chore(deps): bump netty-bom 4.1.133.Final → 4.2.13.Final

[sonika-shah]

Summary

Fixes https://github.com/open-metadata/openmetadata-collate/issues/4046

Bumps io.netty:netty-bom from 4.1.133.Final → 4.2.13.Final.

This is the long-term follow-up to PR #28010 (1.12.7 hotfix). Once this bump lands, AWS Inspector finding CVE-2026-42577 / GHSA-rwm7-x88c-3g2p (netty-transport-native-epoll) is cleared by GAV — the per-direct-dep <exclusion> blocks added in #28010 can then be removed.

Why not in 1.12.7?

The 4.1.x → 4.2.x bump touches the cross-cutting Netty BOM that's transitively used by every HTTP/IO stack in the build (reactor-netty / Azure SDK / Lettuce / Spring / Jackson). It's not safe to ship under hotfix-cadence review. The 1.12.7 PR uses targeted exclusions on the three direct Azure deps; this PR is the proper fix.

Validation done locally

Check	Result
mvn test (openmetadata-service)	5,289 tests, 0 failures
Azure SDK → reactor-netty 1.2.16 smoke (real HTTPS GET)	HTTP 200
Lettuce 6.7.1 compatibility (real Redis, sync/async/pub-sub)	5/5 — 10k concurrent ops, 1k pub/sub messages, zero loss
OM dist tarball	Ships netty-transport-native-epoll-4.2.13.Final
gRPC	Isolated via grpc-netty-shaded (own relocated netty — unaffected)

Follow-up

After this lands, a follow-up PR removes the netty-transport-native-epoll <exclusion> blocks from openmetadata-service/pom.xml (azure-security-keyvault-secrets, azure-identity, azure-storage-blob, azure-identity-extensions).

Fixes open-metadata/openmetadata-collate#4046

---

Summary by Gitar

• Dependency updates:
  • Bumped simplejavamail to 8.12.6 and reactor-netty-http to 1.2.16.
  • Pinned libthrift to 0.23.0 to address CVE-2026-43869.
• Bug fix:
  • Excluded temporal table period columns from autoClassification sampling as referenced in commit 6ac135dc.

_{This will update automatically on new commits.}

[Copilot]

Pull request overview

This PR updates the root Maven dependency management to import a newer io.netty:netty-bom, aiming to clear the netty-transport-native-epoll security finding (CVE-2026-42577 / GHSA-rwm7-x88c-3g2p) by moving off the flagged Netty line.

Changes:

• Bump io.netty:netty-bom from 4.1.133.Final to 4.2.13.Final in the root pom.xml.

[gitar-bot]

Code Review ✅ Approved

Bumps netty-bom to 4.2.13.Final to remediate CVE-2026-42577 and includes an unrelated bug fix to exclude temporal table period columns from autoClassification. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed for 'open-metadata-ingestion'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🟡 Playwright Results — all passed (22 flaky)

✅ 4063 passed · ❌ 0 failed · 🟡 22 flaky · ⏭️ 86 skipped

Shard	Passed	Failed	Flaky	Skipped
🟡 Shard 1	294	0	5	4
🟡 Shard 2	761	0	7	8
🟡 Shard 3	777	0	4	7
✅ Shard 4	790	0	0	18
🟡 Shard 5	708	0	1	41
🟡 Shard 6	733	0	5	8

🟡 22 flaky test(s) (passed on retry)

• Features/CustomizeDetailPage.spec.ts › Glossary Term - customization should work (shard 1, 1 retry)
• Features/Pagination.spec.ts › should test pagination on Table columns (shard 1, 1 retry)
• Features/Pagination.spec.ts › should test Data Models normal pagination (shard 1, 1 retry)
• Features/Pagination.spec.ts › should test Files normal pagination (shard 1, 2 retries)
• Pages/AuditLogs.spec.ts › should apply both User and EntityType filters simultaneously (shard 1, 1 retry)
• Features/ActivityAPI.spec.ts › Activity event shows the actor who made the change (shard 2, 1 retry)
• Features/BulkEditEntity.spec.ts › Glossary (shard 2, 1 retry)
• Features/Glossary/GlossaryWorkflow.spec.ts › should display correct status badge color and icon (shard 2, 1 retry)
• Features/KnowledgeCenter.spec.ts › Article mentions in description should working for Knowledge Center (shard 2, 1 retry)
• Features/KnowledgeCenterTextEditor.spec.ts › Rich Text Editor - Text Formatting (shard 2, 1 retry)
• Features/KnowledgeCenterTextEditor.spec.ts › Rich Text Editor - Text Formatting (shard 2, 1 retry)
• Features/KnowledgeCenterTextEditor.spec.ts › Rich Text Editor - Text Formatting (shard 2, 1 retry)
• Features/Permissions/GlossaryPermissions.spec.ts › Glossary allow operations (shard 3, 1 retry)
• Features/Table.spec.ts › Tags term should be consistent for search (shard 3, 1 retry)
• Features/Workflows/WorkflowOssRestrictions.spec.ts › execution history tab loads and API call succeeds (shard 3, 1 retry)
• Flow/PersonaFlow.spec.ts › Set default persona for team should work properly (shard 3, 1 retry)
• Pages/Entity.spec.ts › Domain Add, Update and Remove (shard 5, 1 retry)
• Pages/ExplorePageRightPanel.spec.ts › Should clear description for container (shard 6, 1 retry)
• Pages/Glossary.spec.ts › Column dropdown drag-and-drop functionality for Glossary Terms table (shard 6, 1 retry)
• Pages/Lineage/LineageFilters.spec.ts › Verify lineage schema filter selection (shard 6, 1 retry)
• Pages/ServiceEntity.spec.ts › Inactive Announcement create & delete (shard 6, 1 retry)
• Pages/UserDetails.spec.ts › Create team with domain and verify visibility of inherited domain in user profile after team removal (shard 6, 1 retry)

📦 Download artifacts

How to debug locally

# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace