USPR-13767: bump forced io.netty version to 4.2.16.Final

[midnight-clue]

Context & Problem

GitHub Dependabot flagged a moderate-severity CRLF injection vulnerability, GHSA-gcjf-9mgh-3p7g, in io.netty:netty-codec-http (CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder), affecting versions >=4.2.0.Final and <4.2.16.Final. This was reported as GitHub Dependabot alert #114. The repo already pins Netty via a resolutionStrategy override to 4.2.15.Final for prior CVEs, so it needs bumping to the patched 4.2.16.Final. See USPR-13767.

Solution

• Bumped the io.netty version threshold/forced version in the root build.gradle's resolutionStrategy.eachDependency block from 4.2.15.Final to 4.2.16.Final, and appended GHSA-gcjf-9mgh-3p7g to the existing because reason string alongside the prior CVE list.
• Also bumped ext['netty.version'] from 4.2.15.Final to 4.2.16.Final in the two example Spring Boot projects (examples/example-spring-boot-starter-web and examples/example-spring-boot-starter-webflux). This was necessary because Spring Boot's dependency management BOM uses this ext property as the authoritative constraint for Netty in those projects — the root resolutionStrategy.eachDependency block alone did not change the effective resolved version there, as verified below. This follows the exact same pattern established in the prior Netty-pinning commit (850a009 / PR USPR-13707: Security Fix [USPR-13684..13707]: Bump Netty to 4.2.15.Final, Jackson to 2.21.5/3.1.4, Logback to 1.5.34 #379), which updated both mechanisms together.

Verification

• io.netty dependencies forced to >= 4.2.16.Final (verified via ./gradlew :examples:example-spring-boot-starter-webflux:dependencies --configuration runtimeClasspath | grep -i netty-codec-http, which now shows io.netty:netty-codec-http:4.2.12.Final -> 4.2.16.Final (c) and the same for netty-codec-http2/netty-codec-http3)
• because reason string updated to document GHSA-gcjf-9mgh-3p7g alongside prior Netty CVEs

---

🔍 Braintrust trace