netty/netty
Netty project - an event-driven asynchronous network application framework
How netty is put together
Netty is an asynchronous event-driven network application framework for building high-performance protocol servers and clients, written primarily in Java with a Java 8 baseline and a large multi-module Maven build (version 4.2.18.Final-SNAPSHOT). The codebase is organized into layered modules: core utilities (netty-common), zero-copy byte buffers (netty-buffer), the transport/event-loop abstraction (netty-transport), protocol codecs (HTTP/1, HTTP/2, HTTP/3, DNS, MQTT, Redis, SOCKS, etc.), TLS/proxy handlers (netty-handler, handler-proxy, handler-ssl-ocsp), and resolvers (netty-resolver, resolver-dns). Performance-critical I/O is delegated to native transports implemented in C with JNI bindings for epoll, kqueue, io_uring, macOS DNS resolution, and QUIC (via BoringSSL/quiche). Data flows through an event-driven pipeline of ChannelHandlers operating on ByteBufs, orchestrated by EventLoopGroups; a netty-all uber-jar and a BOM aggregate the modules for consumers.
Languages
Frameworks
Infrastructure
Major components
netty-common
Core utilities shared by all modules (module-info.yml present at common/src/main/java/module-info.yml).
netty-buffer
Zero-copy, reference-counted byte buffer abstraction built on top of netty-common.
netty-transport (+ native transports)
Channel/EventLoop abstraction plus JNI-backed epoll, kqueue, and io_uring transports implemented in C under transport-native-*.
codec-base and protocol codecs
Base codec framework plus encoders/decoders for HTTP, HTTP/2, HTTP/3, DNS, compression, HAProxy, Memcache, MQTT, Protobuf, Redis, SMTP, SOCKS, STOMP, XML, Marshalling.
handler / handler-proxy / handler-ssl-ocsp
TLS/SSL handling, proxy protocol support, and OCSP stapling handlers.
resolver / resolver-dns / resolver-dns-native-macos
Hostname resolution including an asynchronous DNS resolver and a native macOS resolver backed by C code.
codec-native-quic / codec-classes-quic
QUIC codec with native bindings to quiche/BoringSSL in C (codec-native-quic/src/main/c/netty_quic_quiche.c, netty_quic_boringssl.c).
all / bom
Aggregation artifacts: netty-all uber-jar merging platform-specific native dependencies and netty-bom Bill of Materials for version alignment.
A quieter week focused on small correctness fixes in DNS, QPACK, and connection pooling, plus better logging for a flaky test.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter week focused on small correctness fixes in DNS, QPACK, and connection pooling, plus better logging for a flaky test.
Week of 2026-08-17
A light week of housekeeping: security-report tooling, dependency/build updates, and removal of an obsolete warning.
Week of 2026-08-10
A busy 16-commit week dominated by memory-leak fixes across HTTP, HTTP/2, and QUIC, plus several protocol correctness fixes.
Week of 2026-08-03
The 4.2.17.Final release shipped amid broad fixes including WebSocket handshake handling, OpenSSL improvements, and style enforcement via EditorConfig.
Week of 2026-07-27
A major push added native-style decompressors for seven compression formats while also fixing several memory leaks and a low-core container OOM issue.
Over the past month, Netty development focused heavily on hardening and cleanup: a wave of resource-leak fixes across HTTP, HTTP/2, QUIC, and compression code, alongside new compression decompressor implementations. A stable release (4.2.17.Final) shipped in early August, followed by continued bug fixes, test reliability improvements, and build tooling updates.
Week by week
2026-08-24A quieter week focused on small correctness fixes in DNS, QPACK, and connection pooling, plus better logging for a flaky test.latest5 changes
Fix
Unhealthy channels closed on release
When returning connections to the pool, actively broken ones are now shut down instead of being reused.
Fix
DNS query flag encoding fixed
Corrected how the message-type bits are read and written in DNS queries so queries are formed properly.
Fix
QPACK header encoding fix
Fixed an edge case in HTTP/3 header compression where certain large numbers were encoded incorrectly.
Chore
More logging for flaky write test
Added extra diagnostic output to help track down why one buffer-writing test intermittently fails.
Chore
Docker image tooling update
The build process for Amazon's crypto library image now installs an extra binary-editing utility it needs.
2026-08-17A light week of housekeeping: security-report tooling, dependency/build updates, and removal of an obsolete warning.3 changes
Chore
Script to fetch vulnerability reports
Added a helper script that downloads published GitHub security advisories, likely to inform security work.
Refactor
Build plugin updated
Upgraded a Maven packaging plugin and changed its configuration mode to keep builds consistent.
Docs
Removed outdated JDK warning
Deleted an old caution about JDK upgrades from the file-transfer (FileRegion) documentation/code.
2026-08-10A busy 16-commit week dominated by memory-leak fixes across HTTP, HTTP/2, and QUIC, plus several protocol correctness fixes.6 changes
Fix
HTTP/2 flush deadlock prevention
Queued messages that got stuck when network buffers filled during a flush are now drained instead of stranded.
Fix
HTTP encoder failures no longer leak resources
Two related fixes ensure encoders release their internal state and buffers when writing headers fails mid-way.
Fix
Connection pool cancellation fixed
Cancelling a request to borrow a pooled channel now correctly returns that channel to the pool.
Fix
QUIC token handling decoupled
Separating token validation from address derivation makes QUIC's retry-token logic more robust.
Fix
Bzip2 overflow detection corrected
Fixed a decompression check so corrupted bzip2 data is caught instead of slipping through.
Chore
QUIC packaging fix
Corrected the Maven packaging metadata so the native QUIC library publishes with the right format.
2026-08-03The 4.2.17.Final release shipped amid broad fixes including WebSocket handshake handling, OpenSSL improvements, and style enforcement via EditorConfig.6 changes
Feature
Release 4.2.17.Final cut
A new stable version was tagged and prepared as part of the regular release cycle.
Fix
WebSocket handshake response routing fixed
Handshake replies are no longer written to a catch-all pipeline slot, avoiding misdirected responses.
Fix
HTTP interim response handling fixed
The server codec no longer consumes queued method information when responding with provisional 1xx status codes.
Fix
Zlib tail-loss bug fixed
Decompression no longer silently drops the end of highly compressible streams.
Feature
OpenSSL session exposes negotiated group
Applications can now query which key-exchange group a TLS session actually used.
Chore
Coding style enforced project-wide
An EditorConfig file was added so all editors apply consistent formatting automatically.
2026-07-27A major push added native-style decompressors for seven compression formats while also fixing several memory leaks and a low-core container OOM issue.6 changes
Feature
New decompressors for many formats
Added implementations for LZ4, Brotli, LZF, Zstd, zlib, Snappy frames, and Bzip2 decompression, expanding built-in compression support.
Fix
Low-core container OOM fixed
Resolved out-of-memory crashes on machines with few CPU cores by adjusting memory sizing assumptions.
Fix
Memory pool eviction bug fixed
Stopped the buddy allocator cache from evicting chunks that still had live buffers using them.
Fix
Header-encoding leak fixed
Buffers are now released when an unexpected error occurs while encoding headers in HTTP or HTTP/2 writers.
Fix
IoUring receive emulation fixed
Corrected the fallback path used when the Linux io_uring networking backend lacks a multi-message receive call.
Fix
Classloader leak plugged
Prevented a shared executor's failed-future objects from pinning application classloaders in web-server deployments.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required