[QUERY] When is a version without CVEs planned?

[dagnelies-elo]

Dear Team,

the current Dependency azure-core-http-netty uses an outdated version of Netty and is therefore riddled with CVEs.

Are there any short term plans to update the Netty Version to get rid of all these CVEs?

[github-actions]

🎯 Agentic Issue Triage

Summary: The author is asking about plans to update the Netty version used by azure-core-http-netty, as the current version contains known CVEs.

📋 Issue Details

Package: com.azure:azure-core-http-netty (latest: 1.16.5)
Affected API: Netty dependency version
Scenarios:

• Dependency scanning tools flag multiple CVEs in the bundled Netty version
• Users are concerned about deploying applications with known vulnerabilities

Root ask: Confirmation of whether/when the Netty dependency will be updated to a CVE-free version.

🔎 Debugging / Reproduction Notes

This is a dependency version inquiry rather than a code bug. The author provided a screenshot showing CVEs associated with the Netty version used by azure-core-http-netty.

Suggested investigation steps:

1. Check the current Netty version pinned in sdk/core/azure-core-http-netty/pom.xml
2. Verify whether a newer Netty version is available that resolves the flagged CVEs
3. Assess compatibility and testing impact of upgrading Netty

🏷️ Label Confidence

• Category: Client — azure-core-http-netty is a data-plane client library under com.azure
• Service: Azure.Core — the package resides in /sdk/core/ and is part of the core HTTP transport layer
• Confidence: High — the issue explicitly names the azure-core-http-netty package; no ambiguity between services or categories

👥 Owner Routing

• Matched CODEOWNERS entry: # ServiceLabel: %Azure.Core (line 56) — issue's service label "Azure.Core" matches
• AzureSdkOwners: @alzimmermsft @samvaity
• ServiceOwners: none listed
• Routing action: Assigned @alzimmermsft (randomly selected from two AzureSdkOwners); added needs-team-attention label
• Scan notes: Scanned bottom-to-top; management and other service entries did not match; %Azure.Core entry at line 56 was the first match

Generated by Agentic Triage for #50096 · 30.5 AIC · ⌖ 6.4 AIC · ⊞ 11K · ◷

[alzimmermsft]

Thanks for asking dagnelies-elo, we're actively working on releasing at the moment: #50104

FYI Jair Myree (@jairmyree)