grpc-netty-shaded netty cve

[ZachChuba]

Grpc netty shaded is getting flagged for CVE-2025-58057. Exploitability of this in grpc itself is dubious, but it's good hygiene to upgrade to netty > 4.124.Final. PR created: #12384

[ejona86]

When using grpc-netty you are free to upgrade the Netty version yourself. gRPC does not use the vulnerable classes, so grpc-netty-shaded is not vulnerable.

We are in the process of upgrading already, but there's some bumps we're dealing with. We're not aware of any incompatibilities, though, so it isn't reason to hesitate to upgrade your application.

This isn't going to be part of 1.76.0 (this week) and it doesn't seem appropriate to backport, so you'd still want to probably upgrade in your own application even if we upgrade soon on the master branch.