Migrate lz4-java from org.lz4 1.8.0 to at.yawk.lz4 1.10.4#18015
Merged
xiangfu0 merged 1 commit intoapache:masterfrom Mar 28, 2026
Merged
Migrate lz4-java from org.lz4 1.8.0 to at.yawk.lz4 1.10.4#18015xiangfu0 merged 1 commit intoapache:masterfrom
xiangfu0 merged 1 commit intoapache:masterfrom
Conversation
…1.10.4 The lz4-java library has moved to at.yawk.lz4 coordinates with active maintenance. Version 1.10.4 fixes both Dependabot alerts: - apache#299 CVE-2025-12183: OOB memory operations causing DoS (fixed in 1.8.1) - apache#300 CVE-2025-66566: information leak in safe decompressor (fixed in 1.10.1) The package names (net.jpountz.lz4 / org.lz4) remain unchanged so no Java source changes are needed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
xiangfu0
force-pushed
the
fix-lz4-java-version
branch
from
b14575d to
b99c769
Compare
xiangfu0
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the project’s LZ4 dependency coordinates/version to use the actively maintained at.yawk.lz4:lz4-java artifact, addressing the CVE-related Dependabot alerts without requiring source changes (package names remain net.jpountz.lz4).
Changes:
- Bump
lz4-javaversion property from1.8.0to1.10.4. - Switch Maven coordinates from
org.lz4:lz4-javatoat.yawk.lz4:lz4-javain dependency management and module dependencies.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pom.xml | Updates lz4-java.version and the dependencyManagement entry to the new at.yawk.lz4 groupId. |
| pinot-common/pom.xml | Updates the direct dependency declaration to at.yawk.lz4 so it resolves via the root’s dependencyManagement. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #18015 +/- ##
============================================
+ Coverage 63.27% 63.31% +0.04%
Complexity 1543 1543
============================================
Files 3200 3200
Lines 194074 194149 +75
Branches 29883 29910 +27
============================================
+ Hits 122792 122930 +138
+ Misses 61637 61570 -67
- Partials 9645 9649 +4
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
yashmayya
approved these changes
Mar 28, 2026
xiangfu0
added a commit
to xiangfu0/pinot
that referenced
this pull request
Mar 30, 2026
…1.10.4 (apache#18015) Auto-merged by automated PR review bot.
xiangfu0
added a commit
to xiangfu0/pinot
that referenced
this pull request
Mar 30, 2026
cherry-pick: Migrate lz4-java from org.lz4:lz4-java 1.8.0 to at.yawk.lz4:lz4-java1.10.4 (apache#18015)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates
lz4-javafromorg.lz4:lz4-java:1.8.0toat.yawk.lz4:lz4-java:1.10.4. The library has moved toat.yawk.lz4coordinates with active maintenance. Version 1.10.4 fixes both Dependabot alerts:The Java package names (
net.jpountz.lz4/org.lz4) remain unchanged so no source code changes are needed.Test plan
🤖 Generated with Claude Code