Netty introduces several CVE dependency advisories to the azure-key-vault module. An azure client using the JDK HttpClient is currently being worked on (current ETA June 2022) and for our simple usage will be more than enough. Switch to using this client when available.
Documentation already available:
https://docs.microsoft.com/en-us/azure/developer/java/sdk/http-client-pipeline
Tracking issue:
Azure/azure-sdk-for-java#27065
Version as of 6 June: 1.0.0-beta.1
https://github.com/Azure/azure-sdk-for-java/tree/main/sdk/core/azure-core-http-jdk-httpclient