• feat: support freeze pane via @FreezePane or register WriteHandler on write by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/916
• feat: split StringImageConverter into Pathname and Base64 by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/934
• feat: add support for column index limit in ReadSheet by @sapienza88 in https://github.com/apache/fesod/pull/942
• feat: add fluent header api for no-bean mode by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/943
• feat: cache date and number formatters by @Duansg in https://github.com/apache/fesod/pull/948
• feat: add support for column-based reading of XLS files by @sapienza88 in https://github.com/apache/fesod/pull/981
• feat: add support for column-based reading of CSV files by @sapienza88 in https://github.com/apache/fesod/pull/982
• feat: add java.time.LocalTime converters by @leehaut in https://github.com/apache/fesod/pull/1032
• feat: require an allowlist for remote URL images by @psxjoy in https://github.com/apache/fesod/pull/1035
• feat: registered EscapeHexCellWriteHandler in DefaultWriteHandlerLoader for XLSX by @delei in https://github.com/apache/fesod/pull/1044

• fix: fix error in using relativeHeadRowIndex for writing tables only by @32154678925 in https://github.com/apache/fesod/pull/810
• fix: correct SheetWriteHandler.afterSheetDispose to avoid repeated execution by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/900
• fix: avoid recursive hashCode in write holder contexts by @skytin1004 in https://github.com/apache/fesod/pull/911
• fix: support SQL date types in WriteCellData by @skytin1004 in https://github.com/apache/fesod/pull/912
• fix: CsvCell crashes on java.sql.Date/Time due to unsupported toInstant() by @alaahong in https://github.com/apache/fesod/pull/954
• fix: clone DataFormatData in WriteCellStyle.merge to avoid mutating cached annotation style by @nkuprins in https://github.com/apache/fesod/pull/957
• fix: XLS BIFF8 encryption not applied due to premature password clearing by @alaahong in https://github.com/apache/fesod/pull/959
• fix: reset cached batch in PageReadListener between sheets to avoid duplicate rows by @nkuprins in https://github.com/apache/fesod/pull/961
• fix: remove redundant buffer copy in IoUtils.toByteArray(InputStream) by @nkuprins in https://github.com/apache/fesod/pull/963
• fix: descriptive error for unrecognized cell type attribute by @nkuprins in https://github.com/apache/fesod/pull/965
• fix: copy default read converter map to isolate per-reader custom converters by @Aias00 in https://github.com/apache/fesod/pull/972
• fix: mark CsvCell Calendar value as a date to avoid silent empty write by @Aias00 in https://github.com/apache/fesod/pull/974
• fix: remove indexFieldMap entry by field key, not running counter by @Aias00 in https://github.com/apache/fesod/pull/977
• fix: eliminate implicit numeric cast warning in date generation by @xleoken in https://github.com/apache/fesod/pull/990
• fix: decode xHHHH escapes when reading inline string cells by @nkuprins in https://github.com/apache/fesod/pull/991
• fix: remove the broken star history chart by @nkuprins in https://github.com/apache/fesod/pull/998
• fix: prioritize subclass fields and ignore superclass annotations on field shadowing by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/1007
• fix: read XLS literal error cells as errors instead of booleans by @codeAnqiang-ma in https://github.com/apache/fesod/pull/1011
• fix: resolve Windows fill template copy failures (#1021) by @Mikkey-f in https://github.com/apache/fesod/pull/1034
• fix: finding issues during 2.1.0 RC by @alaahong in https://github.com/apache/fesod/pull/1049
• fix: copy sheet-level read params to sheet holder by @nkuprins in https://github.com/apache/fesod/pull/1052
• fix: fall back to global 1904 windowing when @DateTimeFormat default is used (#1042) by @Mikkey-f in https://github.com/apache/fesod/pull/1054
• fix: bundle Incubating NOTICE with EasyExcel attribution in jars by @alaahong in https://github.com/apache/fesod/pull/1066
• fix: make DataFormatter cache configuration-aware by @skytin1004 in https://github.com/apache/fesod/pull/1068
• fix: remove deprecated unDraw SVG assets (#1112) by @alaahong in https://github.com/apache/fesod/pull/1125

• refactor: manage password handling in Excel processing by @psxjoy in https://github.com/apache/fesod/pull/928
• refactor: encapsulate xlsx boolean cell parsing in CellData by @nkuprins in https://github.com/apache/fesod/pull/964
• refactor: generate trivial accessors with Lombok by @nkuprins in https://github.com/apache/fesod/pull/995
• refactor: simplify hex escape pattern scanning by @nkuprins in https://github.com/apache/fesod/pull/1003
• refactor: unify and overload readSheet methods for flexible usage by @delei in https://github.com/apache/fesod/pull/1014
• refactor: replace includeColumnIndexes list lookup with ColumnIndexResolver by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/1015
• refactor: remove fesod-examples module by @delei in https://github.com/apache/fesod/pull/1028
• refactor: reuse Head#field in ModelBuildEventListener field-assignment fallback by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/1031
• refactor: extract sanitisation part for improved readability by @nkuprins in https://github.com/apache/fesod/pull/1061
• refactor: extract format-string date detection out of DateUtils by @nkuprins in https://github.com/apache/fesod/pull/1077

