Skip to content

Include user properties and subscription IDs in MqttProperties#isEmpty#16575

Merged
normanmaurer merged 1 commit into
netty:4.2from
ShadowySpirits:fix-mqtt-properties-is-empty
Mar 31, 2026
Merged

Include user properties and subscription IDs in MqttProperties#isEmpty#16575
normanmaurer merged 1 commit into
netty:4.2from
ShadowySpirits:fix-mqtt-properties-is-empty

Conversation

@ShadowySpirits
Copy link
Copy Markdown
Contributor

Motivation:

MqttProperties.isEmpty() only checks the regular property map.

Modification:

Update MqttProperties.isEmpty() so it also considers userProperties and subscriptionIds.

Result:

Fixes #16574

Copilot AI review requested due to automatic review settings March 30, 2026 08:39
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes MQTT 5 encoding decisions that incorrectly treat MqttProperties as empty when it contains only User Properties or Subscription Identifiers, which can cause reason code + property sections to be skipped on the wire (per #16574).

Changes:

  • Update MqttProperties.isEmpty() to also consider userProperties and subscriptionIds.
  • Add unit tests covering isEmpty() behavior for User Properties and Subscription Identifiers.
  • Add codec-level tests to ensure PUBACK and DISCONNECT with success + User Property are encoded/decoded with properties preserved in MQTT 5.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File Description
codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttProperties.java Fixes isEmpty() to reflect all property containers, preventing incorrect “no properties” fast-paths.
codec-mqtt/src/test/java/io/netty/handler/codec/mqtt/MqttPropertiesTest.java Adds focused unit tests validating isEmpty() with only user properties / subscription identifiers.
codec-mqtt/src/test/java/io/netty/handler/codec/mqtt/MqttCodecTest.java Adds regression tests proving MQTT 5 success responses still carry User Properties through encode/decode.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@normanmaurer
Copy link
Copy Markdown
Member

@ShadowySpirits
Copy link
Copy Markdown
Contributor Author

@ShadowySpirits did you sign our ICLA ? https://netty.io/s/icla

I just signed it.

@ShadowySpirits ShadowySpirits force-pushed the fix-mqtt-properties-is-empty branch from a2c753c to 10c96ac Compare March 30, 2026 11:12
@normanmaurer normanmaurer added this to the 4.2.13.Final milestone Mar 30, 2026
@normanmaurer normanmaurer added needs-cherry-pick-4.1 This PR should be cherry-picked to 4.1 once merged. needs-cherry-pick-5.0 This PR should be cherry-picked to 5.0 once merged. labels Mar 30, 2026
@ShadowySpirits
Copy link
Copy Markdown
Contributor Author

@normanmaurer The workflow failed due to an iouring test error, which seems unrelated to this PR.

2026-03-30T14:06:44.9557145Z [ERROR] Failures: 
2026-03-30T14:06:44.9559777Z [ERROR]   IoUringDomainSocketAbstractFdTest>IoUringDomainSocketFdTest.testSendRecvFd:59->AbstractComboTestsuiteTest.run:52->IoUringDomainSocketFdTest.testSendRecvFd:143 expected: not equal but was: <0>
2026-03-30T14:06:44.9562945Z [ERROR]   IoUringDomainSocketFdTest.testSendRecvFd:59->AbstractComboTestsuiteTest.run:52->testSendRecvFd:143 expected: not equal but was: <0>

@normanmaurer normanmaurer merged commit 4a6b875 into netty:4.2 Mar 31, 2026
13 of 23 checks passed
@normanmaurer
Copy link
Copy Markdown
Member

@ShadowySpirits thanks!

netty-project-bot pushed a commit that referenced this pull request Mar 31, 2026
#16575)

Motivation:

MqttProperties.isEmpty() only checks the regular property map.

Modification:

Update MqttProperties.isEmpty() so it also considers userProperties and
subscriptionIds.

Result:

Fixes #16574

(cherry picked from commit 4a6b875)
@netty-project-bot
Copy link
Copy Markdown
Contributor

Auto-port PR for 4.1: #16582

@github-actions github-actions Bot removed the needs-cherry-pick-4.1 This PR should be cherry-picked to 4.1 once merged. label Mar 31, 2026
netty-project-bot pushed a commit that referenced this pull request Mar 31, 2026
#16575)

Motivation:

MqttProperties.isEmpty() only checks the regular property map.

