From 742ef48c2178a2a40ef931966d988d92ee7aa4e3 Mon Sep 17 00:00:00 2001
From: "adheli.tavares" <adheli.tavares@est.tech>
Date: Tue, 4 Mar 2025 08:41:48 +0000
Subject: Uplift netty dependencies

Issue-ID: POLICY-5299
Change-Id: Ic349d706799f1fe746f07fab0e8cc10e60416902
Signed-off-by: adheli.tavares <adheli.tavares@est.tech>
---
 participant/pom.xml | 39 +--------------------------------------
 pom.xml             | 16 ++++++++++++++--
 runtime-acm/pom.xml | 37 -------------------------------------
 3 files changed, 15 insertions(+), 77 deletions(-)

diff --git a/participant/pom.xml b/participant/pom.xml
index 4c16ea43b..14915bd72 100644
--- a/participant/pom.xml
+++ b/participant/pom.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
   ============LICENSE_START=======================================================
-  Copyright (C) 2021, 2023-2024 Nordix Foundation.
+  Copyright (C) 2021, 2023-2025 Nordix Foundation.
   ================================================================================
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
@@ -120,43 +120,6 @@
             <groupId>io.micrometer</groupId>
             <artifactId>micrometer-tracing-bridge-otel</artifactId>
         </dependency>
-
-        <!-- these netty dependencies need to be uplifted later in parent-->
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-all</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-buffer</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-codec</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-codec-http2</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-common</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-handler</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-handler-proxy</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
     </dependencies>
 
     <build>
diff --git a/pom.xml b/pom.xml
index e372f0553..ba5b87888 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1,6 +1,6 @@
 <!--
   ============LICENSE_START=======================================================
-  Copyright (C) 2021-2024 Nordix Foundation.
+  Copyright (C) 2021-2025 Nordix Foundation.
   ================================================================================
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
@@ -52,7 +52,6 @@
     <properties>
         <policy.common.version>3.1.1-SNAPSHOT</policy.common.version>
         <policy.models.version>4.1.1-SNAPSHOT</policy.models.version>
-        <version.netty>4.1.112.Final</version.netty>
     </properties>
     <modules>
         <module>common</module>
@@ -62,4 +61,17 @@
         <module>runtime-acm</module>
         <module>participant</module>
     </modules>
+
+    <!-- Fix transitive dependencies' vulnerabilities -->
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-bom</artifactId>
+                <version>4.1.119.Final</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
 </project>
diff --git a/runtime-acm/pom.xml b/runtime-acm/pom.xml
index 0ed54a6cc..8852115a1 100644
--- a/runtime-acm/pom.xml
+++ b/runtime-acm/pom.xml
@@ -308,43 +308,6 @@
             <artifactId>spring-boot-test-autoconfigure</artifactId>
             <scope>test</scope>
         </dependency>
-
-        <!-- these netty dependencies need to be uplifted later in parent-->
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-all</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-buffer</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-codec</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-codec-http2</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-common</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-handler</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.netty</groupId>
-            <artifactId>netty-handler-proxy</artifactId>
-            <version>${version.netty}</version>
-        </dependency>
     </dependencies>
 
     <build>
-- 
cgit