sgtm
 Fixed in #4852
 Thanks for the patch @windie !

CorsConfigBuilder allowNullOrigin method should be public instead of package private
Netty version: 4.1.0-CR1

Class:
io.netty.handler.codec.http.cors.CorsConfigBuilder

Method:
method "allowNullOrigin" should be public but it is package private (no modifier)

codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsConfigBuilder.java
codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsConfigBuilder.java
diff --git a/codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsConfigBuilder.java b/codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsConfigBuilder.java
index 81e0a8a2137..52457b32317 100644
--- a/codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsConfigBuilder.java
+++ b/codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsConfigBuilder.java
@@ -103,7 +103,7 @@ public static CorsConfigBuilder forOrigins(final String... origins) {
      *
      * @return {@link CorsConfigBuilder} to support method chaining.
      */
-    CorsConfigBuilder allowNullOrigin() {
+    public CorsConfigBuilder allowNullOrigin() {
         allowNullOrigin = true;
         return this;
     }