Modification:

Update MqttProperties.isEmpty() so it also considers userProperties and
subscriptionIds.

Result:

Fixes #16574

(cherry picked from commit 4a6b875)
@netty-project-bot
Copy link
Copy Markdown
Contributor

Auto-port PR for 5.0: #16583

@github-actions github-actions Bot removed the needs-cherry-pick-5.0 This PR should be cherry-picked to 5.0 once merged. label Mar 31, 2026
normanmaurer added a commit that referenced this pull request Apr 1, 2026
…operties#isEmpty (#16582)

Auto-port of #16575 to 4.1
Cherry-picked commit: 4a6b875

---
Motivation:

MqttProperties.isEmpty() only checks the regular property map.

Modification:

Update MqttProperties.isEmpty() so it also considers userProperties and
subscriptionIds.

Result:

Fixes #16574

---------

Co-authored-by: SSpirits <[email protected]>
Co-authored-by: Norman Maurer <[email protected]>
normanmaurer pushed a commit that referenced this pull request Apr 1, 2026
…operties#isEmpty (#16583)

Auto-port of #16575 to 5.0
Cherry-picked commit: 4a6b875

---
Motivation:

MqttProperties.isEmpty() only checks the regular property map.

Modification:

Update MqttProperties.isEmpty() so it also considers userProperties and
subscriptionIds.

Result:

Fixes #16574

Co-authored-by: SSpirits <[email protected]>
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request May 10, 2026
…l [skip ci]

Bumps [io.netty:netty-all](https://github.com/netty/netty) from 4.2.12.Final to 4.2.13.Final.
Release notes

*Sourced from [io.netty:netty-all's releases](https://github.com/netty/netty/releases).*

