Release day!

by normanmaurer
on 30-Apr-2014

I'm happy to announce the release of Netty 4.0.19.Final, 3.9.1.Final, 3.8.2.Final, 3.7.1.Final and 3.6.9.Final. Beside providing you with various new features and bugfixes all of these releases have one in common; they fix a resource usage problem in the WebSocket08FrameDecoder.

Before we aggregated the full text in the WebSocket08FrameDecoder just to fill in the ContinuationWebSocketFrame.aggregatedText(). The problem was that there was no upper-limit and so it would be possible to see an OOME if the remote peer sends a TextWebSocketFrame + a never ending stream of ContinuationWebSocketFrames. The aggregation of WebSocketFrames can be done with the WebSocketFrameAggregator, which allows to set an upper limit. Because there was no other "sane" way to fix the problem we decided to also remove the ContinuationWebSocketFrame.aggregatedText() method, even in a bugfix release because just changing its behaviour would even be more confusing. We never saw a usage of this method in the wild so far, so we hope this will not affect many users.

So if you using the stock WebSockets codec provided by Netty you should update ASAP! Special thanks to James Roper (Typesafe) for finding the flaw and notify us in a timely manner.

For more details on the fixes for these various releases please see the following sections.