• docs(blog): add blog for migration with OpenRewrite by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/910
• docs: update download page for release 2.0.2-incubating by @delei in https://github.com/apache/fesod/pull/922
• docs(blog): add CVE-2026-49328 security advisory by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/933
• Column Support Feat Docs by @sapienza88 in https://github.com/apache/fesod/pull/949
• docs: add Copilot repository and code review instructions by @alaahong in https://github.com/apache/fesod/pull/958
• docs: Update the release version document by @delei in https://github.com/apache/fesod/pull/967
• docs: upgrade website dependencies and CI by @delei in https://github.com/apache/fesod/pull/968
• docs: update code-review instructions for HeadBuilder and wildcard imports by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/970
• docs: expand the write/fill pages and replace their screenshots with grids by @nkuprins in https://github.com/apache/fesod/pull/979
• style: redesign homepage hero as a spreadsheet grid by @nkuprins in https://github.com/apache/fesod/pull/983
• docs: bump npm dependencies to address component vulnerability risks by @delei in https://github.com/apache/fesod/pull/984
• docs: remove redundant blank line by @xleoken in https://github.com/apache/fesod/pull/992
• docs: remove redundant blank line in java code block by @xleoken in https://github.com/apache/fesod/pull/996
• docs: add both chinese and english versions of docs for the includeCo… by @sapienza88 in https://github.com/apache/fesod/pull/1008
• docs: add class and module changes section to FastExcel migration guide (#857) by @Mikkey-f in https://github.com/apache/fesod/pull/1041
• docs: add License headers to website files and assets by @delei in https://github.com/apache/fesod/pull/1043
• docs: maintain KEYS only in the release directory by @alaahong in https://github.com/apache/fesod/pull/1050
• docs(website): upgrade admonition: caution to warning by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/1053
• docs: update brand logos and maturity model assessment by @delei in https://github.com/apache/fesod/pull/1055
• docs: refactor the team page on the website by @delei in https://github.com/apache/fesod/pull/1146

• [Test] Add testkit infrastructure and refactor unit tests with JUnit 5 parameterized patterns by @GOODBOY008 in https://github.com/apache/fesod/pull/901
• chore(test): remove wildcard imports by @bengbengbalabalabeng in https://github.com/apache/fesod/pull/938
• test: Assert valid excel file with expected column count by @sapienza88 in https://github.com/apache/fesod/pull/945
• Test: expand unit coverage for scalar converters in ConverterTest by @leehaut in https://github.com/apache/fesod/pull/999
• test: add tests for EscapeHexCellWriteHandler by @nkuprins in https://github.com/apache/fesod/pull/1001

• chore: merge 2.0.2-incubating into main branch by @psxjoy in https://github.com/apache/fesod/pull/930
• chore: update copyright year to 2026 in footer and NOTICE files by @psxjoy in https://github.com/apache/fesod/pull/939
• ci: add ASF allowlist check by @delei in https://github.com/apache/fesod/pull/966
• dependency: upgrade assertj-core to 3.27.7 to fix XXE vulnerability by @alaahong in https://github.com/apache/fesod/pull/969
• Update dependabot configuration for GitHub Actions by @pjfanning in https://github.com/apache/fesod/pull/1022
• chore: update pnpm action-setup to specific commit by @delei in https://github.com/apache/fesod/pull/1030
• feat: upgrade slf4j to 2.0.18 and replace logback with slf4j-simple (#905) by @Mikkey-f in https://github.com/apache/fesod/pull/1046
• chore: remove unused mockserver-netty test dependency by @leehaut in https://github.com/apache/fesod/pull/1060
• chore: update gitattributes to exclude non-source files by @delei in https://github.com/apache/fesod/pull/1067
• chore: prepare 2.1.0-incubating release by @alaahong in https://github.com/apache/fesod/pull/1084
• build: set fixed project.build.outputTimestamp for reproducible builds by @alaahong in https://github.com/apache/fesod/pull/1094
• build: drop repetitive comment on project.build.outputTimestamp by @alaahong in https://github.com/apache/fesod/pull/1095
• chore: remove outdated licensing information from pom.xml by @psxjoy in https://github.com/apache/fesod/pull/1122
• chore: exclude website from source archives by @skytin1004 in https://github.com/apache/fesod/pull/1123
• chore: include DISCLAIMER in JAR META-INF (#1108) by @alaahong in https://github.com/apache/fesod/pull/1124
• chore: include DISCLAIMER in sources JAR META-INF (#1108) by @alaahong in https://github.com/apache/fesod/pull/1145
• Bump com.alibaba.fastjson2:fastjson2 from 2.0.61 to 2.0.65 (#909, #980, #987, #1074)
• Bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 (#931)
• Bump org.apache.maven.wrapper:maven-wrapper from 3.1.0 to 3.1.1 (#1013)
• Bump GitHub Actions workflows: setup-node, upload-artifact, actions-netlify, markdownlint-cli2, codeql-action, stale, checkout, cache, setup-java (#1023-#1027, #1037-#1039, #1047)
• Bump org.slf4j dependencies: slf4j-api, jcl-over-slf4j, log4j-over-slf4j, slf4j-simple from 2.0.18 to 2.0.20 (#1071-#1073, #1081, #1141-#1144)

• @32154678925 made their first contribution in https://github.com/apache/fesod/pull/810
• @skytin1004 made their first contribution in https://github.com/apache/fesod/pull/897
• @sapienza88 made their first contribution in https://github.com/apache/fesod/pull/942
• @Duansg made their first contribution in https://github.com/apache/fesod/pull/948
• @nkuprins made their first contribution in https://github.com/apache/fesod/pull/957
• @Aias00 made their first contribution in https://github.com/apache/fesod/pull/972
• @xleoken made their first contribution in https://github.com/apache/fesod/pull/990
• @leehaut made their first contribution in https://github.com/apache/fesod/pull/999
• @codeAnqiang-ma made their first contribution in https://github.com/apache/fesod/pull/1011
• @Mikkey-f made their first contribution in https://github.com/apache/fesod/pull/1034

Full Changelog: https://github.com/apache/fesod/compare/2.0.2-incubating...2.1.0-incubating

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.662...7.21.0-rc.663

• 9846631: [js][bidi] Add vendor specific class generation (#18125) (Puja Jagani) #18125
• e431cc8: [build] Automated Browser Version Update (#18107) (Selenium CI Bot) #18107
• af9e5cf: [java] assert setFiles uploads reach the server in SetFilesCommandTest (#18058) (Yash Pardeshi) #18058
• ceec8bf: [java][bidi] Decode nested RemoteValues from the parsed tree instead of re-serializing each subtree (#18095) (Yash Pardeshi) #18095
• 788fcf3: [rb] type a field-less synthetic map record as a validated map (#18121) (Augustin Gottlieb) #18121
• e420863: [java] remove guava from client bindings #12737 (#13739) (joerg1985) #13739
• e0c56c9: [rb] update test guard for different bidi error in Chrome beta (Titus Fortner)
• 5026a72: [build] clean up IntelliJ project files and align .editorconfig with formatters (#18119) (Titus Fortner) #18119
• b5aacd7: [build] SM production release skips debug jobs and builds Mac binaries in parallel (Titus Fortner)
• 4961c4f: [javascript] Create @seleniumhq/atoms npm package from TypeScript atoms (#17459) (David Burns) #17459
• 229a802: [java][bidi] Add BiDi code generator (#17777) (Puja Jagani) #17777
• 13920ed: [java][bidi] Export the generated protocol classes from selenium-remote-driver (Titus Fortner)
• 21e7241: [build] download prebuilt SBOM tools instead of compiling them for Selenium Manager releases (Titus Fortner)
• 6fcc54c: [rust] bump the crate version in Cargo.lock directly instead of repinning through Bazel (Titus Fortner)

Jedis 8.0.2 is a maintenance release for the 8.0 line, fixing MultiDbClient failover so it recovers to a healed database and keeps health checks running when no failover candidate is available.

• Fail over to a recovered database when the active one is inoperable (#4774)
• Keep MultiDbClient health checks alive when failover has no candidate (#4759)

• Document that automatic recovery is not guaranteed after the permanent failure (#4776)
• Update failover.md and some javadoc (#4772)

We'd like to thank all the contributors who worked on this release!

@ggivo

Full Changelog: https://github.com/redis/jedis/compare/v8.0.1...v8.0.2

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.661...7.21.0-rc.662

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.660...7.21.0-rc.661

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.659...7.21.0-rc.660

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

• CVE-2026-XXXXX : parser desync in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http
• CVE-2026-XXXXX : origin validation error in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http2
• CVE-2026-XXXXX : request/response smuggling in io.netty:netty-codec-http
• CVE-2026-XXXXX : time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : SNI routing bypass in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-xml
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-base
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http
• CVE-2026-XXXXX : input misinterpretation in io.netty:netty-codec-socks
• CVE-2026-XXXXX : improper access control in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-dns

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Specific changes worth calling out:

Validation in FileUpload.setContentType. Previously, the FileUpload.setContentType methods did not validate their inputs. They now throw an IllegaalArgumentException if the given string is not formatted as a plausible MIME content type.

• Auto-port 4.1: perf: Use LinkedHashSet to deduplicate search domains by @netty-project-bot in https://github.com/netty/netty/pull/17407
• Auto-port 4.1: Handle non-positive skip lengths in ByteBufInputStream by @netty-project-bot in https://github.com/netty/netty/pull/17410
• Protobuf: Update protobuf-javanano to non alpha release (#17330) by @normanmaurer in https://github.com/netty/netty/pull/17335
• Socket: Add half-closure tests to SocketHalfClosedTest (#17394) by @normanmaurer in https://github.com/netty/netty/pull/17434
• Auto-port 4.1: HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by @netty-project-bot in https://github.com/netty/netty/pull/17436
• Auto-port 4.1: codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by @netty-project-bot in https://github.com/netty/netty/pull/17459
• Update GitHub Actions to Node.js 24 to fix deprecation warning by @normanmaurer in https://github.com/netty/netty/pull/17488
• Remove not used tools from docker image by @normanmaurer in https://github.com/netty/netty/pull/17490
• Auto-port 4.1: HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by @netty-project-bot in https://github.com/netty/netty/pull/17494
• Auto-port 4.1: Fix buffer leak when recvmmsg returns single UDP_GRO batch by @netty-project-bot in https://github.com/netty/netty/pull/17500
• Auto-port 4.1: Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by @netty-project-bot in https://github.com/netty/netty/pull/17501
• Auto-port 4.1: Add regression test for close() cascade reentering flush() by @netty-project-bot in https://github.com/netty/netty/pull/17505
• Port: Fix UDP_GRO segment size is lost when reading with recvmmsg (#17492) by @normanmaurer in https://github.com/netty/netty/pull/17506
• Auto-port 4.1: Make CompositeBufferGatheringWriteTest robust against write/close race by @netty-project-bot in https://github.com/netty/netty/pull/17510
• Auto-port 4.1: Add workflow that will cancel running workflows for merged PRs by @netty-project-bot in https://github.com/netty/netty/pull/17519
• Auto-port 4.1: Harden DnsNameResolverTest against transient null localAddress from TestDnsServer by @netty-project-bot in https://github.com/netty/netty/pull/17522
• Cache docker build images in ghcr.io to speed up CI for 4.1 by @normanmaurer in https://github.com/netty/netty/pull/17533
• Auto-port 4.1: HTTP/2: Remove failed SETTINGS from ACK queue by @netty-project-bot in https://github.com/netty/netty/pull/17534
• Port: Fix compilation on latest macOS 27.0 (#17529) by @normanmaurer in https://github.com/netty/netty/pull/17542
• Http2ConnectionRoundtripTest: Reduce timing sensitivity to fix CI flakiness (#17540) by @normanmaurer in https://github.com/netty/netty/pull/17552
• Auto-port 4.1: ProtobufVarint32FrameDecoder must wait for more data when the length prefix is incomplete by @netty-project-bot in https://github.com/netty/netty/pull/17553
• Auto-port 4.1: Fix missing readable-bytes check in SmtpResponseDecoder by @netty-project-bot in https://github.com/netty/netty/pull/17556
• Auto-port 4.1: Guard against out-of-bounds reads when parsing ClientHello SNI extension by @netty-project-bot in https://github.com/netty/netty/pull/17558
• Auto-port 4.1: Http2: Reserve promised stream before running the request verifier by @netty-project-bot in https://github.com/netty/netty/pull/17563
• Port: Use random generated LocalAddress in tests that use local transport (#17570) by @normanmaurer in https://github.com/netty/netty/pull/17579
• Port: DnsAddressResolverGroupTest: Use a mock DNS server instead of resolving netty.io over the network (#17566) by @normanmaurer in https://github.com/netty/netty/pull/17577
• [4.1] Use isLengthEqual method in HttpObjectDecoder by @rsvoboda in https://github.com/netty/netty/pull/17575
• Port: Use 2 EventLoops when running our tests by default (#17567) by @normanmaurer in https://github.com/netty/netty/pull/17587
• Auto-port 4.1: Reject incomplete PUSH_PROMISE request headers when validateRequiredPseudoHeaders is enabled by @netty-project-bot in https://github.com/netty/netty/pull/17582
• Auto-port 4.1: POOL: Release Channel when SimpleChannelPool acquire is cancelled by @netty-project-bot in https://github.com/netty/netty/pull/17578
• Auto-port 4.1: Fix flaky HttpToHttp2ConnectionHandlerTest.testChunkedRequestWithBodyAndTrailingHeaders by @netty-project-bot in https://github.com/netty/netty/pull/17593
• Auto-port 4.1: Http2ConnectionHandler: report at most one stream error for a CompositeStreamException by @netty-project-bot in https://github.com/netty/netty/pull/17595
• Port: Http2MultiplexTransportTest: Fix possible SslContext leak in tests (#17597) by @normanmaurer in https://github.com/netty/netty/pull/17599
• Auto-port 4.1: Support creating a PropertyKey that is not tied to a specific Http2Connection by @netty-project-bot in https://github.com/netty/netty/pull/17615
• Auto-port 4.1: Reset LengthFieldBasedFrameDecoder state when the frame is shorter than initialBytesToStrip by @netty-project-bot in https://github.com/netty/netty/pull/17621
• Port: Fix ByteBuf.setBytes(int, ByteBuffer) when the source is the buffer's own internal NIO buffer (#17618) by @normanmaurer in https://github.com/netty/netty/pull/17626
• Auto-port 4.1: Fix connection error scope for SETTINGS_INITIAL_WINDOW_SIZE overflow issue by @netty-project-bot in https://github.com/netty/netty/pull/17640
• Auto-port 4.1: Add missing bounds check to AdaptiveByteBuf.getBytes(...) channel variants by @netty-project-bot in https://github.com/netty/netty/pull/17629
• Port: Update lz4-java to 1.12.0 (#17631) by @normanmaurer in https://github.com/netty/netty/pull/17638
• Auto-port 4.1: HTTP/2: Fix stream stall when toggling auto-read on a child channel by @netty-project-bot in https://github.com/netty/netty/pull/17646
• Port: No need to call clear() on ByteBuffer after AdaptiveByteBuf.internalNioBuffer() (#17619) by @normanmaurer in https://github.com/netty/netty/pull/17653
• Auto-port 4.1: PendingWriteQueue: unlink the write before failing it in removeAndFail by @netty-project-bot in https://github.com/netty/netty/pull/17658
• Port: Don't lose HashedWheelTimer timeouts that race with stop() (#17610) by @normanmaurer in https://github.com/netty/netty/pull/17660
• Port: LocalChannel: complete connect() when the accepted channel dies before registration (#17656) by @normanmaurer in https://github.com/netty/netty/pull/17666
• Port: Don't leak FixedChannelPool slots on unrelated IllegalArgumentException (#17609) by @normanmaurer in https://github.com/netty/netty/pull/17668
• Auto-port 4.1: Don't corrupt the pipeline when a handler context is removed twice by @netty-project-bot in https://github.com/netty/netty/pull/17670
• Auto-port 4.1: Don't leak queued writes in ChunkedWriteHandler on removal or cancel by @netty-project-bot in https://github.com/netty/netty/pull/17676
• Port: Honour the needle's reader index in ByteBufUtil.indexOf(ByteBuf, ByteBuf) (#17682) by @normanmaurer in https://github.com/netty/netty/pull/17687
• Auto-port 4.1: Close idle outbound HTTP/2 child channels when the parent closes by @netty-project-bot in https://github.com/netty/netty/pull/17694
• Auto-port 4.1: Only fail in ZlibDecoder when the decompression buffer is full by @netty-project-bot in https://github.com/netty/netty/pull/17698
• Auto-port 4.1: Use LocalIoHandler instead of DefaultEventLoop for LocalChannel tests in codec-http2 by @netty-project-bot in https://github.com/netty/netty/pull/17708
• Auto-port 4.1: Add script that allows to check if a user has signed the icla by @netty-project-bot in https://github.com/netty/netty/pull/17713
• Port: Fail pending writes of ProxyHandler when it is removed (#17691) by @normanmaurer in https://github.com/netty/netty/pull/17707
• Auto-port 4.1: Complete HTTP/2 graceful close when the connection closes the last stream by @netty-project-bot in https://github.com/netty/netty/pull/17720
• Auto-port 4.1: Don't count STOMP headers again when the header block is replayed by @netty-project-bot in https://github.com/netty/netty/pull/17716
• Port 4.1: Don't corrupt ChannelOutboundBuffer when a cancelled write makes the channel writable (#17702) by @normanmaurer in https://github.com/netty/netty/pull/17733
• Auto-port 4.1: Fail ChunkedNioFile instead of spinning when the file is shorter than requested by @netty-project-bot in https://github.com/netty/netty/pull/17734
• Port 4.1: Arm force-close timeout when an inbound CLOSE frame is echoed (#17574) by @normanmaurer in https://github.com/netty/netty/pull/17710
• Port 4.1: MqttDecoder accepts malformed MQTT 5 property sections and reclassifies payload bytes as properties (#17714) by @normanmaurer in https://github.com/netty/netty/pull/17732
• Port 4.1: Only build and test the affected modules when validating PRs (#17736) by @normanmaurer in https://github.com/netty/netty/pull/17744
• Port 4.1: Validate bzip2 Huffman table selector index before use (#17705) by @normanmaurer in https://github.com/netty/netty/pull/17738
• Port 4.1: Fix racy DnsNameResolverTest.testNegativeTtl lifecycle observer checks (#17737) by @normanmaurer in https://github.com/netty/netty/pull/17748
• Auto-port 4.1: Fix retainedSlice() of non-retained pooled derived buffers by @netty-project-bot in https://github.com/netty/netty/pull/17761
• Port 4.1: Reset the permessage-deflate compressor after an empty final fragment (#17681) by @normanmaurer in https://github.com/netty/netty/pull/17741
• Try to fix/stabilize a number of flaky tests (#16934) by @normanmaurer in https://github.com/netty/netty/pull/17763
• Auto-port 4.1: Build using powershell on Windows by @netty-project-bot in https://github.com/netty/netty/pull/17768
• Bulk merge changes for 4.1 by @normanmaurer in https://github.com/netty/netty/pull/17771

• @rsvoboda made their first contribution in https://github.com/netty/netty/pull/17575

Full Changelog: https://github.com/netty/netty/compare/netty-4.1.138.Final...netty-4.1.139.Final

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

• CVE-2026-XXXXX : parser desync in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http
• CVE-2026-XXXXX : origin validation error in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http2
• CVE-2026-XXXXX : request/response smuggling in io.netty:netty-codec-http
• CVE-2026-XXXXX : time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : SNI routing bypass in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-xml
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-base
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http
• CVE-2026-XXXXX : input misinterpretation in io.netty:netty-codec-socks
• CVE-2026-XXXXX : improper access control in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-dns
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http3
• CVE-2026-XXXXX : use-after-free in io.netty:netty-transport-classes-io_uring
• CVE-2026-XXXXX : memory leak in io.netty:netty-transport-native-io_uring

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Specific changes worth calling out:

Validation in FileUpload.setContentType. Previously, the FileUpload.setContentType methods did not validate their inputs. They now throw an IllegaalArgumentException if the given string is not formatted as a plausible MIME content type.

• perf: Use LinkedHashSet to deduplicate search domains by @JunggiKim in https://github.com/netty/netty/pull/17400
• Handle non-positive skip lengths in ByteBufInputStream by @cuishuang in https://github.com/netty/netty/pull/17388
• Avoid double promise allocation in SslHandler.wrap() by @doom369 in https://github.com/netty/netty/pull/17382
• Socket: Add half-closure tests to SocketHalfClosedTest by @rajan-github in https://github.com/netty/netty/pull/17394
• HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by @hunseonglee in https://github.com/netty/netty/pull/17386
• codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by @hyperxpro in https://github.com/netty/netty/pull/17373
• transport: Avoid io_uring completion callback allocation by @massiccio in https://github.com/netty/netty/pull/17457
• QUIC: Ensure writable events reflect stream capacity by @yawkat in https://github.com/netty/netty/pull/17431
• OcspServerCertificateValidatorTest: Fix possible leak in test by @normanmaurer in https://github.com/netty/netty/pull/17469
• Use github to download cmake and also remove tar file after unpacking by @normanmaurer in https://github.com/netty/netty/pull/17482
• build: Upgrade GitHub Actions to fix Node.js 20 deprecation warnings by @normanmaurer in https://github.com/netty/netty/pull/17484
• HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by @ohchanKyu in https://github.com/netty/netty/pull/17456
• Fix buffer leak when recvmmsg returns single UDP_GRO batch by @octa-one in https://github.com/netty/netty/pull/17493
• Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by @fudianchn in https://github.com/netty/netty/pull/17438
• Add regression test for close() cascade reentering flush() by @normanmaurer in https://github.com/netty/netty/pull/17497
• Fix UDP_GRO segment size is lost when reading with recvmmsg by @octa-one in https://github.com/netty/netty/pull/17492
• KQueueDatagramChannel: rewrite IPv4-wildcard bind to IPv6-any on dual-stack sockets by @normanmaurer in https://github.com/netty/netty/pull/17498
• Make CompositeBufferGatheringWriteTest robust against write/close race by @normanmaurer in https://github.com/netty/netty/pull/17508
• Add option to ignore MaxDirectMemorySize JVM argument by @franz1981 in https://github.com/netty/netty/pull/17177
• Only build affected Maven modules for PR verification by @normanmaurer in https://github.com/netty/netty/pull/17512
• Add workflow that will cancel running workflows for merged PRs by @normanmaurer in https://github.com/netty/netty/pull/17518
• Harden DnsNameResolverTest against transient null localAddress from TestDnsServer by @normanmaurer in https://github.com/netty/netty/pull/17514
• Fix flaky memory leak detection in OcspServerCertificateValidatorTest by @normanmaurer in https://github.com/netty/netty/pull/17524
• Cache docker build images in ghcr.io to speed up CI by @normanmaurer in https://github.com/netty/netty/pull/17530
• HTTP/2: Remove failed SETTINGS from ACK queue by @Gimini-3 in https://github.com/netty/netty/pull/17387
• Fix compilation on latest macOS 27.0 by @normanmaurer in https://github.com/netty/netty/pull/17529
