title: What is the right way to upgrade netty and its components for security reason?
body: <p>Our spring boot (cloud) application uses rx-netty, whose version is <code>0.4.20</code>. And it sets netty and its components to version <code>4.1.5.Final</code>.</p>
  <p>Currently our security auditing system found that the current netty-codec version (<code>4.1.52.Final</code>) is vulnerable and suggested us to upgrade to version <code>4.1.68+</code>.</p>
  <p>I tried to lock <code>netty-codec</code> in pom.xml to <code>4.1.68.Final</code>, but then I found that other netty components like <code>netty-buffer</code> or <code>netty-handler</code> still stay at <code>4.1.52</code>.</p>
  <p>I want to know:</p>
  <ul>
  <li>Should I keep all the netty components at the same version?</li>
  <li>What is the right way to upgrade individual vulnerable components?</li>
  </ul>
  <p>Thanks</p>
  <h2>Update:</h2>
  <p><code>mvn dependency:tree</code></p>
  <pre><code>...
  [INFO] +- io.reactivex:rxnetty-contexts:jar:0.4.20:compile
  [INFO] +- io.reactivex:rxnetty-servo:jar:0.4.20:compile
  [INFO] |  \- com.netflix.servo:servo-core:jar:0.12.21:runtime
  [INFO] +- io.reactivex:rxnetty:jar:0.4.20:compile
  [INFO] |  +- io.netty:netty-codec-http:jar:4.1.69.Final:runtime
  [INFO] |  |  +- io.netty:netty-common:jar:4.1.69.Final:runtime
  [INFO] |  |  +- io.netty:netty-buffer:jar:4.1.52.Final:runtime
  [INFO] |  |  +- io.netty:netty-transport:jar:4.1.52.Final:runtime
  [INFO] |  |  \- io.netty:netty-codec:jar:4.1.52.Final:runtime
  [INFO] |  +- io.netty:netty-handler:jar:4.1.69.Final:runtime
  [INFO] |  |  \- io.netty:netty-resolver:jar:4.1.52.Final:runtime
  [INFO] |  +- io.netty:netty-transport-native-epoll:jar:4.1.69.Final:runtime
  [INFO] |  |  \- io.netty:netty-transport-native-unix-common:jar:4.1.52.Final:runtime
  ...
  </code></pre>