From 5fe17a77707606f1622c5d368f93b84431346654 Mon Sep 17 00:00:00 2001
From: Jim Thario <33331284+JimTharioAmazon@users.noreply.github.com>
Date: Wed, 26 Mar 2025 14:37:00 -0700
Subject: [PATCH 1/4] Update pom.xml

Pin netty-handler used by vertx.
---
 extra/pom.xml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/extra/pom.xml b/extra/pom.xml
index ff6f5a429e5..c5f253aedae 100644
--- a/extra/pom.xml
+++ b/extra/pom.xml
@@ -4,14 +4,14 @@
 
     <groupId>org.prebid</groupId>
     <artifactId>prebid-server-aggregator</artifactId>
-    <version>3.23.0-SNAPSHOT</version>
+    <version>3.22.0</version>
     <packaging>pom</packaging>
 
     <scm>
         <url>https://github.com/prebid/prebid-server-java</url>
         <connection>scm:git:git@github.com:prebid/prebid-server-java.git</connection>
         <developerConnection>scm:git:git@github.com:prebid/prebid-server-java.git</developerConnection>
-        <tag>HEAD</tag>
+        <tag>3.22.0</tag>
     </scm>
 
     <properties>
@@ -74,6 +74,11 @@
 
     <dependencyManagement>
         <dependencies>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-handler</artifactId>
+                <version>4.1.118.Final</version>
+            </dependency>
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>

From 0c99b68bb4fe51c8cdf38d278f0ad926683cd24b Mon Sep 17 00:00:00 2001
From: Jim Thario <33331284+JimTharioAmazon@users.noreply.github.com>
Date: Thu, 27 Mar 2025 08:53:03 -0700
Subject: [PATCH 2/4] Update pom.xml

Fix versions.
---
 extra/pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/extra/pom.xml b/extra/pom.xml
index c5f253aedae..764dec116e8 100644
--- a/extra/pom.xml
+++ b/extra/pom.xml
@@ -4,14 +4,14 @@
 
     <groupId>org.prebid</groupId>
     <artifactId>prebid-server-aggregator</artifactId>
-    <version>3.22.0</version>
+    <version>3.23.0-SNAPSHOT</version>
     <packaging>pom</packaging>
 
     <scm>
         <url>https://github.com/prebid/prebid-server-java</url>
         <connection>scm:git:git@github.com:prebid/prebid-server-java.git</connection>
         <developerConnection>scm:git:git@github.com:prebid/prebid-server-java.git</developerConnection>
-        <tag>3.22.0</tag>
+        <tag>HEAD</tag>
     </scm>
 
     <properties>

From 391935a2d5ddea4a3e6fb8ac7ec4f8048ea6f3db Mon Sep 17 00:00:00 2001
From: Jim Thario <33331284+JimTharioAmazon@users.noreply.github.com>
Date: Mon, 31 Mar 2025 10:43:58 -0700
Subject: [PATCH 3/4] Update pom.xml

Externalize netty-handler version.
---
 extra/pom.xml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/extra/pom.xml b/extra/pom.xml
index 764dec116e8..8eb7591152f 100644
--- a/extra/pom.xml
+++ b/extra/pom.xml
@@ -53,6 +53,7 @@
         <protoc.version>${protobuf.version}</protoc.version>
         <json-logic.version>1.0.7</json-logic.version>
         <aws.awssdk.version>2.26.24</aws.awssdk.version>
+        <netty-handler.version>4.1.118.Final</netty-handler.version>
 
         <!-- Project test dependency versions -->
         <wiremock.version>3.9.1</wiremock.version>
@@ -77,7 +78,7 @@
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-handler</artifactId>
-                <version>4.1.118.Final</version>
+                <version>${netty-handler.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.springframework.boot</groupId>

From 8e5f698961b650b2bdd64bc44ce34d5fa60a10e3 Mon Sep 17 00:00:00 2001
From: Jim Thario <33331284+JimTharioAmazon@users.noreply.github.com>
Date: Tue, 1 Apr 2025 08:51:12 -0700
Subject: [PATCH 4/4] Update pom.xml

Add comment for netty-handler dependency.
---
 extra/pom.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/extra/pom.xml b/extra/pom.xml
index 8eb7591152f..fa586a49327 100644
--- a/extra/pom.xml
+++ b/extra/pom.xml
@@ -75,6 +75,7 @@
 
     <dependencyManagement>
         <dependencies>
+            <!-- set netty-handler version for CVE-2025-24970-->
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-handler</artifactId>