force latest netty

Signed-off-by: Adrian Cole <adrian.cole@elastic.co>

Author: codefromthecrypt

benchmarks/pom.xml

@@ -27,6 +27,19 @@
     <maven.compiler.release>17</maven.compiler.release>
   </properties>
 
+  <!-- Avoid CVEs in armeria deps -->
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-bom</artifactId>
+        <version>${netty.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
     <dependency>
       <groupId>${project.groupId}</groupId>

module/pom.xml

@@ -25,6 +25,19 @@
     <maven.compiler.release>17</maven.compiler.release>
   </properties>
 
+  <!-- Avoid CVEs in armeria deps -->
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-bom</artifactId>
+        <version>${netty.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
     <dependency>
       <groupId>${project.groupId}</groupId>

pom.xml

@@ -64,13 +64,15 @@
     <!-- groupId overrides allow testing feature branches with jitpack -->
     <!-- matching armeria/grpc/zipkin -->
     <zipkin.groupId>io.zipkin.zipkin2</zipkin.groupId>
-    <!-- when updating, update docker/Dockerfile and storage/src/test/java/zipkin2/storage/kafka/IT* -->
+    <!-- when updating, update docker/Dockerfile -->
     <zipkin.version>3.5.0</zipkin.version>
     <zipkin-reporter.version>3.5.0</zipkin-reporter.version>
     <spring-boot.version>3.4.2</spring-boot.version>
     <!-- armeria.groupId allows you to test feature branches with jitpack -->
     <armeria.groupId>com.linecorp.armeria</armeria.groupId>
     <armeria.version>1.31.3</armeria.version>
+    <!-- Use same version as Zipkin to remain compatible with armeria to avoid CVEs -->
+    <netty.version>4.1.118.Final</netty.version>
     <log4j.version>2.24.3</log4j.version>
 
     <!-- This allows you to test feature branches with jitpack -->

storage-stackdriver/pom.xml

@@ -25,6 +25,19 @@
     <maven.compiler.release>17</maven.compiler.release>
   </properties>
 
+  <!-- Avoid CVEs in armeria deps -->
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-bom</artifactId>
+        <version>${netty.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
     <dependency>
       <groupId>${project.groupId}</groupId>