> netty-4.2.13.Final
> ------------------
>
> CVEs Fixed
> ----------
>
> * [CVE-2026-42586](GHSA-rgrr-p7gp-5xj7) (netty-codec-redis)
> * [CVE-2026-42578](GHSA-45q3-82m4-75jr) (netty-handler-proxy)
> * [CVE-2026-42577](GHSA-rwm7-x88c-3g2p) (netty-transport-native-epoll)
> * [CVE-2026-42587](GHSA-f6hv-jmp6-3vwv) (netty-codec-http, netty-codec-http2)
> * [CVE-2026-41417](GHSA-v8h7-rr48-vmmv) (netty-codec-http)
> * [CVE-2026-42581](GHSA-xxqh-mfjm-7mv9) (netty-codec-http)
> * [CVE-2026-42580](GHSA-m4cv-j2px-7723) (netty-codec-http)
> * [CVE-2026-42585](GHSA-38f8-5428-x5cv) (netty-codec-http)
> * [CVE-2026-42579](GHSA-cm33-6792-r9fm) (netty-codec-dns)
> * [CVE-2026-42582](GHSA-2c5c-chwr-9hqw) (netty-codec-http3)
> * [CVE-2026-42583](GHSA-mj4r-2hfc-f8p6) (netty-codec, netty-codec-compression)
> * [CVE-2026-42584](GHSA-57rv-r2g8-2cj3) (netty-codec-http)
> * [CVE-2026-44248](GHSA-jfg9-48mv-9qgx) (netty-codec-mqtt)
>
> What's Changed
> --------------
>
> * Kqueue: sendfile EINTR doesn't advance offset — data duplication by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16544](https://redirect.github.com/netty/netty/pull/16544)
> * Replace usage of strerror with thread-safe alternative by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16547](https://redirect.github.com/netty/netty/pull/16547)
> * Fix implementation of strerror\_r\_xsi for GNU by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16546](https://redirect.github.com/netty/netty/pull/16546)
> * Lazy init ArrayList in DefaultHeaders.getAll by [`@​doom369`](https://github.com/doom369) in [netty/netty#16526](https://redirect.github.com/netty/netty/pull/16526)
> * Less logging in AWS-LC build by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16565](https://redirect.github.com/netty/netty/pull/16565)
> * Ensure the CRYPTO\_BUFFER\_POOL is also freed when we fail creating the SSLContext by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16545](https://redirect.github.com/netty/netty/pull/16545)
> * Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16543](https://redirect.github.com/netty/netty/pull/16543)
> * Avoid leak in PemReader on OutOfDirectMemoryError by [`@​raipc`](https://github.com/raipc) in [netty/netty#16551](https://redirect.github.com/netty/netty/pull/16551)
> * IoUring: Disable test while we debug to unblock other builds by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16581](https://redirect.github.com/netty/netty/pull/16581)
> * Include user properties and subscription IDs in MqttProperties#isEmpty by [`@​ShadowySpirits`](https://github.com/ShadowySpirits) in [netty/netty#16575](https://redirect.github.com/netty/netty/pull/16575)
> * Native DNS resolver: Guard against malloc failures by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16559](https://redirect.github.com/netty/netty/pull/16559)
> * Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16578](https://redirect.github.com/netty/netty/pull/16578)
> * Fix parsing HTTP chunks with multiple extensions by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16579](https://redirect.github.com/netty/netty/pull/16579)
> * Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by [`@​dependabot`](https://github.com/dependabot)[bot] in [netty/netty#16572](https://redirect.github.com/netty/netty/pull/16572)
> * Revert to PR build to Ubuntu 22.04 by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16595](https://redirect.github.com/netty/netty/pull/16595)
> * Native transports: Correctly create pipe when pipe2 is not supported by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16592](https://redirect.github.com/netty/netty/pull/16592)
> * Epoll: Cleanup code to always return negative value on failure by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16591](https://redirect.github.com/netty/netty/pull/16591)
> * Fix component search fast path by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16548](https://redirect.github.com/netty/netty/pull/16548)
> * Stabilize read-only toStringMultipleThreads1 by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16608](https://redirect.github.com/netty/netty/pull/16608)
> * Stabilize more AbstractByteBufTests by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16611](https://redirect.github.com/netty/netty/pull/16611)
> * Remove note about needing 256-bit for PQC by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16605](https://redirect.github.com/netty/netty/pull/16605)
> * Stabilize testSessionInvalidate for Conscrypt by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16615](https://redirect.github.com/netty/netty/pull/16615)
> * Quic: Correctly handle SSL\_CTX\_new failures by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16622](https://redirect.github.com/netty/netty/pull/16622)
> * Make LocalIoHandle public by [`@​rdicroce`](https://github.com/rdicroce) in [netty/netty#16621](https://redirect.github.com/netty/netty/pull/16621)
> * Quic: Fix shadowing of variable which leads to incorrectly handling errors by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16623](https://redirect.github.com/netty/netty/pull/16623)
> * Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16629](https://redirect.github.com/netty/netty/pull/16629)
> * Fix `shutdownInput` bug in kqueue for empty recv buffer by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16630](https://redirect.github.com/netty/netty/pull/16630)
> * fix FFM address semantics in directBufferAddress by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16603](https://redirect.github.com/netty/netty/pull/16603)
> * HTTP2: Ensure HTTP2 preface is always send as first message by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16636](https://redirect.github.com/netty/netty/pull/16636)
> * Move Http2FrameCodecSubClassTest to correct package by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16640](https://redirect.github.com/netty/netty/pull/16640)
> * Kqueue: Fix usage of LOCAL\_PEERPID by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16637](https://redirect.github.com/netty/netty/pull/16637)
> * Avoid ArrayQueue allocation in HttpServerCodec by [`@​doom369`](https://github.com/doom369) in [netty/netty#16596](https://redirect.github.com/netty/netty/pull/16596)
> * Fix file descriptor reuse bug in kqueue by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16650](https://redirect.github.com/netty/netty/pull/16650)

... (truncated)


Commits

* [`b3844c8`](netty/netty@b3844c8) [maven-release-plugin] prepare release netty-4.2.13.Final
* [`82f47fa`](netty/netty@82f47fa) Merge commit from fork
* [`ada0999`](netty/netty@ada0999) Merge commit from fork
* [`b4051e2`](netty/netty@b4051e2) Fix BrotliDecoder not forwarding all decompressed chunks
* [`67207c1`](netty/netty@67207c1) Merge commit from fork
* [`541ca7c`](netty/netty@541ca7c) Merge commit from fork
* [`943edb3`](netty/netty@943edb3) Fix codec-dns tests
* [`6459a28`](netty/netty@6459a28) Merge commit from fork
* [`b4ba61b`](netty/netty@b4ba61b) Fix checkstyle in HttpObjectDecoder
* [`977661f`](netty/netty@977661f) Merge commit from fork
* Additional commits viewable in [compare view](netty/netty@netty-4.2.12.Final...netty-4.2.13.Final)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=io.netty:netty-all&package-manager=maven&previous-version=4.2.12.Final&new-version=4.2.13.Final)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request May 10, 2026
…ip ci]

Bumps `netty.version` from 4.2.12.Final to 4.2.13.Final.
Updates `io.netty:netty-transport` from 4.2.12.Final to 4.2.13.Final
Release notes

*Sourced from [io.netty:netty-transport's releases](https://github.com/netty/netty/releases).*

> netty-4.2.13.Final
> ------------------
>
> CVEs Fixed
> ----------
>
> * [CVE-2026-42586](GHSA-rgrr-p7gp-5xj7) (netty-codec-redis)
> * [CVE-2026-42578](GHSA-45q3-82m4-75jr) (netty-handler-proxy)
> * [CVE-2026-42577](GHSA-rwm7-x88c-3g2p) (netty-transport-native-epoll)
> * [CVE-2026-42587](GHSA-f6hv-jmp6-3vwv) (netty-codec-http, netty-codec-http2)
> * [CVE-2026-41417](GHSA-v8h7-rr48-vmmv) (netty-codec-http)
> * [CVE-2026-42581](GHSA-xxqh-mfjm-7mv9) (netty-codec-http)
> * [CVE-2026-42580](GHSA-m4cv-j2px-7723) (netty-codec-http)
> * [CVE-2026-42585](GHSA-38f8-5428-x5cv) (netty-codec-http)
> * [CVE-2026-42579](GHSA-cm33-6792-r9fm) (netty-codec-dns)
> * [CVE-2026-42582](GHSA-2c5c-chwr-9hqw) (netty-codec-http3)
> * [CVE-2026-42583](GHSA-mj4r-2hfc-f8p6) (netty-codec, netty-codec-compression)
> * [CVE-2026-42584](GHSA-57rv-r2g8-2cj3) (netty-codec-http)
> * [CVE-2026-44248](GHSA-jfg9-48mv-9qgx) (netty-codec-mqtt)
>
> What's Changed
> --------------
>
> * Kqueue: sendfile EINTR doesn't advance offset — data duplication by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16544](https://redirect.github.com/netty/netty/pull/16544)
> * Replace usage of strerror with thread-safe alternative by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16547](https://redirect.github.com/netty/netty/pull/16547)
> * Fix implementation of strerror\_r\_xsi for GNU by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16546](https://redirect.github.com/netty/netty/pull/16546)
> * Lazy init ArrayList in DefaultHeaders.getAll by [`@​doom369`](https://github.com/doom369) in [netty/netty#16526](https://redirect.github.com/netty/netty/pull/16526)
> * Less logging in AWS-LC build by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16565](https://redirect.github.com/netty/netty/pull/16565)
> * Ensure the CRYPTO\_BUFFER\_POOL is also freed when we fail creating the SSLContext by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16545](https://redirect.github.com/netty/netty/pull/16545)
> * Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16543](https://redirect.github.com/netty/netty/pull/16543)
> * Avoid leak in PemReader on OutOfDirectMemoryError by [`@​raipc`](https://github.com/raipc) in [netty/netty#16551](https://redirect.github.com/netty/netty/pull/16551)
> * IoUring: Disable test while we debug to unblock other builds by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16581](https://redirect.github.com/netty/netty/pull/16581)
> * Include user properties and subscription IDs in MqttProperties#isEmpty by [`@​ShadowySpirits`](https://github.com/ShadowySpirits) in [netty/netty#16575](https://redirect.github.com/netty/netty/pull/16575)
> * Native DNS resolver: Guard against malloc failures by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16559](https://redirect.github.com/netty/netty/pull/16559)
> * Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16578](https://redirect.github.com/netty/netty/pull/16578)
> * Fix parsing HTTP chunks with multiple extensions by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16579](https://redirect.github.com/netty/netty/pull/16579)
> * Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by [`@​dependabot`](https://github.com/dependabot)[bot] in [netty/netty#16572](https://redirect.github.com/netty/netty/pull/16572)
> * Revert to PR build to Ubuntu 22.04 by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16595](https://redirect.github.com/netty/netty/pull/16595)
> * Native transports: Correctly create pipe when pipe2 is not supported by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16592](https://redirect.github.com/netty/netty/pull/16592)
> * Epoll: Cleanup code to always return negative value on failure by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16591](https://redirect.github.com/netty/netty/pull/16591)
> * Fix component search fast path by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16548](https://redirect.github.com/netty/netty/pull/16548)
> * Stabilize read-only toStringMultipleThreads1 by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16608](https://redirect.github.com/netty/netty/pull/16608)
> * Stabilize more AbstractByteBufTests by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16611](https://redirect.github.com/netty/netty/pull/16611)
> * Remove note about needing 256-bit for PQC by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16605](https://redirect.github.com/netty/netty/pull/16605)
> * Stabilize testSessionInvalidate for Conscrypt by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16615](https://redirect.github.com/netty/netty/pull/16615)
> * Quic: Correctly handle SSL\_CTX\_new failures by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16622](https://redirect.github.com/netty/netty/pull/16622)
> * Make LocalIoHandle public by [`@​rdicroce`](https://github.com/rdicroce) in [netty/netty#16621](https://redirect.github.com/netty/netty/pull/16621)
> * Quic: Fix shadowing of variable which leads to incorrectly handling errors by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16623](https://redirect.github.com/netty/netty/pull/16623)
> * Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16629](https://redirect.github.com/netty/netty/pull/16629)
> * Fix `shutdownInput` bug in kqueue for empty recv buffer by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16630](https://redirect.github.com/netty/netty/pull/16630)
> * fix FFM address semantics in directBufferAddress by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16603](https://redirect.github.com/netty/netty/pull/16603)
> * HTTP2: Ensure HTTP2 preface is always send as first message by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16636](https://redirect.github.com/netty/netty/pull/16636)
> * Move Http2FrameCodecSubClassTest to correct package by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16640](https://redirect.github.com/netty/netty/pull/16640)
> * Kqueue: Fix usage of LOCAL\_PEERPID by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16637](https://redirect.github.com/netty/netty/pull/16637)
> * Avoid ArrayQueue allocation in HttpServerCodec by [`@​doom369`](https://github.com/doom369) in [netty/netty#16596](https://redirect.github.com/netty/netty/pull/16596)
> * Fix file descriptor reuse bug in kqueue by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16650](https://redirect.github.com/netty/netty/pull/16650)

