing with "promise already done" by @normanmaurer in https://github.com/netty/netty/pull/17983
• Fix Snappy.encode(...) for input with a non-zero reader index by @Marti2203 in https://github.com/netty/netty/pull/18019
• Fill every remaining byte in the Java 8 SplittableRandom.nextBytes fallback by @Marti2203 in https://github.com/netty/netty/pull/18009
• Cancel queued runs and runs of fork PRs when a PR is merged by @normanmaurer in https://github.com/netty/netty/pull/18026
• Complete the TCP fast open connect before notifying the initial write by @normanmaurer in https://github.com/netty/netty/pull/18008
• Only delete socket files when binding and closing UDS channels by @normanmaurer in https://github.com/netty/netty/pull/17980
• Port 4.1: Complete the TCP fast open connect before notifying the initial write… by @normanmaurer in https://github.com/netty/netty/pull/18039
• Use a long file offset when splicing a DefaultFileRegion with io_uring by @Marti2203 in https://github.com/netty/netty/pull/18018
• Read tv_nsec from the correct offset in QuicheSendInfo.getAtNanos by @normanmaurer in https://github.com/netty/netty/pull/18045
• Don't truncate the token length of QUIC Initial packets to an int by @normanmaurer in https://github.com/netty/netty/pull/18046
• Port 4.1: Don't use the network in testsuite-jpms OCSPTest (#18043) by @normanmaurer in https://github.com/netty/netty/pull/18051
• Don't use a negative index in QuicCodecDispatcher by @normanmaurer in https://github.com/netty/netty/pull/18048
• Reject too long UDS paths in sendTo instead of truncating them by @normanmaurer in https://github.com/netty/netty/pull/18022
• Fix FastLz.readU16 when the reader index is not 0 by @normanmaurer in https://github.com/netty/netty/pull/18054
• Fail to encode DNS messages that are too large for TCP by @normanmaurer in https://github.com/netty/netty/pull/18058
• Return the haystack's reader index from ByteBufUtil.indexOf(...) for an empty needle by @CCCLL in https://github.com/netty/netty/pull/18073
• Return -1 from StringUtil.decodeHexNibble(byte) for non-ASCII bytes by @CCCLL in https://github.com/netty/netty/pull/18072
• Fix flaky AutoScalingEventExecutorChooserFactoryTest on Windows by @normanmaurer in https://github.com/netty/netty/pull/18079
• Port 4.1: Fix FastLz.readU16 when the reader index is not 0 (#18054) by @normanmaurer in https://github.com/netty/netty/pull/18077
• Port 4.1: Reject too long UDS paths in sendTo instead of truncating t… by @normanmaurer in https://github.com/netty/netty/pull/18076
• Don't return an entry twice when removing while iterating a primitive map by @CCCLL in https://github.com/netty/netty/pull/18070
• Mark disk-based HttpData as completed after setting empty content by @CCCLL in https://github.com/netty/netty/pull/18069
• Don't sign-extend the trailing bytes in SipHash by @normanmaurer in https://github.com/netty/netty/pull/18047
• Release a SPDY DATA frame that exceeds the session window by @Marti2203 in https://github.com/netty/netty/pull/18089
• Port 4.2: Fix out-of-bounds read when validating UDS paths in the native code (#18016) by @normanmaurer in https://github.com/netty/netty/pull/18096
• Update Brotli4j version to 1.24.0 by @hyperxpro in https://github.com/netty/netty/pull/18097
• Grow KQueueEventArray correctly in realloc by @normanmaurer in https://github.com/netty/netty/pull/18102
• Update Brotli4j version to 1.24.0 (#18097) by @normanmaurer in https://github.com/netty/netty/pull/18104
• Port 4.1: Grow KQueueEventArray correctly in realloc (#18102) by @normanmaurer in https://github.com/netty/netty/pull/18106
• Send zero-length datagrams instead of dropping or duplicating them by @Marti2203 in https://github.com/netty/netty/pull/18098
• Read all pending data when the EOF is received before the connect is complete in kqueue by @normanmaurer in https://github.com/netty/netty/pull/18091
• Reject request-only and response-only pseudo-headers in invalid contexts (RFC 9113) by @rajan-github in https://github.com/netty/netty/pull/17752
• Keep throttling the producer while the executor is shutting down in NioEventLoopTest by @normanmaurer in https://github.com/netty/netty/pull/18110
• Read the 4 byte Snappy literal length as unsigned by @normanmaurer in https://github.com/netty/netty/pull/18056
• Call FFM directly in the cleaners and link malloc/free on first use by @franz1981 in https://github.com/netty/netty/pull/17791
• Deliver all data a LocalChannel peer wrote before it closed by @allthingssecurity in https://github.com/netty/netty/pull/18127
• Load the native library in IoUringSharedIovArrayTest by @normanmaurer in https://github.com/netty/netty/pull/18130
• Do not fail update-sdkman-sha.sh when run without arguments by @normanmaurer in https://github.com/netty/netty/pull/18134
