fix(security): align Netty runtime on 4.1.136.Final

[seonghobae]

Security objective

Move the complete Spring Boot-managed Netty 4.1 module family from 4.1.135.Final to the reviewed 4.1.136.Final security line after exact-head Strix run 30997430437 reported newly published HIGH findings against the prior line.

This is deliberately separate from privacy PR #267. It contains only the Netty runtime version contract, its regression test, and the architecture decision. It must not absorb audit-pseudonymization, administrative authorization, or unrelated workflow changes.

Changes

• Override Spring Boot's coordinated Netty family through the documented root netty.version property rather than individual mixed-module pins.
• Add a real-POM regression test requiring 4.1.136.Final.
• Add an accepted security ADR with APA 7th references, compatibility boundaries, exact-head verification, removal/upgrade criteria, and the buyer-evidence requirement.

Test-first evidence

The dependency-policy test names the fixed line and fails if the root POM omits or changes the coordinated override. The production change is limited to dependency resolution; no Clearfolio API or application logic changes.

Required buyer-evidence work

The dated CycloneDX SBOM and generated third-party attribution still describe the prior Netty line. Before this PR is ready:

1. regenerate the CycloneDX aggregate SBOM from this exact branch using the canonical Maven plugin command;
2. regenerate third-party attribution from that SBOM;
3. add a repository contract that rejects POM/SBOM/attribution drift;
4. prove every applicable Netty component, purl, BOM reference, and dependency reference is coherent on 4.1.136.Final and no current evidence contains 4.1.135.Final;
5. update CHANGELOG.md without duplicating its existing cleanup work.

Hand-editing package URLs, hashes, dependency edges, or generated evidence is prohibited.

Merge gate

Keep this PR draft until the generated evidence and changelog are complete and the exact current head has successful CI, dependency tree, Security Scan, SAST, fuzzing, Strix, CodeRabbit/OpenCode/Noema review, zero unresolved threads, and an independent approving review whose repository permission GitHub counts. Do not bypass protections, use self-mutating repair workflows, weaken tests, or count stale-head evidence.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 29705ead-d6a5-4154-babd-72db78513360

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Complete this bounded clean PR on exact current head 778b58d65885e13e5a4a91a13f2ffcca277fa269 without adding any GitHub Actions workflow, repair script, unrelated security change, or parent-PR content.

Required work:

1. Run the canonical CycloneDX aggregate generation from this exact branch and commit the resulting docs/qa/evidence/2026-07-02-krw2b-sale-readiness/sbom-cyclonedx.json through your normal branch write path.
2. Regenerate docs/legal/2026-07-03-third-party-attribution.md only through scripts/render_third_party_attribution.py.
3. Extend scripts/test_render_third_party_attribution.py with a semantic repository contract that reads the trusted netty.version property without an XML parser and verifies:
   • a non-empty resolved Netty family;
   • every Netty component version, purl, and BOM reference matches 4.1.136.Final;
   • every Netty dependency reference corresponds to a committed Netty component;
   • generated attribution is byte-for-byte equal to rendering the committed SBOM;
   • no current SBOM/attribution evidence contains 4.1.135.Final.
4. Add one concise CHANGELOG.md Security entry. Preserve the existing file structure; do not attempt unrelated duplicate-section cleanup owned by fix(security): pseudonymize policy override audit identifiers #267/fix(accessibility): make asynchronous viewer actions nested-safe #264.
5. Run python -m pytest -q scripts, mvn -B --no-transfer-progress test, and mvn -B --no-transfer-progress dependency:tree -Dincludes=io.netty. Report test counts, exact dependency version set, SBOM component/Netty counts, and file SHA-256 values.
6. Commit only POM/test/ADR, the generated SBOM and attribution, the evidence contract, and the focused changelog entry. The branch currently contains only the first three categories; do not rewrite or remove them.

Refuse an empty component set, mixed Netty line, hand-edited generated graph, or stale-head result. Keep the PR draft and report the exact new head for fresh review.

[seonghobae]

@coderabbitai review

@cwl-noema-review Independently inspect exact current head 778b58d65885e13e5a4a91a13f2ffcca277fa269 while the generated-evidence work is completed. Verify that the coordinated Spring Boot netty.version override applies to the complete Netty family, the POM contract test is safe and meaningful, the ADR accurately limits the compatibility claim, and the diff is isolated from #267/#268. Do not approve or recommend merge until generated SBOM/attribution drift is closed, exact-head CI/Security/SAST/fuzz/Strix all succeed, no required result is stale or pending, and a counted independent approval exists.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 5 minutes and 53 seconds before sending another message.

[seonghobae]

@opencode-agent Continue from exact current head b9d48719b2d94d4d47f871f5cdfa87d6ac0d0970.

The repository evidence contract is now test-first and red on the exact head. CI run 31007176663, buyer-readiness job 92309867434, executed 18 script tests and failed only at test_committed_netty_evidence_matches_the_trusted_pom: committed io.netty:netty-codec-http is 4.1.135.Final while the trusted POM requires 4.1.136.Final. Maven tests passed; exact-head Security Scan, SAST, and fuzz succeeded. This failure is expected evidence and must not be suppressed or weakened.

Generate the CycloneDX aggregate SBOM from this exact branch with the canonical Maven command, regenerate third-party attribution only through scripts/render_third_party_attribution.py, add one focused CHANGELOG.md Security entry, and run the previously requested script tests, Maven tests, and Netty dependency tree. The new contract additionally requires a nonempty component/Netty family, coherent component versions/purls/bom-refs, dependency refs backed by committed components, byte-for-byte renderer equality, and absence of 4.1.135.Final. Do not add a workflow or repair script, hand-edit generated package graph data, import #267/#268 content, or report predecessor-head results. Keep Draft and report the exact new head plus component counts, Netty version set, dependency-tree version set, and SHA-256 values.

[seonghobae]

Exact head advanced only by the focused changelog entry to 06282747e72bb8fc5b9104374a840898351d8b4e; the generated-evidence defect and test-first red contract are unchanged. @opencode-agent generate and commit the SBOM and attribution on this exact head, then run the full requested verification. Do not reuse the superseded b9d4871 head as merge evidence.

[seonghobae]

Superseded by draft #270. #269's bounded Netty property, real-POM regression, and ADR are preserved in #270, while #270 also contains the complete generated CycloneDX SBOM, deterministic attribution, full Netty component/purl/bom-ref/dependency-edge drift contract, corrected Maven property documentation, hashes, and privacy parent required for one coherent protected merge. #269's current CI failure reflects the intentionally incomplete historical SBOM and is not ignored; the valid fix and regenerated evidence are carried by #270. No #269 check or review is reused as final #270 evidence.

[seonghobae]

Closing as superseded by integrated replacement #270. #270 exact head 06452c3f39f2deb38d31d189e46de4b25512baa0 contains the coordinated Netty 4.1.136.Final POM pin, a non-empty generated CycloneDX 1.6 SBOM with 61 components and 17 coherent Netty components, byte-for-byte generated attribution, dependency-ref/component-ref validation, retired-version rejection, evidence hashes, and the clean privacy parent. Exact-head CI, Security Scan, SAST Semgrep, and fuzz are successful. This standalone PR's red evidence and predecessor checks are retained only as test-first provenance; they are not merge evidence for #270. #270 still requires exact-head automated review, zero unresolved threads, qualifying independent approval, and every branch-protection gate.