neo4j-2025.01: pombump netty to address CVE

Specifically CVE-2025-25193 GHSA-389x-839f-4rhx and CVE-2025-24970 GHSA-4g8c-wm8x-jfhw. Also remove the unused `pombump-properties.yaml` file: `maven/pombump` wasn't in the pipeline so both it and `pombump-properties.yaml` were previously unused.
wolfi-dev · Mar 3, 2025 · 8f1544b · 8f1544b
1 parent bcf847d
commit 8f1544b
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 6 deletions.
diff --git a/neo4j-2025.01.yaml b/neo4j-2025.01.yaml
@@ -31,6 +31,8 @@ pipeline:
       tag: ${{package.version}}
       expected-commit: aa168a96c066c736faaf121480c2b5572ad0037d
 
+  - uses: maven/pombump
+
   - runs: |
       export LANG=en_US.UTF-8
       export MAVEN_OPTS="-Xmx2048m"

diff --git a/neo4j-2025.01/pombump-deps.yaml b/neo4j-2025.01/pombump-deps.yaml
@@ -1,4 +1,4 @@
 patches:
-    - groupId: com.google.protobuf
-      artifactId: protobuf-java
-      version: 3.25.5
+    - groupId: io.netty
+      artifactId: netty-bom
+      version: 4.1.118.Final
diff --git a/neo4j-2025.01/pombump-properties.yaml b/neo4j-2025.01/pombump-properties.yaml