From 7634a8d51c9f1a8bd4103901d0cdae51fc36effa Mon Sep 17 00:00:00 2001
From: sidhdirenge <sidhdirenge@google.com>
Date: Thu, 18 Jun 2026 07:38:35 +0000
Subject: [PATCH] Override netty version to 3.9.9.Final to resolve
 CVE-2015-2156

---
 adls-plugins/pom.xml | 5 +++++
 pom.xml              | 1 +
 2 files changed, 6 insertions(+)

diff --git a/adls-plugins/pom.xml b/adls-plugins/pom.xml
index 899a9de..e6d876e 100644
--- a/adls-plugins/pom.xml
+++ b/adls-plugins/pom.xml
@@ -28,6 +28,11 @@
   <artifactId>adls-plugins</artifactId>
 
   <dependencies>
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty</artifactId>
+      <version>${netty.version}</version>
+    </dependency>
     <dependency>
       <groupId>org.apache.avro</groupId>
       <artifactId>avro-mapred</artifactId>
diff --git a/pom.xml b/pom.xml
index 8a6aac8..706b74a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -88,6 +88,7 @@
     <app.parents>
       system:cdap-data-pipeline[6.11.0-SNAPSHOT,7.0.0-SNAPSHOT),system:cdap-data-streams[6.11.0-SNAPSHOT,7.0.0-SNAPSHOT)
     </app.parents>
+    <netty.version>3.10.6.Final</netty.version>
     <main.basedir>${project.basedir}</main.basedir>
   </properties>