Is SonarQube getting updated netty libraries (> 4.1.66) with the next release?

Hey there.

SonarQube bundles a version of Elasticsearch (v7.17.8) which bundles this version of Netty.

SonarQube is not vulnerable to either CVE-2021-37136 or CVE-2021-37137, as Elasticsearch itself doesn’t use the functionality that these vulnerabilities relate to (the Bzip2Decoder or SnappyFrameDecoder).

There are no plans to upgrade the version of Elasticsearch to a new major version until SonarQube v10.x.