... (truncated)


Commits

* [`b3844c8`](netty/netty@b3844c8) [maven-release-plugin] prepare release netty-4.2.13.Final
* [`82f47fa`](netty/netty@82f47fa) Merge commit from fork
* [`ada0999`](netty/netty@ada0999) Merge commit from fork
* [`b4051e2`](netty/netty@b4051e2) Fix BrotliDecoder not forwarding all decompressed chunks
* [`67207c1`](netty/netty@67207c1) Merge commit from fork
* [`541ca7c`](netty/netty@541ca7c) Merge commit from fork
* [`943edb3`](netty/netty@943edb3) Fix codec-dns tests
* [`6459a28`](netty/netty@6459a28) Merge commit from fork
* [`b4ba61b`](netty/netty@b4ba61b) Fix checkstyle in HttpObjectDecoder
* [`977661f`](netty/netty@977661f) Merge commit from fork
* Additional commits viewable in [compare view](netty/netty@netty-4.2.12.Final...netty-4.2.13.Final)
  
Updates `io.netty:netty-codec` from 4.2.12.Final to 4.2.13.Final
Release notes

*Sourced from [io.netty:netty-codec's releases](https://github.com/netty/netty/releases).*

> netty-4.2.13.Final
> ------------------
>
> CVEs Fixed
> ----------
>
> * [CVE-2026-42586](GHSA-rgrr-p7gp-5xj7) (netty-codec-redis)
> * [CVE-2026-42578](GHSA-45q3-82m4-75jr) (netty-handler-proxy)
> * [CVE-2026-42577](GHSA-rwm7-x88c-3g2p) (netty-transport-native-epoll)
> * [CVE-2026-42587](GHSA-f6hv-jmp6-3vwv) (netty-codec-http, netty-codec-http2)
> * [CVE-2026-41417](GHSA-v8h7-rr48-vmmv) (netty-codec-http)
> * [CVE-2026-42581](GHSA-xxqh-mfjm-7mv9) (netty-codec-http)
> * [CVE-2026-42580](GHSA-m4cv-j2px-7723) (netty-codec-http)
> * [CVE-2026-42585](GHSA-38f8-5428-x5cv) (netty-codec-http)
> * [CVE-2026-42579](GHSA-cm33-6792-r9fm) (netty-codec-dns)
> * [CVE-2026-42582](GHSA-2c5c-chwr-9hqw) (netty-codec-http3)
> * [CVE-2026-42583](GHSA-mj4r-2hfc-f8p6) (netty-codec, netty-codec-compression)
> * [CVE-2026-42584](GHSA-57rv-r2g8-2cj3) (netty-codec-http)
> * [CVE-2026-44248](GHSA-jfg9-48mv-9qgx) (netty-codec-mqtt)
>
> What's Changed
> --------------
>
> * Kqueue: sendfile EINTR doesn't advance offset — data duplication by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16544](https://redirect.github.com/netty/netty/pull/16544)
> * Replace usage of strerror with thread-safe alternative by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16547](https://redirect.github.com/netty/netty/pull/16547)
> * Fix implementation of strerror\_r\_xsi for GNU by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16546](https://redirect.github.com/netty/netty/pull/16546)
> * Lazy init ArrayList in DefaultHeaders.getAll by [`@​doom369`](https://github.com/doom369) in [netty/netty#16526](https://redirect.github.com/netty/netty/pull/16526)
> * Less logging in AWS-LC build by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16565](https://redirect.github.com/netty/netty/pull/16565)
> * Ensure the CRYPTO\_BUFFER\_POOL is also freed when we fail creating the SSLContext by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16545](https://redirect.github.com/netty/netty/pull/16545)
> * Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16543](https://redirect.github.com/netty/netty/pull/16543)
> * Avoid leak in PemReader on OutOfDirectMemoryError by [`@​raipc`](https://github.com/raipc) in [netty/netty#16551](https://redirect.github.com/netty/netty/pull/16551)
> * IoUring: Disable test while we debug to unblock other builds by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16581](https://redirect.github.com/netty/netty/pull/16581)
> * Include user properties and subscription IDs in MqttProperties#isEmpty by [`@​ShadowySpirits`](https://github.com/ShadowySpirits) in [netty/netty#16575](https://redirect.github.com/netty/netty/pull/16575)
