[BugFix] Fix Netty security vulnerabilities (backport #64142) (#64261)

Signed-off-by: Murphy <[email protected]>

Author: mergify[bot]

.gitignore

@@ -90,3 +90,19 @@ be/tags
 build/
 cmake-build-debug/
 CMakeLists.txt
+.claude
+CLAUDE.md
+.clangd
+.cursor/
+
+
+!build-mac/CMakeLists.txt
+# build-mac generated files
+build-mac/.ninja_deps
+build-mac/.ninja_lock
+build-mac/.ninja_log
+build-mac/CMakeCache.txt
+build-mac/CMakeFiles/
+build-mac/build.ninja
+build-mac/build_version.cc
+build-mac/cmake_install.cmake

.trivyignore

@@ -0,0 +1,4 @@
+# https://avd.aquasec.com/nvd/cve-2025-52999
+# ignore it for now, tracking it in https://github.com/StarRocks/starrocks/issues/60549
+CVE-2025-52999
+CVE-2025-55163

fe/build.gradle.kts

@@ -59,7 +59,7 @@ subprojects {
         set("hive-apache.version", "3.1.2-22")
         set("hudi.version", "1.0.2")
         set("iceberg.version", "1.9.0")
-        set("io.netty.version", "4.1.125.Final")
+        set("io.netty.version", "4.1.128.Final")
         set("jackson.version", "2.15.2")
         set("jetty.version", "9.4.57.v20241219")
         set("jprotobuf-starrocks.version", "1.0.0")

fe/pom.xml

@@ -61,7 +61,7 @@ under the License.
         <kafka-clients.version>3.4.0</kafka-clients.version>
         <arrow.version>18.0.0</arrow.version>
         <grpc.version>1.63.0</grpc.version>
-        <io.netty.version>4.1.125.Final</io.netty.version>
+        <io.netty.version>4.1.128.Final</io.netty.version>
         <puppycrawl.version>10.21.1</puppycrawl.version>
         <aws-v2-sdk.version>2.29.52</aws-v2-sdk.version>
         <avro.version>1.12.0</avro.version>

fs_brokers/apache_hdfs_broker/src/pom.xml

@@ -50,7 +50,7 @@ under the License.
         <jackson.version>2.15.2</jackson.version>
         <avro.version>1.11.4</avro.version>
         <jetty.version>9.4.57.v20241219</jetty.version>
-        <io.netty.version>4.1.125.Final</io.netty.version>
+        <io.netty.version>4.1.128.Final</io.netty.version>
     </properties>
 
     <profiles>

java-extensions/pom.xml

@@ -41,7 +41,7 @@
         <jni-connector.version>1.0.0</jni-connector.version>
         <hadoop-ext.version>1.0.0</hadoop-ext.version>
         <java-utils.version>1.0.0</java-utils.version>
-        <io.netty.version>4.1.125.Final</io.netty.version>
+        <io.netty.version>4.1.128.Final</io.netty.version>
         <protobuf-java.version>3.25.5</protobuf-java.version>
         <nimbusds.version>9.37.2</nimbusds.version>
         <commons-io.version>2.14.0</commons-io.version>