Fix CVE-2025-58057 (#4338)

* fix cve

Signed-off-by: Nathalie Jonathan <[email protected]>

* Force version for other netty modules

Signed-off-by: Nathalie Jonathan <[email protected]>

* Apply suggestion

Signed-off-by: Nathalie Jonathan <[email protected]>

* Use versions.netty

Signed-off-by: Nathalie Jonathan <[email protected]>

---------

Signed-off-by: Nathalie Jonathan <[email protected]>

Author: nathaliellenaa

build.gradle

@@ -96,6 +96,15 @@ subprojects {
         // Force spotless depending on newer version of guava due to CVE-2023-2976. Remove after spotless upgrades.
         resolutionStrategy.force "com.google.guava:guava:32.1.3-jre"
         resolutionStrategy.force 'org.apache.commons:commons-compress:1.26.0'
+        resolutionStrategy.force "io.netty:netty-buffer:${versions.netty}"
+        resolutionStrategy.force "io.netty:netty-codec:${versions.netty}"
+        resolutionStrategy.force "io.netty:netty-codec-http:${versions.netty}"
+        resolutionStrategy.force "io.netty:netty-codec-http2:${versions.netty}"
+        resolutionStrategy.force "io.netty:netty-common:${versions.netty}"
+        resolutionStrategy.force "io.netty:netty-handler:${versions.netty}"
+        resolutionStrategy.force "io.netty:netty-resolver:${versions.netty}"
+        resolutionStrategy.force "io.netty:netty-transport:${versions.netty}"
+        resolutionStrategy.force "io.netty:netty-transport-native-unix-common:${versions.netty}"
     }
 
     apply plugin: 'com.diffplug.spotless'