build(deps): bump io.netty:netty-codec from 4.1.133.Final to 4.1.136.Final in /extensions/open-mysql-db

[dependabot]

Bumps io.netty:netty-codec from 4.1.133.Final to 4.1.136.Final.

Release notes

Sourced from io.netty:netty-codec's releases.

netty-4.1.136.Final

What's Changed

• SingleThreadEventExecutor: document Throwable safety contract on run() by @​daguimu in netty/netty#16814
• Make HTTP/2 frame hashCode consistent with equals by @​daguimu in netty/netty#16692
• Add BlockHound exception for DnsQueryIdSpace (#16896) by @​chrisvest in netty/netty#16915
• FlowControlHandler: Fix autoRead behavior by @​chrisvest in netty/netty#16912
• Auto-port 4.1: Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize by @​netty-project-bot in netty/netty#16911
• MQTT: Fix MQTT decoder size check after variable header replay by @​daguimu in netty/netty#16916
• MQTT: Make the decodeProperties early-REPLAY check actually fire by @​daguimu in netty/netty#16813
• Reject control characters at the boundary of HTTP method names (#16723) by @​chrisvest in netty/netty#16933
• Auto-port 4.1: Update to latest tcnative release by @​netty-project-bot in netty/netty#16941
• Auto-port 4.1: Fix HTTP 2 PUSH_PROMISE stream association validation by @​netty-project-bot in netty/netty#16955
• Auto-port 4.1: Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder by @​netty-project-bot in netty/netty#16957
• Auto-port 4.1: Add opt-in validation of mandatory pseudo-header fields for HTTP/2 by @​netty-project-bot in netty/netty#16964
• Strictly validate MQTT UTF-8 Encoded String (#16939) by @​chrisvest in netty/netty#16965
• Auto-port 4.1: Stop DateFormatter trailing token from running past the parse end by @​netty-project-bot in netty/netty#16968
• Auto-port 4.1: IpFilter: Deprecate constructor which use accept by default by @​netty-project-bot in netty/netty#16973
• Add RFC 10008 QUERY Method support (#16966) by @​normanmaurer in netty/netty#16978
• Correctly release and fail queued traffic-shaping writes on close (#16959) by @​normanmaurer in netty/netty#16976
• Auto-port 4.1: FlowControlHandler: respect auto-read when toggled while dequeueing by @​netty-project-bot in netty/netty#16983
• IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout (#16982) by @​chrisvest in netty/netty#16989
• Auto-port 4.1: Fix typo in AbstractSniHandler Javadoc by @​netty-project-bot in netty/netty#16995
• Auto-port 4.1: Reconcile AbstractCoalescingBufferQueue readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames by @​netty-project-bot in netty/netty#16997
• Reject control characters at the boundary of the HTTP version token (#16971) by @​normanmaurer in netty/netty#16986
• Auto-port 4.1: Reset UTF-8 decode state on CR in StompSubframeDecoder by @​netty-project-bot in netty/netty#17003
• Auto-port 4.1: HTTP2: Pass the correct number of arguments when logging goaway by @​netty-project-bot in netty/netty#17017
• FastLz: Guard decompression against truncated input (#17000) by @​chrisvest in netty/netty#17015
• Backport 4.1 Fix propagation of startTls for client SslContext handler by @​skyguard1 in netty/netty#17020
• Auto-port 4.1: Reject non-token characters in HTTP/2 header names by @​netty-project-bot in netty/netty#17022
• Update lz4-java to 1.11.1 by @​yawkat in netty/netty#17060
• Pin github actions to reduce risk (#17043) by @​normanmaurer in netty/netty#17044
• Merge branches from forks (#17063) by @​normanmaurer in netty/netty#17065

Full Changelog: netty/netty@netty-4.1.135.Final...netty-4.1.136.Final

netty-4.1.135.Final

Security fixes

• CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).
• CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).
• CVE-2026-50560: DDoS in io.netty:netty-codec-http2.
• CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).
• CVE-2026-50020: request smuggling in io.netty:netty-codec-http.
• CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).
• CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).
• CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.
• CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

... (truncated)

Commits

• fca0764 [maven-release-plugin] prepare release netty-4.1.136.Final
• bb2ff68 Merge branches from forks (#17063) (#17065)
• 7b44dc9 Pin github actions to reduce risk (#17043) (#17044)
• 50e6e1d Update lz4-java to 1.11.1 (#17060)
• d7dcf6c Auto-port 4.1: Reject non-token characters in HTTP/2 header names (#17022)
• b12bd11 Backport 4.1 Fix propagation of startTls for client SslContext handler (#17020)
• 7fd5cc7 FastLz: Guard decompression against truncated input (#17000) (#17015)
• 42e7103 Auto-port 4.1: HTTP2: Pass the correct number of arguments when logging goawa...
• 666c3b2 Auto-port 4.1: Reset UTF-8 decode state on CR in StompSubframeDecoder (#17003)
• df54c37 Reject control characters at the boundary of the HTTP version token (#16971) ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

SDK Test Report

102 files  ±0  102 suites  ±0   2m 4s ⏱️ -7s
359 tests ±0  345 ✅ ±0  14 💤 ±0  0 ❌ ±0 
487 runs  ±0  473 ✅ ±0  14 💤 ±0  0 ❌ ±0 

Results for commit 7e3c7bf. ± Comparison against base commit cb21cba.

