ZOOKEEPER-4897 Upgrade Netty to 4.1.119.Final for fix CVE-2025-24970 for master branch

[helloworld28]

No description provided.

[tisonkun]

Thank you!

[kezhuw]

There is a patch netty/netty@dc6b051 to jdk path(a.k.a. no crash though) and it is landed in 4.1.119.Final.

I think we can bump to 4.1.119.Final to minimize the affect of the "crafted packet".

[eolivelli]

Can you please update (just rename) the License files?

[tisonkun]

@eolivelli where is the file? I may forget it and I can't find it now.

[cnauroth]

@tisonkun , the license files are here:

https://github.com/apache/zookeeper/tree/master/zookeeper-server/src/main/resources/lib

We can git mv all of the Netty 4.1.115.Final files to 4.1.118.Final without changing file contents.

[tisonkun]

Thanks for pointing this out @cnauroth!

I've pushed a new commit to fix it, as well as adopting @kezhuw's suggestion to use 4.1.119.Final.

[cnauroth]

+1. Thanks to all who participated: @helloworld28 , @tisonkun , @eolivelli , @kezhuw

[tisonkun]

Thanks for your review @cnauroth! You may take a look at the backport PR #2226 also.

Thank @helloworld28 for your contribution!

[cnauroth]

@helloworld28 , do you have an ASF JIRA ID? Can you please let me know it, so I can assign ZOOKEEPER-4897 and close it? If you don't have an ID, you can request one here:

https://selfserve.apache.org/jira-account.html

Please mention that you fixed ZOOKEEPER-4897 in the request.

Thank you.

[helloworld28]

@helloworld28 , do you have an ASF JIRA ID? Can you please let me know it, so I can assign ZOOKEEPER-4897 and close it? If you don't have an ID, you can request one here:

https://selfserve.apache.org/jira-account.html

Please mention that you fixed ZOOKEEPER-4897 in the request.

Thank you.

thanks for merging this PR, I already have a ASF account, the JIRA is created by me, you can assign it to me

[helloworld28]

@helloworld28 , do you have an ASF JIRA ID? Can you please let me know it, so I can assign ZOOKEEPER-4897 and close it? If you don't have an ID, you can request one here:

https://selfserve.apache.org/jira-account.html

Please mention that you fixed ZOOKEEPER-4897 in the request.

Thank you.

@helloworld28 , do you have an ASF JIRA ID? Can you please let me know it, so I can assign ZOOKEEPER-4897 and close it? If you don't have an ID, you can request one here:
https://selfserve.apache.org/jira-account.html
Please mention that you fixed ZOOKEEPER-4897 in the request.
Thank you.

thanks for merging this PR, I already have a ASF account, the JIRA is created by me, you can assign it to me

@cnauroth could you help assign the the task to me(jimqin)? let me close it

[cnauroth]

@helloworld28 , I assigned the JIRA issue and closed it. Thank you again!