Skip to content

[fix][sec][branch-4.x] Upgrade vertx to 4.5.32 - #26437

Merged
Technoboy- merged 1 commit into
apache:branch-4.2from
lhotari:lh-fix-vertx-4.5.32-branch-4.2
Aug 31, 2026
Merged

[fix][sec][branch-4.x] Upgrade vertx to 4.5.32#26437
Technoboy- merged 1 commit into
apache:branch-4.2from
lhotari:lh-fix-vertx-4.5.32-branch-4.2

Conversation

@lhotari

@lhotari lhotari commented Aug 31, 2026

Copy link
Copy Markdown
Member

Motivation

Vert.x 4.5.28 is currently used in branch-4.2. Versions 4.5.29 - 4.5.32 contain security and robustness fixes, both directly in Vert.x and in its transitive dependencies. Upgrading keeps the shipped Vert.x (used by the BookKeeper HTTP server and jetcd) free of known vulnerable versions.

Notable changes picked up by this upgrade:

Release notes:

Modifications

  • Bump vertx.version from 4.5.28 to 4.5.32 in the root pom.xml
  • Update the Vert.x jar names in distribution/server/src/assemble/LICENSE.bin.txt

This is a patch-level upgrade within the Vert.x 4.5.x line, so no source changes are required.

Verifying this change

  • Make sure that the change passes the CI checks.

This change is a trivial rework / code cleanup without any test coverage.

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

  • Dependencies (add or upgrade a dependency)
  • The public API
  • The schema
  • The default values of configurations
  • The threading model
  • The binary protocol
  • The REST endpoints
  • The admin CLI options
  • The metrics
  • Anything that affects deployment

Documentation

  • doc
  • doc-required
  • doc-not-needed
  • doc-complete

Upgrades Vert.x from 4.5.28 to 4.5.32 to pick up the security and
robustness fixes released in 4.5.29 - 4.5.32:

- 4.5.29: vertx-web response not ended on edge error cases; transitive
  Netty 4.1.136.Final and Jackson 2.21.5 bumps
- 4.5.30: the default HTTP client redirect handler now strips sensitive
  headers on cross-origin redirects by default, plus WebClient HTTP
  state management improvements
- 4.5.31: JDK PQC availability detection
- 4.5.32: transitive Netty 4.1.137 bump; vertx-json-schema recursive
  $ref fix

Release notes:
https://github.com/vert-x3/wiki/wiki/4.5.29-Release-Notes
https://github.com/vert-x3/wiki/wiki/4.5.30-Release-Notes
https://github.com/vert-x3/wiki/wiki/4.5.31-Release-Notes
https://github.com/vert-x3/wiki/wiki/4.5.32-Release-Notes
@Technoboy-
Technoboy- merged commit 40fe29e into apache:branch-4.2 Aug 31, 2026
52 of 53 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants