From 920c6ef4536a4bb04e44cac426e4782ab41f4339 Mon Sep 17 00:00:00 2001
From: vkalapov <87693906+vkalapov@users.noreply.github.com>
Date: Mon, 22 Jun 2026 09:39:58 +0300
Subject: [PATCH] Bump spring to 6.2.19, netty to 4.1.135.Final

---
 pom.xml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index 0b46d9bae9..30f78aabe4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -28,7 +28,7 @@
         <httpcore.version>5.4.2</httpcore.version>
         <eclipselink.version>4.0.9</eclipselink.version>
         <flowable.version>7.2.0</flowable.version>
-        <spring.version>6.2.18</spring.version>
+        <spring.version>6.2.19</spring.version>
         <spring-security.version>6.5.10</spring-security.version>
         <hikari.version>7.0.2</hikari.version>
         <jackson-annotations.version>2.21</jackson-annotations.version>
@@ -40,7 +40,7 @@
         <!--reactor netty 1.3.x uses direct memory leading to OOM errors-->
         <reactor-netty.version>1.2.17</reactor-netty.version>
         <!-- Override Netty version to fix CVE-2026-42583 (Lz4FrameDecoder resource exhaustion) -->
-        <netty.version>4.1.133.Final</netty.version>
+        <netty.version>4.1.135.Final</netty.version>
         <swagger.version>1.6.16</swagger.version>
         <jclouds.version>2.7.0</jclouds.version>
         <guava.version>33.5.0-jre</guava.version>
@@ -301,6 +301,13 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-bom</artifactId>
+                <version>${netty.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-compress</artifactId>