From 49119eab5ca0e519b1737e1f1ecfa021d9ef7b9e Mon Sep 17 00:00:00 2001
From: Zhe Sun <31067185+ZheSun88@users.noreply.github.com>
Date: Thu, 14 Nov 2024 11:48:30 +0200
Subject: [PATCH] fix: dependency convergence error from copilot (#6998)

- `dependency convergence` : there two different versions of io.netty:netty-* in this reactor-netty:1.2.0 , which are 4.1.114 and 4.1.113
- `vulnerable dependency` : the reactor-netty:1.2.0 uses io.netty:netty-common:4.1.114 which contains https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv
---
 vaadin-dev/pom.xml | 67 ++++++++++++++++++++++++++++++++++++++++++++++
 versions.json      |  2 +-
 2 files changed, 68 insertions(+), 1 deletion(-)

diff --git a/vaadin-dev/pom.xml b/vaadin-dev/pom.xml
index 0355ff11d..0390125ff 100644
--- a/vaadin-dev/pom.xml
+++ b/vaadin-dev/pom.xml
@@ -52,8 +52,75 @@
         <dependency>
             <groupId>com.vaadin</groupId>
             <artifactId>copilot</artifactId>
+            <exclusions>
+                <!-- io.projectreactor.netty:reactor-netty:jar:1.1.24 brings vulnerable dependencies
+                and also failed the dependency convergence test, as netty-* has different versions   -->
+                <exclusion>
+                    <groupId>io.netty</groupId>
+                    <artifactId>netty-common</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.netty</groupId>
+                    <artifactId>netty-buffer</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.netty</groupId>
+                    <artifactId>netty-codec</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.netty</groupId>
+                    <artifactId>netty-handler</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.netty</groupId>
+                    <artifactId>netty-transport</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.netty</groupId>
+                    <artifactId>netty-resolver</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.netty</groupId>
+                    <artifactId>netty-transport-native-unix-common</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-common</artifactId>
+            <version>4.1.115.Final</version>
+        </dependency>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-buffer</artifactId>
+            <version>4.1.115.Final</version>
+        </dependency>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-codec</artifactId>
+            <version>4.1.115.Final</version>
+        </dependency>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-handler</artifactId>
+            <version>4.1.115.Final</version>
+        </dependency>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-transport</artifactId>
+            <version>4.1.115.Final</version>
+        </dependency>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-resolver</artifactId>
+            <version>4.1.115.Final</version>
+        </dependency>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-transport-native-unix-common</artifactId>
+            <version>4.1.115.Final</version>
+        </dependency>
     </dependencies>
     <build>
         <plugins>
diff --git a/versions.json b/versions.json
index b83c937ba..c08153811 100644
--- a/versions.json
+++ b/versions.json
@@ -382,7 +382,7 @@
             "version": "1.0.0"
         },
         "copilot": {
-            "javaVersion": "24.4.16"
+            "javaVersion": "24.4-SNAPSHOT"
         },
         "kubernetes-kit-starter": {
             "javaVersion": "2.3.0"