Skip to content

[bundle] Fix stale lz4-java groupId in commented shade include#8520

Merged
JingsongLi merged 1 commit into
apache:masterfrom
thswlsqls:fix/bundle-lz4-groupid-comment
Jul 9, 2026
Merged

[bundle] Fix stale lz4-java groupId in commented shade include#8520
JingsongLi merged 1 commit into
apache:masterfrom
thswlsqls:fix/bundle-lz4-groupid-comment

Conversation

@thswlsqls

Copy link
Copy Markdown
Contributor

Purpose

  • The commented example shade <include> for lz4-java still referenced the old groupId org.lz4, while the actual dependency is at.yawk.lz4.
  • This completes the groupId rename from [core] upgrade lz4-java to 1.10.4 due to CVE #7384 (lz4-java 1.10.4 CVE upgrade, org.lz4at.yawk.lz4), which updated every active declaration but missed this commented example.
  • Keeps the example aligned with the real artifact so uncommenting it would actually match. See paimon-bundle/pom.xml line 79 and paimon-common/pom.xml, both at.yawk.lz4.

Tests

  • Comment-only change in paimon-bundle/pom.xml, no behavior change — no test added.
  • mvn -pl paimon-bundle apache-rat:check spotless:check passed (rat: 0 unapproved licenses; spotless: clean).
  • mvn -pl paimon-bundle -DfailIfNoTests=false clean install passed.
  • paimon-bundle has no Java sources, so there is no compile surface for this line; the pom is well-formed XML. Full reactor build covered by CI (fork Actions).

The commented example shade include for lz4-java still referenced the
old groupId org.lz4, while the actual dependency was renamed to
at.yawk.lz4 in apache#7384 (lz4-java 1.10.4 CVE upgrade). Align the comment
so the example matches the real artifact coordinate.

Generated-by: Claude Code
@JingsongLi JingsongLi merged commit a4255cc into apache:master Jul 9, 2026
12 checks passed
@thswlsqls thswlsqls deleted the fix/bundle-lz4-groupid-comment branch July 11, 2026 00:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants