Vulnerability in netty-nio-client

[DavidCorral94]

Hey there!

Recently, in one of our services, our Dependant Bot triggered an alarm for the following vulnerability netty-handler SniHandler 16MB allocation.

We checked our dependency tree, and it seems the root of this dependency with the problem (io.netty:netty-handler) is io.laserdisc:fs2-aws-s3_2.13:6.0.2. More specifically, it comes from software.amazon.awssdk:netty-nio-client:2.20.90.

I've checked in the Maven Repository, and the most recent one (2.20.132) still have vulnerabilities but are in the tests dependencies.

So, I'm wondering if you are waiting until them fix that vulnerability as well and then release a new version, or what's the plan?

Thanks!

[DavidCorral94]

I believe the Scala Steward already patched this by updating versions in the Dependencies.scala file, but there is no new releases. Are there plans for a new release any time soon?

Thanks!

[semenodm]

released tag 6.0.3

[DavidCorral94]

Thanks, fixed!