Play Framework

fix(security): bump netty 4.2.12 → 4.2.13 for 13 CVE-2026 advisories (PF-117, release 1.13.25)

Netty 4.2.13.Final addresses 13 CVE-2026-* advisories affecting
netty-codec-http (request smuggling CVE-2026-42581 + others),
netty-codec-http2, netty-codec-http3, netty-codec-compression,
netty-codec-redis, netty-codec-mqtt, netty-codec-dns, netty-handler-proxy,
and netty-transport-native-epoll. Bump moves all 17 framework-shipped
netty artifacts (codec, transport, handler, native-quic per-platform
classifiers) in lockstep — they share an internal API contract and
cannot be mixed across versions.

The CVE-2026-42581 fix tightens HTTP/1.1 decoding (HttpObjectDecoder
now rejects requests carrying both Transfer-Encoding and Content-Length
per RFC 9112). Audited Play's request path: StreamChunkAggregator
mutates a post-decode FullHttpRequest (not wire bytes), so the gate
does not re-trigger inside the pipeline. No fork-side code change
needed. Operational watchpoint: misbehaving external clients emitting
both headers will start receiving 400 Bad Request after deploy.

Verified: ant test (unittest + integration, including HTTP/1.1, h2
ALPN, h3 QUIC, SSE, WSAsync) is green on the new jars.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>