v1.1.10.9

What's Changed

🐛 Bug Fixes

• Fix buffer overflows and unbounded allocations from untrusted input (CVE-2026-90559 and others) by @xerial in #739
• Fix musl misdetection on glibc systems with musl installed (#692) by @xerial in #740

🔗 Dependency Updates

• Update native libraries by @github-actions[bot] in #543
• Update sbt, scripted-plugin to 1.11.5 by @xerial-bot in #687
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #685
• Bump actions/setup-java from 4 to 5 by @dependabot[bot] in #690
• Update sbt, scripted-plugin to 1.11.6 by @xerial-bot in #695
• Update sbt, scripted-plugin to 1.11.7 by @xerial-bot in #698
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #705
• Bump actions/cache from 4 to 5 by @dependabot[bot] in #707
• Bump peter-evans/create-pull-request from 7 to 8 by @dependabot[bot] in #706
• Update sbt, scripted-plugin to 1.12.0 by @xerial-bot in #709
• Update native libraries by @github-actions[bot] in #688
• Update sbt, scripted-plugin to 1.12.2 by @xerial-bot in #719
• Bump dorny/paths-filter from 3 to 4 by @dependabot[bot] in #722
• Bump release-drafter/release-drafter from 6 to 7 by @dependabot[bot] in #723
• Bump jwlawson/actions-setup-cmake from 2.0 to 2.2 by @dependabot[bot] in #724

🛠 Internal Updates

• Update airframe-log to 2025.1.16 by @xerial-bot in #686
• Update airframe-log to 2025.1.19 by @xerial-bot in #697
• Update sbt-scalafmt to 2.5.6 by @xerial-bot in #701
• Update airframe-log to 2025.1.21 by @xerial-bot in #700
• Update hadoop-common to 3.4.2 by @xerial-bot in #691
• Update airframe-log to 2025.1.22 by @xerial-bot in #708
• Update airframe-log to 2025.1.23 by @xerial-bot in #710
• Update airframe-log to 2025.1.27 by @xerial-bot in #714

📚 Docs

• Document JDK 24+ native access requirements by @xerial in #702

Other Changes

• chore: update release CI to use Java 21 by @xerial in #681
• Suppress AccessController deprecation warning for Java 17+ by @xerial in #682
• Add JDK 25 to CI test matrix by @xerial in #703
• Add JAR integration test for JDK compatibility by @xerial in #704
• Validate maxCompressedLength overflow and stream array ranges (#671, #513) by @xerial in #741
• Adding automatic module name header (#713) by @gunnarmorling in #718
• Fail clearly on oversized raw input in SnappyInputStream (#278) by @xerial in #743
• Enable ASLR and DEP for Windows DLLs (#288, #661) by @xerial in #742
• Close the underlying stream even if flush fails on close (#216) by @xerial in #744
• tests: remove Big Endian–specific compressed size assertion (from #720) by @xerial in #745

New Contributors

• @gunnarmorling made their first contribution in #718

Full Changelog: v1.1.10.8...v1.1.10.9