From 4437c274ec8b6c34396790722e493c9789ac11f0 Mon Sep 17 00:00:00 2001
From: Iraj Taghlidi <iraj.taghlidi@fortanix.com>
Date: Mon, 10 Nov 2025 11:45:33 +0100
Subject: [PATCH] Bump dependencies to fix vulnerabilities (#696)

---
 management-api-agent-5.0.x/pom.xml                              | 2 +-
 .../org/apache/cassandra/transport/NettyChannelWrapper.java     | 2 +-
 .../org/apache/cassandra/transport/NettyChannelWrapper.java     | 2 +-
 .../org/apache/cassandra/transport/NettyChannelWrapper.java     | 2 +-
 .../org/apache/cassandra/transport/NettyChannelWrapper.java     | 2 +-
 pom.xml                                                         | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/management-api-agent-5.0.x/pom.xml b/management-api-agent-5.0.x/pom.xml
index 8af614a3..30a91860 100644
--- a/management-api-agent-5.0.x/pom.xml
+++ b/management-api-agent-5.0.x/pom.xml
@@ -17,7 +17,7 @@
   <artifactId>datastax-mgmtapi-agent-5.0.x</artifactId>
   <properties>
     <cassandra5.version>5.0.5</cassandra5.version>
-    <netty.http.codec.version>4.1.96.Final</netty.http.codec.version>
+    <netty.http.codec.version>4.1.128.Final</netty.http.codec.version>
   </properties>
   <dependencies>
     <!-- Need to explicitly declare SLF4J as "provided" to avoid it being bundled into the resulting agent jarfile -->
diff --git a/management-api-agent-5.0.x/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java b/management-api-agent-5.0.x/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
index 4eda90cc..54bdc9eb 100644
--- a/management-api-agent-5.0.x/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
+++ b/management-api-agent-5.0.x/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
@@ -81,7 +81,7 @@ public SocketAddress localAddress() {
   @Override
   public SocketAddress remoteAddress() {
     /**
-     * For Cassandra 5.0, and/or possibly Netty 4.1.96.Final, the remote address for the Channel
+     * For Cassandra 5.0, and/or possibly Netty 4.1.128.Final, the remote address for the Channel
      * seems to be initialized to a Netty io.netty.channel.unix.DomainSocketAddress instance. For
      * Cassandra 4.1 and lower, it seems to be null. Strangely enough, an initialized instance of
      * io.netty.channel.unix.DomainSocketAddress causes a ClassCastException in Cassandra, since it
diff --git a/management-api-agent-5.1.x/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java b/management-api-agent-5.1.x/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
index 4eda90cc..54bdc9eb 100644
--- a/management-api-agent-5.1.x/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
+++ b/management-api-agent-5.1.x/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
@@ -81,7 +81,7 @@ public SocketAddress localAddress() {
   @Override
   public SocketAddress remoteAddress() {
     /**
-     * For Cassandra 5.0, and/or possibly Netty 4.1.96.Final, the remote address for the Channel
+     * For Cassandra 5.0, and/or possibly Netty 4.1.128.Final, the remote address for the Channel
      * seems to be initialized to a Netty io.netty.channel.unix.DomainSocketAddress instance. For
      * Cassandra 4.1 and lower, it seems to be null. Strangely enough, an initialized instance of
      * io.netty.channel.unix.DomainSocketAddress causes a ClassCastException in Cassandra, since it
diff --git a/management-api-agent-hcd-cc4/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java b/management-api-agent-hcd-cc4/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
index 4eda90cc..54bdc9eb 100644
--- a/management-api-agent-hcd-cc4/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
+++ b/management-api-agent-hcd-cc4/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
@@ -81,7 +81,7 @@ public SocketAddress localAddress() {
   @Override
   public SocketAddress remoteAddress() {
     /**
-     * For Cassandra 5.0, and/or possibly Netty 4.1.96.Final, the remote address for the Channel
+     * For Cassandra 5.0, and/or possibly Netty 4.1.128.Final, the remote address for the Channel
      * seems to be initialized to a Netty io.netty.channel.unix.DomainSocketAddress instance. For
      * Cassandra 4.1 and lower, it seems to be null. Strangely enough, an initialized instance of
      * io.netty.channel.unix.DomainSocketAddress causes a ClassCastException in Cassandra, since it
diff --git a/management-api-agent-hcd-cc5/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java b/management-api-agent-hcd-cc5/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
index 4eda90cc..54bdc9eb 100644
--- a/management-api-agent-hcd-cc5/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
+++ b/management-api-agent-hcd-cc5/src/main/java/org/apache/cassandra/transport/NettyChannelWrapper.java
@@ -81,7 +81,7 @@ public SocketAddress localAddress() {
   @Override
   public SocketAddress remoteAddress() {
     /**
-     * For Cassandra 5.0, and/or possibly Netty 4.1.96.Final, the remote address for the Channel
+     * For Cassandra 5.0, and/or possibly Netty 4.1.128.Final, the remote address for the Channel
      * seems to be initialized to a Netty io.netty.channel.unix.DomainSocketAddress instance. For
      * Cassandra 4.1 and lower, it seems to be null. Strangely enough, an initialized instance of
      * io.netty.channel.unix.DomainSocketAddress causes a ClassCastException in Cassandra, since it
diff --git a/pom.xml b/pom.xml
index b3d594c6..499c92e3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -24,7 +24,7 @@
     <bytebuddy.version>1.12.19</bytebuddy.version>
     <build.version.file>build_version.sh</build.version.file>
     <slf4j.version>2.0.9</slf4j.version>
-    <logback.version>1.5.13</logback.version>
+    <logback.version>1.5.19</logback.version>
     <netty.version>4.1.128.Final</netty.version>
     <mockito.version>3.5.13</mockito.version>
     <prometheus.version>0.16.0</prometheus.version>