• Make IoEventLoopGroup.isCompatible/isIoType side-effect free by @idelpivnitskiy in https://github.com/netty/netty/pull/17544
• Fix flaky memory leak detection in OcspServerCertificateValidatorTest by @normanmaurer in https://github.com/netty/netty/pull/17536
• Reset busy counters after triggering an auto-scale-up decision by @normanmaurer in https://github.com/netty/netty/pull/17538
• Http2ConnectionRoundtripTest: Reduce timing sensitivity to fix CI flakiness by @normanmaurer in https://github.com/netty/netty/pull/17540
• ProtobufVarint32FrameDecoder must wait for more data when the length prefix is incomplete by @ohchanKyu in https://github.com/netty/netty/pull/17550
• QpackEncoder.sectionAcknowledgment must not NPE when dynamic table is disabled by @normanmaurer in https://github.com/netty/netty/pull/17537
• Fix missing readable-bytes check in SmtpResponseDecoder by @normanmaurer in https://github.com/netty/netty/pull/17516
• Guard against out-of-bounds reads when parsing ClientHello SNI extension by @normanmaurer in https://github.com/netty/netty/pull/17532
• Fix IndexOutOfBoundsException from mismatched varint length in Http3FrameCodec by @normanmaurer in https://github.com/netty/netty/pull/17523
• Fix missing readable-bytes checks in QuicHeaderParser by @normanmaurer in https://github.com/netty/netty/pull/17515
• Http2: Reserve promised stream before running the request verifier by @normanmaurer in https://github.com/netty/netty/pull/17495
• Fix HTTP/3 decoding of frames with zero length payloads by @violetagg in https://github.com/netty/netty/pull/17564
• DnsAddressResolverGroupTest: Use a mock DNS server instead of resolving netty.io over the network by @normanmaurer in https://github.com/netty/netty/pull/17566
• Use random generated LocalAddress in tests that use local transport by @normanmaurer in https://github.com/netty/netty/pull/17570
• POOL: Release Channel when SimpleChannelPool acquire is cancelled by @renechoi in https://github.com/netty/netty/pull/17569
• Fix missing per-entry clamp in IoUringBufferRing.useBuffer by @normanmaurer in https://github.com/netty/netty/pull/17568
• Reject incomplete PUSH_PROMISE request headers when validateRequiredPseudoHeaders is enabled by @normanmaurer in https://github.com/netty/netty/pull/17460
• Add regression tests for CANCEL_PUSH/GOAWAY/MAX_PUSH_ID trailing bytes by @normanmaurer in https://github.com/netty/netty/pull/17571
• Use 2 EventLoops when running our tests by default by @normanmaurer in https://github.com/netty/netty/pull/17567
• Fix flaky HttpToHttp2ConnectionHandlerTest.testChunkedRequestWithBodyAndTrailingHeaders by @normanmaurer in https://github.com/netty/netty/pull/17590
• Http2ConnectionHandler: report at most one stream error for a CompositeStreamException by @normanmaurer in https://github.com/netty/netty/pull/17470
• Http2MultiplexTransportTest: Fix possible SslContext leak in tests by @normanmaurer in https://github.com/netty/netty/pull/17597
• Restore configurable ioRatio-based task scheduling in SingleThreadIoEventLoop by @normanmaurer in https://github.com/netty/netty/pull/17481
• Support creating a PropertyKey that is not tied to a specific Http2Connection by @normanmaurer in https://github.com/netty/netty/pull/17594
• Reset LengthFieldBasedFrameDecoder state when the frame is shorter than initialBytesToStrip by @allthingssecurity in https://github.com/netty/netty/pull/17606
• Auto-port 4.2: SingleThreadEventExecutor: fix race between suspend and cancellation … by @netty-project-bot in https://github.com/netty/netty/pull/17601
• Fix ByteBuf.setBytes(int, ByteBuffer) when the source is the buffer's own internal NIO buffer by @laosijikaichele in https://github.com/netty/netty/pull/17618
• Add missing bounds check to AdaptiveByteBuf.getBytes(...) channel variants by @laosijikaichele in https://github.com/netty/netty/pull/17620
• SingleThreadEventExecutor: fix remaining suspend/cancellation race by @normanmaurer in https://github.com/netty/netty/pull/17627
• Update lz4-java to 1.12.0 by @yawkat in https://github.com/netty/netty/pull/17631
• Fix connection error scope for SETTINGS_INITIAL_WINDOW_SIZE overflow issue by @skyguard1 in https://github.com/netty/netty/pull/17602
• HTTP/2: Fix stream stall when toggling auto-read on a child channel by @pandareen in https://github.com/netty/netty/pull/17617
• Run the Linux test legs on ubuntu-24.04 so io_uring buffer ring tests execute by @franz1981 in https://github.com/netty/netty/pull/17637
• Update quiche to a new version 0.30.0 by @sanjomo in https://github.com/netty/netty/pull/17642
• No need to call clear() on ByteBuffer after AdaptiveByteBuf.internalNioBuffer() by @laosijikaichele in https://github.com/netty/netty/pull/17619
