[fix][sec] Upgrade Netty to 4.1.133.Final to address CVEs

[lhotari]

Motivation

This PR upgrades Netty to 4.1.133.Final (released 2026-05-04) and netty-tcnative to 2.0.77.Final to pick up multiple security fixes and bug fixes.

Security fixes addressed by Netty 4.1.133.Final

Per the Netty 4.1.133.Final release notes, this release addresses the following CVEs:

• CVE-2026-42586 (netty-codec-redis)
• CVE-2026-42578 (netty-handler-proxy)
• CVE-2026-42587 (netty-codec-http, netty-codec-http2)
• CVE-2026-41417 (netty-codec-http)
• CVE-2026-42581 (netty-codec-http)
• CVE-2026-42580 (netty-codec-http)
• CVE-2026-42585 (netty-codec-http)
• CVE-2026-42579 (netty-codec-dns)
• CVE-2026-42582 (netty-codec-http3)
• CVE-2026-42583 (netty-codec, netty-codec-compression)
• CVE-2026-42584 (netty-codec-http)
• additional CVE in netty-codec-mqtt

Notable bug fixes also included in 4.1.133.Final

• Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat
• Kqueue sendfile fix preventing data duplication
• PemReader memory leak prevention during OutOfDirectMemoryError
• Native DNS resolver safeguards against malloc failures
• MQTT properties isEmpty now considers user properties and subscription IDs
• HTTP chunk parsing with multiple extensions corrected
• Epoll error handling standardized to return negative values
• HTTP/2 stream error handling for maxContentLength violations
• HTTP/2 preface transmission ensured as initial message (client and server)
• NPE prevention in JdkSslServerContext and JdkSslClientContext
• netty-tcnative upgraded to 2.0.77.Final

netty-tcnative 2.0.75.Final → 2.0.77.Final

Full changelog. Highlights:

• OpenSSL upgraded from 3.1.6 to 3.6.1 for the static/dynamic OpenSSL builds
• Memory safety / native robustness fixes:
  • Fix Use-After-Free / dangling pointer when using session tickets with OpenSSL 3.x (#964)
  • Fix memory leak in setSessionTicketKeys0 when GetByteArrayElements fails (#957)
  • Don't leak CRYPTO_BUFFER when GetByteArrayElements returns NULL during decompression (#959)
  • Guard against malloc failures when configuring ALPN and NPN (#958)
  • setCurves(...) checks for GetIntArrayElements returning NULL (#960)
  • Guard against GetStringUTFChars(...) returning NULL (#973)
  • Free buffer correctly if push fails (#966)
  • Always clear global reference to the verifier (#967)
  • Correctly track array length / cert count when using async verifier (#970)
  • Delete local references inside loops to avoid local-ref overflow (#972)
  • Clear pending exception in keylog_cb (#971)
  • SSL_CTX_set_info_callback called only once per context (#963)
  • Fix UB caused by uninitialized proto_len before reading (#961)
  • Fix wrong format specifier causing UB (#955)
  • Correctly respect return value of apr_thread_rwlock_create (#965)
• Behavior / API:
  • Add SSL.getVersionInt to avoid string allocation on initial SSL handshake (#954)
  • Fall back to the correct protocol (#969)
  • More descriptive exception when SSLContext.make(...) fails (#976)
• Build / packaging:
  • Build against OpenSSL 3.6 for dynamic linking (#952)
  • Correctly build boringssl-static for linux aarch64 (#975)
  • Ensure locks are usable when cross-compiling (#977)
  • Fix creation of docker image for cross compilation (#956)
  • Fix missing semicolon causing compile errors on old OpenSSL versions (#962)

Modifications

• Bump netty from 4.1.132.Final to 4.1.133.Final in gradle/libs.versions.toml
• Bump netty-tcnative from 2.0.75.Final to 2.0.77.Final in gradle/libs.versions.toml
• Update distribution/server/src/assemble/LICENSE.bin.txt and distribution/shell/src/assemble/LICENSE.bin.txt to reflect new Netty/tcnative versions

Verifying this change

• Make sure that the change passes the CI checks.

This change is a trivial rework / code cleanup without any test coverage. It is a pure dependency version bump; existing tests exercise the affected Netty code paths.

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

Upgrades the netty (4.1.132.Final -> 4.1.133.Final) and netty-tcnative (2.0.75.Final -> 2.0.77.Final) dependencies. The tcnative bump also pulls in OpenSSL 3.1.6 -> 3.6.1 for the bundled OpenSSL builds.