[hotfix][build] Bump netty to 4.2.15.Final

[spuru9]

What is the purpose of the change

Bump io.netty:netty-bom from 4.2.13.Final to 4.2.15.Final to keep the Netty modules Flink uses on a current patch release (non-shaded scope). Follows the prior bump in #28124.

Brief change log

• pom.xml: bump netty-bom 4.2.13.Final → 4.2.15.Final
• Update matching META-INF/NOTICE entries in flink-rpc-akka, flink-python, and flink-s3-fs-native so NoticeFileChecker passes

Scope

Non-shaded only, mirroring the prior PR #28072 / FLINK-39580 split and #28124. The runtime networking path that flows through flink-shaded-netty (currently 4.2.6.Final) is updated separately in the flink-shaded repo and is not addressed here.

Verifying this change

This change is a dependency version bump with no code changes; it is covered by the existing test suite and CI, including NoticeFileChecker, which validates the updated META-INF/NOTICE files against the bundled dependencies.

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): yes
• The public API, i.e., is any changed class annotated with @Public(Evolving): no
• The serializers: no
• The runtime per-record code paths (performance sensitive): no
• Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
• The S3 file system connector: no (NOTICE-only update)

Documentation

• Does this pull request introduce a new feature? no
• If yes, how is the feature documented? not applicable

AI Disclosure

• I confirm that AI agents (e.g. Cursor, Claude code, Github Copilot) were used in the process of creating this PR. Tool: Claude Code.

[flinkbot]

CI report:

• 9f0b38f Azure: SUCCESS

Bot commands

The @flinkbot bot supports the following commands:

• @flinkbot run azure re-run the last Azure build

[raminqaf]

Thanks for the contribution! I was wondering if the dependency's patch bump fixes anything related to Flink. We need to wait for the CI

[spuru9]

Thanks for the contribution! I was wondering if the dependency's patch bump fixes anything related to Flink. We need to wait for the CI

Its green.

[spuru9]

@raminqaf Can you help with a re-review

[spuru9]

The PR address some of the CVEs, full details in https://github.com/netty/netty/releases/tag/netty-4.2.15.Final, have DMed you the specific to flink.

[spuru9]

@snuyanzin Can you merge this as well while you are updating the shaded repo.

[adealjason]

稍后和您联系！

[spuru9]

@raminqaf Can you recheck this PR.

[MartijnVisser]

For a next time, shall we not do version bumps via hotfixes?

[snuyanzin]

makes sense, thanks for raising
noted