• Don't strand tasks when trySuspend() races with startThread() by @allthingssecurity in https://github.com/netty/netty/pull/17608
• Use assertInstanceOf/assertThrows instead of assertTrue/fail idioms in tests by @normanmaurer in https://github.com/netty/netty/pull/17633
• PendingWriteQueue: unlink the write before failing it in removeAndFail by @allthingssecurity in https://github.com/netty/netty/pull/17657
• Don't lose HashedWheelTimer timeouts that race with stop() by @allthingssecurity in https://github.com/netty/netty/pull/17610
• Don't corrupt the pipeline when a handler context is removed twice by @allthingssecurity in https://github.com/netty/netty/pull/17643
• LocalChannel: complete connect() when the accepted channel dies before registration by @allthingssecurity in https://github.com/netty/netty/pull/17656
• Don't leak FixedChannelPool slots on unrelated IllegalArgumentException by @allthingssecurity in https://github.com/netty/netty/pull/17609
• Don't leak queued writes in ChunkedWriteHandler on removal or cancel by @allthingssecurity in https://github.com/netty/netty/pull/17663
• Honour the needle's reader index in ByteBufUtil.indexOf(ByteBuf, ByteBuf) by @allthingssecurity in https://github.com/netty/netty/pull/17682
• Close idle outbound HTTP/2 child channels when the parent closes by @allthingssecurity in https://github.com/netty/netty/pull/17679
• Only fail in ZlibDecoder when the decompression buffer is full by @allthingssecurity in https://github.com/netty/netty/pull/17692
• Fail pending writes of ProxyHandler when it is removed by @allthingssecurity in https://github.com/netty/netty/pull/17691
• Use LocalIoHandler instead of DefaultEventLoop for LocalChannel tests in codec-http2 by @normanmaurer in https://github.com/netty/netty/pull/17697
• Arm force-close timeout when an inbound CLOSE frame is echoed by @normanmaurer in https://github.com/netty/netty/pull/17574
• Don't count STOMP headers again when the header block is replayed by @allthingssecurity in https://github.com/netty/netty/pull/17664
• Add script that allows to check if a user has signed the icla by @normanmaurer in https://github.com/netty/netty/pull/17711
• Complete HTTP/2 graceful close when the connection closes the last stream by @allthingssecurity in https://github.com/netty/netty/pull/17683
• Handle ed25519 and ed448 names in SignatureAlgorithmConverter by @eager-signal in https://github.com/netty/netty/pull/17689
• MqttDecoder accepts malformed MQTT 5 property sections and reclassifies payload bytes as properties by @normanmaurer in https://github.com/netty/netty/pull/17714
• common: initialize SystemTicker at runtime in native images by @Asthenia0412 in https://github.com/netty/netty/pull/17677
• Don't corrupt ChannelOutboundBuffer when a cancelled write makes the channel writable by @allthingssecurity in https://github.com/netty/netty/pull/17702
• Fail ChunkedNioFile instead of spinning when the file is shorter than requested by @allthingssecurity in https://github.com/netty/netty/pull/17727
• Validate bzip2 Huffman table selector index before use by @normanmaurer in https://github.com/netty/netty/pull/17705
• Reset the permessage-deflate compressor after an empty final fragment by @allthingssecurity in https://github.com/netty/netty/pull/17681
• Only build and test the affected modules when validating PRs by @normanmaurer in https://github.com/netty/netty/pull/17736
• Fix racy DnsNameResolverTest.testNegativeTtl lifecycle observer checks by @normanmaurer in https://github.com/netty/netty/pull/17737
• Fix retainedSlice() of non-retained pooled derived buffers by @lhotari in https://github.com/netty/netty/pull/17759
• Build using powershell on Windows by @chrisvest in https://github.com/netty/netty/pull/17766
• Bulk merge changes for 4.2 by @normanmaurer in https://github.com/netty/netty/pull/17770

• @JunggiKim made their first contribution in https://github.com/netty/netty/pull/17400
• @hunseonglee made their first contribution in https://github.com/netty/netty/pull/17386
• @massiccio made their first contribution in https://github.com/netty/netty/pull/17457
• @ohchanKyu made their first contribution in https://github.com/netty/netty/pull/17456
• @octa-one made their first contribution in https://github.com/netty/netty/pull/17493
• @fudianchn made their first contribution in https://github.com/netty/netty/pull/17438
• @allthingssecurity made their first contribution in https://github.com/netty/netty/pull/17606
• @eager-signal made their first contribution in https://github.com/netty/netty/pull/17689
• @Asthenia0412 made their first contribution in https://github.com/netty/netty/pull/17677

Full Changelog: https://github.com/netty/netty/compare/netty-4.2.18.Final...netty-4.2.19.Final