> * Native DNS resolver: Guard against malloc failures by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16559](https://redirect.github.com/netty/netty/pull/16559)
> * Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16578](https://redirect.github.com/netty/netty/pull/16578)
> * Fix parsing HTTP chunks with multiple extensions by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16579](https://redirect.github.com/netty/netty/pull/16579)
> * Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by [`@​dependabot`](https://github.com/dependabot)[bot] in [netty/netty#16572](https://redirect.github.com/netty/netty/pull/16572)
> * Revert to PR build to Ubuntu 22.04 by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16595](https://redirect.github.com/netty/netty/pull/16595)
> * Native transports: Correctly create pipe when pipe2 is not supported by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16592](https://redirect.github.com/netty/netty/pull/16592)
> * Epoll: Cleanup code to always return negative value on failure by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16591](https://redirect.github.com/netty/netty/pull/16591)
> * Fix component search fast path by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16548](https://redirect.github.com/netty/netty/pull/16548)
> * Stabilize read-only toStringMultipleThreads1 by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16608](https://redirect.github.com/netty/netty/pull/16608)
> * Stabilize more AbstractByteBufTests by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16611](https://redirect.github.com/netty/netty/pull/16611)
> * Remove note about needing 256-bit for PQC by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16605](https://redirect.github.com/netty/netty/pull/16605)
> * Stabilize testSessionInvalidate for Conscrypt by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16615](https://redirect.github.com/netty/netty/pull/16615)
> * Quic: Correctly handle SSL\_CTX\_new failures by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16622](https://redirect.github.com/netty/netty/pull/16622)
> * Make LocalIoHandle public by [`@​rdicroce`](https://github.com/rdicroce) in [netty/netty#16621](https://redirect.github.com/netty/netty/pull/16621)
> * Quic: Fix shadowing of variable which leads to incorrectly handling errors by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16623](https://redirect.github.com/netty/netty/pull/16623)
> * Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16629](https://redirect.github.com/netty/netty/pull/16629)
> * Fix `shutdownInput` bug in kqueue for empty recv buffer by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16630](https://redirect.github.com/netty/netty/pull/16630)
> * fix FFM address semantics in directBufferAddress by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16603](https://redirect.github.com/netty/netty/pull/16603)
> * HTTP2: Ensure HTTP2 preface is always send as first message by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16636](https://redirect.github.com/netty/netty/pull/16636)
> * Move Http2FrameCodecSubClassTest to correct package by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16640](https://redirect.github.com/netty/netty/pull/16640)
> * Kqueue: Fix usage of LOCAL\_PEERPID by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16637](https://redirect.github.com/netty/netty/pull/16637)
> * Avoid ArrayQueue allocation in HttpServerCodec by [`@​doom369`](https://github.com/doom369) in [netty/netty#16596](https://redirect.github.com/netty/netty/pull/16596)
> * Fix file descriptor reuse bug in kqueue by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16650](https://redirect.github.com/netty/netty/pull/16650)