• Port 4.2: Update sdkman sha (#18133) by @normanmaurer in https://github.com/netty/netty/pull/18135
• Make ZlibCertificateCompressionAlgorithm public by @daschl in https://github.com/netty/netty/pull/18131
• Round up the NIO select timeout again to not busy spin (#18137) by @DavideD in https://github.com/netty/netty/pull/18138
• Update central-publishing-maven-plugin to 0.12.0 by @normanmaurer in https://github.com/netty/netty/pull/18140
• Close an HTTP/2 stream only after its last merged DATA frame was written by @allthingssecurity in https://github.com/netty/netty/pull/18126
• Use IP_MULTICAST_IF in leaveGroup and block without an interface by @Marti2203 in https://github.com/netty/netty/pull/18122
• Add opt-in Origin validation to WebSocketServerProtocolHandler (hardening) by @normanmaurer in https://github.com/netty/netty/pull/17944
• Auto-port 4.2: Add JDK27 profiles by @netty-project-bot in https://github.com/netty/netty/pull/18148
• IoUring:Refactor io_uring write lifecycle management by @dreamlike-ocean in https://github.com/netty/netty/pull/17757
• Do not run javadoc for netty-varhandle-stub by @normanmaurer in https://github.com/netty/netty/pull/18151
• Don't lose the alert when the handshake fails in ReferenceCountedOpen… by @normanmaurer in https://github.com/netty/netty/pull/18155
• Fix buffer over-read in netty_boringssl_password_callback by @normanmaurer in https://github.com/netty/netty/pull/18163
• Fix freeing of invalid EVP_PKEY handle when parsing a private key fails by @normanmaurer in https://github.com/netty/netty/pull/18159
• Fix use of out-of-scope variable in netty_quiche_conn_new_scid by @normanmaurer in https://github.com/netty/netty/pull/18162
• Fix freeing of uninitialized dynamicMethods in netty_quiche_JNI_OnLoad by @normanmaurer in https://github.com/netty/netty/pull/18161
• Fix use of uninitialized pointers in quic_certificate_cb by @normanmaurer in https://github.com/netty/netty/pull/18160
• Add a change review skill by @chrisvest in https://github.com/netty/netty/pull/18071
• Add guidance for LLM agents by @chrisvest in https://github.com/netty/netty/pull/18036
• SslHandler: Size the unwrap output buffer for the plaintext, not the record by @watson-ryan in https://github.com/netty/netty/pull/18028
• Send bad_certificate alert when the TrustManager rejects the certificate by @normanmaurer in https://github.com/netty/netty/pull/18164
• Auto-port 4.2: Quote revapi argument by @netty-project-bot in https://github.com/netty/netty/pull/18187
• Avoid reverse DNS lookup in IpSubnetFilterTest.testIpFilterRuleHandler by @normanmaurer in https://github.com/netty/netty/pull/18188
• IoUring: Verify the FileChannel is a FileChannelImpl before reading its fd by @normanmaurer in https://github.com/netty/netty/pull/18192
• Update to latest netty-jni-util release by @normanmaurer in https://github.com/netty/netty/pull/18189
• Fix flaky SSLEngineTest.testSessionInvalidate with Conscrypt by @normanmaurer in https://github.com/netty/netty/pull/18198
• Auto-port 4.2: Fix reporting of the wrong error when setting flags on an accepted fd fails by @netty-project-bot in https://github.com/netty/netty/pull/18201
• Auto-port 4.2: KQueue: Verify the FileChannel is a FileChannelImpl before reading its fd by @netty-project-bot in https://github.com/netty/netty/pull/18204
• Auto-port 4.2: Do not send uninitialized stack memory when sending a fd over a domain socket by @netty-project-bot in https://github.com/netty/netty/pull/18209
• Auto-port 4.2: Fix underflow detection in netty_unix_util_timespec_subtract_ns by @netty-project-bot in https://github.com/netty/netty/pull/18214
• Auto-port 4.2: Epoll: Verify the FileChannel is a FileChannelImpl before reading its fd by @netty-project-bot in https://github.com/netty/netty/pull/18202
• Auto-port 4.2: Epoll: Fix signed integer overflow when calculating the epoll_wait timeout by @netty-project-bot in https://github.com/netty/netty/pull/18213
• Auto-port 4.2: Fix read of uninitialized memory when accepting a connection on a domain socket by @netty-project-bot in https://github.com/netty/netty/pull/18212
• Don't encode Snappy copies with an offset that does not fit into 16 bits by @normanmaurer in https://github.com/netty/netty/pull/18055
• Don't truncate binary memcache key and extras lengths by @Raghuvardhan-Reddy78 in https://github.com/netty/netty/pull/18041
• Revert "Update central-publishing-maven-plugin to 0.12.0 (#18140)" by @normanmaurer in https://github.com/netty/netty/pull/18230
• Update to latest netty-tcnative release by @normanmaurer in https://github.com/netty/netty/pull/18231
• 4.2 Merge fixes by @chrisvest in https://github.com/netty/netty/pull/18237

