Update netty-codec-http version

[chiranSachintha]

Purpose

Describe the problems, issues, or needs driving this feature/fix and include links to related issues.

Fixes #

Approach

Describe how you are implementing the solutions along with the design details.

Samples

Provide high-level details about the samples related to this feature.

Remarks

List any other known issues, related PRs, TODO items, or any other notes related to the PR.

Check List

• Read the Contributing Guide
• Updated Change Log
• Checked Tooling Support (#)
• Added necessary tests
  • Unit Tests
  • Spec Conformance Tests
  • Integration Tests
  • Ballerina By Example Tests
• Increased Test Coverage
• Added necessary documentation
  • API documentation
  • Module documentation in Module.md files
  • Ballerina By Examples

[nipunayf]

Can we bump this to .109 [1] instead? It appears that there is a small vulnerability with .108 [2]?

[1] https://mvnrepository.com/artifact/io.netty/netty-codec-http/4.1.109.Final
[2] https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-6483812

[chiranSachintha]

Can we bump this to .109 [1] instead? It appears that there is a small vulnerability with .108 [2]?

[1] https://mvnrepository.com/artifact/io.netty/netty-codec-http/4.1.109.Final [2] https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-6483812

If there are any high severity vulnerability, I will update to the latest version. If not, I will stick with version .108.

[TharmiganK]

I think you have to update the wso2 transport also to the latest version here:

ballerina-lang/gradle/javaLibsProject.gradle

Line 42 in f29b411

dist 'org.wso2.transport.http:org.wso2.transport.http.netty:6.3.48'

Wso2 transport also has netty dependency

Also it is safer to update all the netty packages to 4.1.108.Final rather than updating the vulnerable ones. The compatible tcnative version is 2.0.65.Final