[dependabot]

Bumps the gradle-deps group with 2 updates: io.netty:netty-bom and com.diffplug.spotless.

Updates io.netty:netty-bom from 4.2.19.Final to 4.2.20.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.20.Final

Security Fixes

• https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77 - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-v2v6-vch9-4pcg - inefficient CPU computation in netty-codec-http3
• https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8 - insufficient entropy in netty-resolver-dns
• https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x - unbounded memory usage in netty-codec-http2
• https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj - insufficient control character neutralization in netty-codec-http
• https://github.com/netty/netty/security/advisories/GHSA-w53r-xhgx-8582 - use-after-free in netty-codec-classes-quic
• https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948 - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q - unbounded memory usage in netty-codec-mqtt
• https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc - mTLS auth bypass via session resumption in netty-handler and netty-codec-quic

What's Changed

• IoUring: Fix empty writev submissions after sendmsg_zc by @​dreamlike-ocean in netty/netty#17782
• Do not let a negatively cached search domain shadow a positive one by @​akilegaspi in netty/netty#17623
• Fix musl verify job by @​normanmaurer in netty/netty#17801
• Reject Redis lines that start with LF by @​yawkat in netty/netty#17793
• Choose server key types from client's signature algorithms for TLS 1.3 by @​eager-signal in netty/netty#17764
• Port 4.2: LocalChannel: Deliver data written by the peer before it closed (#17814) by @​normanmaurer in netty/netty#17816
• Validate padding of HEADERS frames without priority by @​bryce-anderson in netty/netty#17817
• Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing by @​allthingssecurity in netty/netty#17728
• Preserve invalid SNI names in ReferenceCountedOpenSslEngine by @​gavinbunney in netty/netty#17781
• Optimize redundant bounds checking in ByteBuf.setBytes by @​vpelikh in netty/netty#17023
• Respect SETTINGS_QPACK_BLOCKED_STREAMS for unacknowledged QPACK entries by @​allthingssecurity in netty/netty#17754
• Release the DNS response when a query future loses a cancel race by @​watson-ryan in netty/netty#17475
• Lazily instantiate VarHandle JCTools queues via holder class by @​arnabnandy7 in netty/netty#17750
• Keep reading a closed QUIC stream until the end of its input by @​allthingssecurity in netty/netty#17755
• Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address by @​normanmaurer in netty/netty#17820
• HAProxyMessage: validate the length of all TLV types by @​yawkat in netty/netty#17834
• Fix HpackDynamicTable losing entries when filled to capacity by @​yawkat in netty/netty#17831
• Make AdaptiveByteBuf.memoryAddress() faster by @​lhotari in netty/netty#17767
• Validate bzip2 Huffman code lengths before building decode tables by @​Raghuvardhan-Reddy78 in netty/netty#17812
• Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders by @​normanmaurer in netty/netty#17841
• Throw DecompressionException on JdkZlib preset dictionary mismatch by @​yawkat in netty/netty#17838
• Reject HTTP version numbers that overflow int by @​yawkat in netty/netty#17836
• Apply certificate list size floor by @​arnabnandy7 in netty/netty#17674
• HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by @​yawkat in netty/netty#17837
• HAProxyMessage: decode TLVs with an empty value at the end of the header by @​yawkat in netty/netty#17835
• Reject invalid content-length in PUSH_PROMISE with a stream error by @​yawkat in netty/netty#17867
• Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by @​yawkat in netty/netty#17866
• HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by @​yawkat in netty/netty#17832
• IpSubnetFilter: Add tests for overlapping rules by @​Raghuvardhan-Reddy78 in netty/netty#17765
• Avoid allocating NIO buffer views in AdaptiveByteBuf.setBytes(int, ByteBuf, int, int) by @​lhotari in netty/netty#17840
• Skip JNDI nameserver lookup on IBM i by @​manish-9245 in netty/netty#17872
• Reset the h2c upgrade stream if the request can not be converted by @​yawkat in netty/netty#17869
• Don't size ZstdDecoder output buffers from the frame content size by @​Raghuvardhan-Reddy78 in netty/netty#17896
• Fix NPE in Http2FrameCodec when h2c upgrade fails by @​yawkat in netty/netty#17871
• Allow adaptive allocator magazine cleanup in BlockHound by @​cj848 in netty/netty#17849
• GroupsConverter: fix the x25519mlkem768 group name by @​normanmaurer in netty/netty#17898

... (truncated)

Commits

• 4fb6a5f [maven-release-plugin] prepare release netty-4.2.20.Final
• 3da0f5a Reject all control characters and DEL in HTTP request line tokens
• 464cfd7 TLS/QUIC: Scope session resumption via a derived session_id_context
• b85fb0a Don't preallocate the SUBACK and UNSUBACK reason code lists from the remainin...
• c2196f9 Check the index before every numeric accessor on Unpooled buffers
• dbf089b Fix use-after-free when QuicheQuicConnection.free() races an offloaded SSL task
• 52ce8c5 Bound outstandingRemoteSettingsQueue to prevent unbounded heap growth
• d576bd9 Add 0x20 case randomization and DNS cookie support to DnsNameResolver
• fb4736f Check bounds in ByteBuf string accessors
• debfda5 QPACK: Don't decode the name of Insert With Literal Name again for every valu...
• Additional commits viewable in compare view

Updates com.diffplug.spotless from 8.10.4 to 8.11.0

Release notes

Sourced from com.diffplug.spotless's releases.

Gradle Plugin v8.11.0

Added

• Add cleanup(false) to googleJavaFormat() to disable google-java-format's non-whitespace cleanups. (#3157)
• Add maxLineLength(int) to googleJavaFormat(). (#3151)
  Overrides the 100-column limit prescribed by the GOOGLE and AOSP styles; requires google-java-format 2.0.0 or later.

Changes

• Bump default google-java-format version 1.36.1 -> 2.0.0. (#3157)
  This version applies some small non-whitespace cleanups by default (removing redundant semicolons, empty annotation parentheses, and parentheses around single lambda parameters), which can be disabled with cleanup(false).

Commits

• 8d2edae Published gradle/8.11.0
• 80977b4 Published lib/4.11.0
• ed34276 Add maxLineLength option to googleJavaFormat step (requires gjf 2.0.0+) (#3152)
• b2cd501 docs: split maxLineLength changelog entries into subject and desc style
• d1c06e2 Update plugin-gradle/README.md
• 7fd0a54 Update plugin-maven/README.md
• abe4e9f Merge origin/main: combine cleanup option and gjf 2.0.0 bump with maxLineLength
• 5ec09c0 Bump google-java-format to 2.0.0 and add a cleanup option (#3157)
• e8f21cb Handle older google-java-format versions in GoogleJavaFormatStepTest
• e6eab79 Apply batched suggestions from code review
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Thanks for opening your first pull request on guard-agent-jvm!

Quick checklist before review (most of these are enforced by CI, but worth a glance):

• The PR body says Closes #N for an open issue (the issue-link check enforces it); chores take the no-issue label
• ./gradlew spotlessCheck detekt is clean
• ./gradlew build passes
• No blanket @Suppress in non-test code

See README.md for the agent status. Welcome aboard - a maintainer will review shortly.