• @akilegaspi made their first contribution in https://github.com/netty/netty/pull/17623
• @Raghuvardhan-Reddy78 made their first contribution in https://github.com/netty/netty/pull/17812
• @manish-9245 made their first contribution in https://github.com/netty/netty/pull/17872
• @cj848 made their first contribution in https://github.com/netty/netty/pull/17849
• @zsewasdsdsd made their first contribution in https://github.com/netty/netty/pull/17873
• @CCCLL made their first contribution in https://github.com/netty/netty/pull/17961
• @Marti2203 made their first contribution in https://github.com/netty/netty/pull/17974
• @AbhishekShukla1289 made their first contribution in https://github.com/netty/netty/pull/17779
• @DavideD made their first contribution in https://github.com/netty/netty/pull/18138

Full Changelog: https://github.com/netty/netty/compare/netty-4.2.19.Final...netty-4.2.20.Final

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.770...7.21.0-rc.771

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.8.0-jre</version>
  <!-- or, for Android: -->
  <version>33.8.0-android</version>
</dependency>

• 33.8.0-jre.jar
• 33.8.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

• 33.8.0-jre
• 33.8.0-android

• 33.8.0-jre vs. 33.7.2-jre
• 33.8.0-android vs. 33.7.2-android
• 33.8.0-android vs. 33.8.0-jre

• collect: Enhanced HashBiMap and LinkedHashMultimap.ValueSet to defend against hash flooding (forthcoming CVE-2026-118042). (7cd44b3506)
• net: Added MediaType.APPLICATION_GZIP (application/gzip) to be used in preference to GZIP (application/x-gzip). (6393ebbdb6)
• primitives: Added Doubles.MIN_POSITIVE_VALUE and Floats.MIN_POSITIVE_VALUE as more clearly named aliases for Double.MIN_VALUE and Float.MIN_VALUE. (adf5554e7e)
• testlib: Added AbstractClassInitializationTest. (80fd5c114d)
• and, among the usual changes, a larger than usual number of small fixes (4afb1e04a4246c261be4742e1f2e2c39ebaf6266, 79152348ece2de85559eb2eb18133862d492c892, a279b884fe9890a3869142919352156f2a67a705, 786bb1a9b44685875ebe7b83f1404a1f07ac653c, 6b3a8d7498a7fde122967ba37a023ba3dcb47792, de57a419b56bcd887f51bb99103d91c65b7c5e86, fa64cc7c2b320aca9219981952bbb544f8f6ccff, 7b64964048948de3b5633a75d6e64f98cf8fcece, 5ae56d77e64305752b919ff2c96713f47ac0c94c, 37535d73f0416f30e0301efe61a8eb8ede44c1b7, ca8aedb2fdaf40fd6937a0643180aea51ca4154e, c0a8a1edc69393e8141424037571d9825f5fc0f4, 51246d06bb85ccc182a0aeb6a7adcbd55f759ae5, 81c7d030f8f144a4885ccf8efdc72c92605b4eec, 2b86a8216627a807ce8520abc6ae55437dbb85fb, 669a232b4e20ae6e8bc6efc62caaf2f830d56327, b157643c41f9ee6a38732b4fa1a590ba187912d9, ad73fbb9beff220aa26390630724855ef92fc50b, 1e6eb68f2ee8dc6cb164c285f7fe6ad5e8bc0905, 3d5be86651ec58b3f9d15c76cf888ade15aba39b)

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.769...7.21.0-rc.770

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.768...7.21.0-rc.769

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.767...7.21.0-rc.768

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.766...7.21.0-rc.767

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.765...7.21.0-rc.766