[BOURNE-3137] Resolve Dependabot alerts

[chao-shawn]

Resolves all open critical and high severity Dependabot alerts on this repo (and, as a side effect, every open netty and pmd-core moderate alert too, since the patched versions are the same properties).

Changes

Property	Before	After	Why
netty.version	4.1.130.Final	4.1.138.Final	Highest patched version required by any netty alert was 4.1.137.Final; 4.1.138.Final is the latest 4.1.x on Maven Central.
pmd.version	7.6.0	7.28.0	Critical pmd-core alert is patched in 7.10.0, the moderate one in 7.22.0.

Alerts addressed

Critical (1)

• initial circle ci config #2 — net.sourceforge.pmd:pmd-core (>= 6.21.0, < 7.10.0)

High (11) — all io.netty codec artifacts

• Bump io.netty:netty-codec-http from 4.1.130.Final to 4.1.133.Final #27, [BOURNE-2565] Sync with upstream #23, [BOURNE-1817] Retrieve realm-management client authz information in parts to prevent long-running query #17, [BOURNE-1703] Prevent recreating auth flows if priority values changed (but order remains the same) #15, Prevent retrieving all clients in client composite import #14, [BOURNE-1717] Prevent retrieving all clients in client composite import #12, [BOURNE-1562] Cache client and role retrieval in role import step #5 — netty-codec-http2
• Bump net.sourceforge.pmd:pmd-core from 7.6.0 to 7.22.0 #26, Bump io.netty:netty-codec-http from 4.1.130.Final to 4.1.132.Final #24, Sync with upstream #21, Get all stream #13, [BOURNE-1717] Cache client IDs in ClientCompositeImport #10, Cache client name to id mapping #4 — netty-codec-http
• Bourne 2656 update to latest upstream #22, [BOURNE-1717] Change getAll client methods to return streams #9 — netty-codec

Also resolved (moderate) — #28, #25, #20, #19, #18, #16, #11, #8, #7, #6, #3

Alert #1 (org.keycloak:keycloak-core, low, in contrib/custom-representations/pom.xml) is not addressed here — it is low severity, has no patched version published, and lives in a separate contrib module. Out of scope for this PR.

Verification

• ./mvnw compile pmd:check — passes (PMD 7.28.0 reports no new violations against the maven-pmd-plugin default ruleset; no custom ruleset in this repo).
• ./mvnw test — 339 tests, 0 failures, 0 errors.
• ./mvnw dependency:tree -Dincludes='io.netty:*' confirms netty-codec, netty-codec-http, and netty-codec-http2 all resolve to 4.1.138.Final.
• Integration tests (*IT, Testcontainers + Keycloak) were not run locally — leaving those to CI, which is why this is a draft.

Note for reviewers

The other netty artifacts (netty-buffer, netty-common, netty-handler, netty-transport, ...) still resolve to 4.1.135.Final. That is because the keycloak-parent BOM is imported at pom.xml:155, before the netty-bom import at pom.xml:217, so keycloak-parent's netty pins win for everything not explicitly listed in our own dependencyManagement. This is why the three explicit netty-codec* entries exist at pom.xml:224-239 — they are the only way to override keycloak-parent. None of those other artifacts have open alerts, so this PR does not touch them, but it is worth knowing that the netty-bom import is currently shadowed and bumping netty.version alone would not move them.

🤖 Generated with Claude Code

[kermitapp]

Jira Issue: https://appfolio.atlassian.net/browse/BOURNE-3137