This pull request removes 48 and adds 27 tests. Note that renamed tests count towards both.

  PARTITION BY db1.t1.col2 ORDER BY db1.t1.col1
  PARTITION BY t1.col2 ORDER BY t1.col1
  ROWS_RANGE BETWEEN 3 PRECEDING AND CURRENT ROW
 ) limit 10;](1)
 ) limit 10;](2)
 ) limit 10;](3)
 FROM db1.t1
 FROM t1
 WINDOW w1 AS (
 last join db2.t2 order by db2.t2.col1
…

com._4paradigm.hybridse.sdk.SqlEngineTest ‑ sqlLastJoinWithMultipleDB[,  SELECT sum(db1.t1.col1) over w1 as sum_t1_col1, db2.t2.str1 as t2_str1
 FROM db1.t1
 last join db2.t2 order by db2.t2.col1
 on db1.t1.col1 = db2.t2.col1 and db1.t1.col2 = db2.t2.col0
 WINDOW w1 AS (
  PARTITION BY db1.t1.col2 ORDER BY db1.t1.col1
  ROWS_RANGE BETWEEN 3 PRECEDING AND CURRENT ROW
 ) limit 10;](2)
com._4paradigm.hybridse.sdk.SqlEngineTest ‑ sqlLastJoinWithMultipleDB[db1,  SELECT sum(t1.col1) over w1 as sum_t1_col1, db2.t2.str1 as t2_str1
 FROM t1
 last join db2.t2 order by db2.t2.col1
 on t1.col1 = db2.t2.col1 and t1.col2 = db2.t2.col0
 WINDOW w1 AS (
  PARTITION BY t1.col2 ORDER BY t1.col1
  ROWS_RANGE BETWEEN 3 PRECEDING AND CURRENT ROW
 ) limit 10;](1)
com._4paradigm.hybridse.sdk.SqlEngineTest ‑ sqlLastJoinWithMultipleDB[null,  SELECT sum(db1.t1.col1) over w1 as sum_t1_col1, db2.t2.str1 as t2_str1
 FROM db1.t1
 last join db2.t2 order by db2.t2.col1
 on db1.t1.col1 = db2.t2.col1 and db1.t1.col2 = db2.t2.col0
 WINDOW w1 AS (
  PARTITION BY db1.t1.col2 ORDER BY db1.t1.col1
  ROWS_RANGE BETWEEN 3 PRECEDING AND CURRENT ROW
 ) limit 10;](3)
com._4paradigm.hybridse.sdk.SqlEngineTest ‑ sqlMultipleDBErrorTest[, SELECT db2.t2.str1 as t2_str1
 FROM t1
 last join db2.t2 order by db2.t2.col1
 on t1.col1 = db2.t2.col1 and t1.col2 = db2.t2.col0;
, SQL parse error: Fail to transform data provider op: table t1 not exists in database []](4)
com._4paradigm.hybridse.sdk.SqlEngineTest ‑ sqlMultipleDBErrorTest[db1, SELECT db1.t2.str1 as t2_str1
 FROM t1
 last join db2.t2 order by db2.t2.col1
 on t1.col1 = db2.t2.col1 and t1.col2 = db2.t2.col0;
, SQL parse error: Column Not found: db1.t2.str1](2)
com._4paradigm.hybridse.sdk.SqlEngineTest ‑ sqlMultipleDBErrorTest[db1, SELECT db2.t2.str1 as t2_str1
 FROM t1
 last join db2.t2 order by db2.t2.col1
 on t1.col1 = t2.col1 and t1.col2 = db2.t2.col0;
, SQL parse error: Column Not found: .t2.col1](3)
com._4paradigm.hybridse.sdk.SqlEngineTest ‑ sqlMultipleDBErrorTest[db1, SELECT t2.str1 as t2_str1
 FROM t1
 last join db2.t2 order by db2.t2.col1
 on t1.col1 = db2.t2.col1 and t1.col2 = db2.t2.col0;
, SQL parse error: Column Not found: .t2.str1](1)
com._4paradigm.hybridse.sdk.SqlEngineTest ‑ sqlMultipleDBErrorTest[null, SELECT db2.t2.str1 as t2_str1
 FROM t1
 last join db2.t2 order by db2.t2.col1
 on t1.col1 = db2.t2.col1 and t1.col2 = db2.t2.col0;
, SQL parse error: Fail to transform data provider op: table t1 not exists in database []](5)
com._4paradigm.hybridse.sdk.SqlEngineTest ‑ sqlWindowLastJoin[ SELECT sum(t1.col1) over w1 as sum_t1_col1, t2.str1 as t2_str1
 FROM t1
 last join t2 order by t2.col1
 on t1.col1 = t2.col1 and t1.col2 = t2.col0
 WINDOW w1 AS (
  PARTITION BY t1.col2 ORDER BY t1.col1
  ROWS_RANGE BETWEEN 3 PRECEDING AND CURRENT ROW
 ) limit 10;](1)
com._4paradigm.openmldb.jdbc.SQLRouterSmokeTest ‑ testInsertMeta[com._4paradigm.openmldb.sdk.impl.SqlClusterExecutor@5274830e](2)
…