From af2be7c0748b6fe23fc7033ae16483c5bddc53f9 Mon Sep 17 00:00:00 2001
From: Miguel Serrano <mserranom@users.noreply.github.com>
Date: Wed, 14 Jan 2026 14:27:46 +0100
Subject: [PATCH] [git-bridge] Update envsubst and dependencies (#30747)

Updates patch versions of stable dependencies, and rebuilds
envsubst

GitOrigin-RevId: f55bc2d5c00aef110cf6a8ba89e8529211d560cb
---
 services/git-bridge/Dockerfile |  2 +-
 services/git-bridge/pom.xml    | 23 +++++++++++++++++------
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/services/git-bridge/Dockerfile b/services/git-bridge/Dockerfile
index 4cd94ac4ab..eb1c782b78 100644
--- a/services/git-bridge/Dockerfile
+++ b/services/git-bridge/Dockerfile
@@ -1,6 +1,6 @@
 # Build the a8m/envsubst binary, as it supports default values,
 # which the gnu envsubst (from gettext-base) does not.
-FROM golang:1.25.3-alpine AS envsubst_builder
+FROM golang:1.25.5-alpine AS envsubst_builder
 
 WORKDIR /build
 
diff --git a/services/git-bridge/pom.xml b/services/git-bridge/pom.xml
index 7c9cdaa0e2..279da85e5d 100644
--- a/services/git-bridge/pom.xml
+++ b/services/git-bridge/pom.xml
@@ -19,25 +19,36 @@
         <jetty.version>12.1.5</jetty.version>
         <jakarta.servlet.version>6.1.0</jakarta.servlet.version>
         <gson.version>2.13.2</gson.version>
-        <async.http.client.version>3.0.3</async.http.client.version>
+        <async.http.client.version>3.0.6</async.http.client.version>
         <jgit.version>7.5.0.202512021534-r</jgit.version>
         <sqlite.jdbc.version>3.41.2.2</sqlite.jdbc.version>
         <joda.time.version>2.9.9</joda.time.version>
         <google.oauth.client.version>1.39.0</google.oauth.client.version>
         <google.http.client.version>1.23.0</google.http.client.version>
-        <commons.lang3.version>3.19.0</commons.lang3.version>
-        <logback.classic.version>1.5.20</logback.classic.version>
+        <commons.lang3.version>3.20.0</commons.lang3.version>
+        <logback.classic.version>1.5.24</logback.classic.version>
         <mockserver.version>5.15.0</mockserver.version>
         <mockito.version>5.20.0</mockito.version>
-        <aws.java.sdk.version>2.36.2</aws.java.sdk.version>
+        <aws.java.sdk.version>2.41.7</aws.java.sdk.version>
         <jakarta.xml.bind.api.version>${jaxb.runtime.version}</jakarta.xml.bind.api.version>
         <jaxb.runtime.version>2.3.2</jaxb.runtime.version>
         <httpclient.version>4.5.14</httpclient.version>
-        <commons.io.version>2.20.0</commons.io.version>
+        <commons.io.version>2.21.0</commons.io.version>
         <commons.compress.version>1.28.0</commons.compress.version>
         <simpleclient.version>0.10.0</simpleclient.version>
-        <bouncycastle.crypto.version>1.82</bouncycastle.crypto.version>
+        <bouncycastle.crypto.version>1.83</bouncycastle.crypto.version>
+        <netty.version>4.1.130.Final</netty.version>
     </properties>
+    <dependencyManagement>
+        <dependencies>
+            <!-- Override vulnerable netty version from mockserver-netty -->
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-codec-http2</artifactId>
+                <version>${netty.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
     <build>
         <plugins>
             <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-compiler-plugin -->