[3.20] Bump to Vert.x 4.5.21 and Netty 4.1.127.Final

[jponge]

This fixes Netty CVEs: CVE-2025-58057 and CVE-2025-58056

[quarkus-bot]

/cc @aloubyansky (3.20), @gastaldi (3.20), @gsmet (3.20), @jmartisk (3.20), @rsvoboda (3.20)

[gsmet]

Let's make sure we have everything sorted out in #49867 first before merging this.

[jponge]

I messed up with my branch

[jponge]

@jmartisk this should be good, but you might want to squash the commits when it's good to merge

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 046b26e.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[marcelstoer]

@jponge thanks for the updates, much appreciated! Would anyone care to explain how such fixes will find their way into RHBQ 3.20 releases? I previously tried through https://issues.redhat.com/projects/QUARKUS (using the corporate account) but got nowhere.

[jmartisk]

@jponge thanks for the updates, much appreciated! Would anyone care to explain how such fixes will find their way into RHBQ 3.20 releases? I previously tried through https://issues.redhat.com/projects/QUARKUS (using the corporate account) but got nowhere.

This PR will first get merged into the 3.20.3 community release, which will then be the base for the corresponding RHBQ release.

[marcelstoer]

This landing in 3.20.3 is important information, thanks. Should it be assigned to the 3.20.3 milestone? Or does this happen only once it's merged?

the base for the corresponding RHBQ release

Given the above, this for us means that there's no need waiting for a new RHBQ release that includes the Vert.x and Netty vulnerability fixes. RHBQ 3.20.3.GA is due only in a month. We'll now manage those dependencies manually.

[jmartisk]

Should it be assigned to the 3.20.3 milestone? Or does this happen only once it's merged?

Yes, that is exactly how we do it :)