... (truncated)


Commits

* [`b3844c8`](netty/netty@b3844c8) [maven-release-plugin] prepare release netty-4.2.13.Final
* [`82f47fa`](netty/netty@82f47fa) Merge commit from fork
* [`ada0999`](netty/netty@ada0999) Merge commit from fork
* [`b4051e2`](netty/netty@b4051e2) Fix BrotliDecoder not forwarding all decompressed chunks
* [`67207c1`](netty/netty@67207c1) Merge commit from fork
* [`541ca7c`](netty/netty@541ca7c) Merge commit from fork
* [`943edb3`](netty/netty@943edb3) Fix codec-dns tests
* [`6459a28`](netty/netty@6459a28) Merge commit from fork
* [`b4ba61b`](netty/netty@b4ba61b) Fix checkstyle in HttpObjectDecoder
* [`977661f`](netty/netty@977661f) Merge commit from fork
* Additional commits viewable in [compare view](netty/netty@netty-4.2.12.Final...netty-4.2.13.Final)
  
Updates `io.netty:netty-handler` from 4.2.12.Final to 4.2.13.Final
Release notes

*Sourced from [io.netty:netty-handler's releases](https://github.com/netty/netty/releases).*

> netty-4.2.13.Final
> ------------------
>
> CVEs Fixed
> ----------
>
> * [CVE-2026-42586](GHSA-rgrr-p7gp-5xj7) (netty-codec-redis)
> * [CVE-2026-42578](GHSA-45q3-82m4-75jr) (netty-handler-proxy)
> * [CVE-2026-42577](GHSA-rwm7-x88c-3g2p) (netty-transport-native-epoll)
> * [CVE-2026-42587](GHSA-f6hv-jmp6-3vwv) (netty-codec-http, netty-codec-http2)
> * [CVE-2026-41417](GHSA-v8h7-rr48-vmmv) (netty-codec-http)
> * [CVE-2026-42581](GHSA-xxqh-mfjm-7mv9) (netty-codec-http)
> * [CVE-2026-42580](GHSA-m4cv-j2px-7723) (netty-codec-http)
> * [CVE-2026-42585](GHSA-38f8-5428-x5cv) (netty-codec-http)
> * [CVE-2026-42579](GHSA-cm33-6792-r9fm) (netty-codec-dns)
> * [CVE-2026-42582](GHSA-2c5c-chwr-9hqw) (netty-codec-http3)
> * [CVE-2026-42583](GHSA-mj4r-2hfc-f8p6) (netty-codec, netty-codec-compression)
> * [CVE-2026-42584](GHSA-57rv-r2g8-2cj3) (netty-codec-http)
> * [CVE-2026-44248](GHSA-jfg9-48mv-9qgx) (netty-codec-mqtt)
>
> What's Changed
> --------------
>
> * Kqueue: sendfile EINTR doesn't advance offset — data duplication by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16544](https://redirect.github.com/netty/netty/pull/16544)
> * Replace usage of strerror with thread-safe alternative by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16547](https://redirect.github.com/netty/netty/pull/16547)
> * Fix implementation of strerror\_r\_xsi for GNU by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16546](https://redirect.github.com/netty/netty/pull/16546)
> * Lazy init ArrayList in DefaultHeaders.getAll by [`@​doom369`](https://github.com/doom369) in [netty/netty#16526](https://redirect.github.com/netty/netty/pull/16526)
> * Less logging in AWS-LC build by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16565](https://redirect.github.com/netty/netty/pull/16565)
> * Ensure the CRYPTO\_BUFFER\_POOL is also freed when we fail creating the SSLContext by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16545](https://redirect.github.com/netty/netty/pull/16545)
> * Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16543](https://redirect.github.com/netty/netty/pull/16543)
> * Avoid leak in PemReader on OutOfDirectMemoryError by [`@​raipc`](https://github.com/raipc) in [netty/netty#16551](https://redirect.github.com/netty/netty/pull/16551)
> * IoUring: Disable test while we debug to unblock other builds by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16581](https://redirect.github.com/netty/netty/pull/16581)
> * Include user properties and subscription IDs in MqttProperties#isEmpty by [`@​ShadowySpirits`](https://github.com/ShadowySpirits) in [netty/netty#16575](https://redirect.github.com/netty/netty/pull/16575)
> * Native DNS resolver: Guard against malloc failures by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16559](https://redirect.github.com/netty/netty/pull/16559)
> * Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16578](https://redirect.github.com/netty/netty/pull/16578)
> * Fix parsing HTTP chunks with multiple extensions by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16579](https://redirect.github.com/netty/netty/pull/16579)
> * Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by [`@​dependabot`](https://github.com/dependabot)[bot] in [netty/netty#16572](https://redirect.github.com/netty/netty/pull/16572)
> * Revert to PR build to Ubuntu 22.04 by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16595](https://redirect.github.com/netty/netty/pull/16595)
> * Native transports: Correctly create pipe when pipe2 is not supported by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16592](https://redirect.github.com/netty/netty/pull/16592)
> * Epoll: Cleanup code to always return negative value on failure by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16591](https://redirect.github.com/netty/netty/pull/16591)
> * Fix component search fast path by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16548](https://redirect.github.com/netty/netty/pull/16548)
> * Stabilize read-only toStringMultipleThreads1 by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16608](https://redirect.github.com/netty/netty/pull/16608)
> * Stabilize more AbstractByteBufTests by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16611](https://redirect.github.com/netty/netty/pull/16611)
> * Remove note about needing 256-bit for PQC by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16605](https://redirect.github.com/netty/netty/pull/16605)
> * Stabilize testSessionInvalidate for Conscrypt by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16615](https://redirect.github.com/netty/netty/pull/16615)
> * Quic: Correctly handle SSL\_CTX\_new failures by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16622](https://redirect.github.com/netty/netty/pull/16622)
> * Make LocalIoHandle public by [`@​rdicroce`](https://github.com/rdicroce) in [netty/netty#16621](https://redirect.github.com/netty/netty/pull/16621)
> * Quic: Fix shadowing of variable which leads to incorrectly handling errors by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16623](https://redirect.github.com/netty/netty/pull/16623)
> * Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16629](https://redirect.github.com/netty/netty/pull/16629)
> * Fix `shutdownInput` bug in kqueue for empty recv buffer by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16630](https://redirect.github.com/netty/netty/pull/16630)
> * fix FFM address semantics in directBufferAddress by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16603](https://redirect.github.com/netty/netty/pull/16603)
> * HTTP2: Ensure HTTP2 preface is always send as first message by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16636](https://redirect.github.com/netty/netty/pull/16636)
> * Move Http2FrameCodecSubClassTest to correct package by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16640](https://redirect.github.com/netty/netty/pull/16640)
> * Kqueue: Fix usage of LOCAL\_PEERPID by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16637](https://redirect.github.com/netty/netty/pull/16637)
> * Avoid ArrayQueue allocation in HttpServerCodec by [`@​doom369`](https://github.com/doom369) in [netty/netty#16596](https://redirect.github.com/netty/netty/pull/16596)
> * Fix file descriptor reuse bug in kqueue by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16650](https://redirect.github.com/netty/netty/pull/16650)

... (truncated)


Commits

* [`b3844c8`](netty/netty@b3844c8) [maven-release-plugin] prepare release netty-4.2.13.Final
* [`82f47fa`](netty/netty@82f47fa) Merge commit from fork
* [`ada0999`](netty/netty@ada0999) Merge commit from fork
* [`b4051e2`](netty/netty@b4051e2) Fix BrotliDecoder not forwarding all decompressed chunks
* [`67207c1`](netty/netty@67207c1) Merge commit from fork
* [`541ca7c`](netty/netty@541ca7c) Merge commit from fork
* [`943edb3`](netty/netty@943edb3) Fix codec-dns tests
* [`6459a28`](netty/netty@6459a28) Merge commit from fork
* [`b4ba61b`](netty/netty@b4ba61b) Fix checkstyle in HttpObjectDecoder
* [`977661f`](netty/netty@977661f) Merge commit from fork
* Additional commits viewable in [compare view](netty/netty@netty-4.2.12.Final...netty-4.2.13.Final)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

MqttProperties.isEmpty() ignores user properties and subscription identifiers

4 participants