Skip to content

[bug] switch to at.yawk.lz4:lz4-java due to CVE-2025-12183 #2136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wuchong merged 2 commits into from
Dec 28, 2025
+8 −8
Merged

[bug] switch to at.yawk.lz4:lz4-java due to CVE-2025-12183 #2136

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6bdfe09
fix issue-2081:switch to at.yawk.lz4:lz4-java due to CVE-2025-12183
sd4324530 Dec 10, 2025
aa5a5bd
fix issue-2081:switch to at.yawk.lz4:lz4-java due to CVE-2025-12183
sd4324530 Dec 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions fluss-client/src/main/resources/META-INF/NOTICE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ This project bundles the following dependencies under the Apache Software Licens
- com.ververica:frocksdbjni:6.20.3-ververica-2.0
- org.apache.commons:commons-lang3:3.18.0
- org.apache.commons:commons-math3:3.6.1
- org.lz4:lz4-java:1.8.0
- at.yawk.lz4:lz4-java:1.10.2

This project bundles the following dependencies under the MIT (https://opensource.org/licenses/MIT)
See bundled license files for details.
Expand All @@ -20,4 +20,4 @@ See bundled license files for details.
This project bundles the following dependencies under BSD License (https://opensource.org/licenses/bsd-license.php).
See bundled license files for details.

- com.github.luben:zstd-jni:1.5.7-1
- com.github.luben:zstd-jni:1.5.7-6
6 changes: 3 additions & 3 deletions fluss-common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,15 +64,15 @@

<!-- TODO: these two dependencies need to be shaded. -->
<dependency>
<groupId>org.lz4</groupId>
<groupId>at.yawk.lz4</groupId>
<artifactId>lz4-java</artifactId>
<version>1.8.0</version>
<version>1.10.2</version>
</dependency>

<dependency>
<groupId>com.github.luben</groupId>
<artifactId>zstd-jni</artifactId>
<version>1.5.7-1</version>
<version>1.5.7-6</version>
</dependency>

<!-- RocksDB dependencies -->
Expand Down
2 changes: 1 addition & 1 deletion fluss-lake/fluss-lake-iceberg/src/main/resources/META-INF/NOTICE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,5 +51,5 @@ See bundled license files for details.
This project bundles the following dependencies under BSD License (https://opensource.org/licenses/bsd-license.php).
See bundled license files for details.

- com.github.luben:zstd-jni:1.5.7-1
- com.github.luben:zstd-jni:1.5.7-6
- org.threeten:threeten-extra:1.7.1
4 changes: 2 additions & 2 deletions fluss-server/src/main/resources/META-INF/NOTICE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ This project bundles the following dependencies under the Apache Software Licens
- commons-cli:commons-cli:1.5.0
- org.apache.commons:commons-lang3:3.18.0
- org.apache.commons:commons-math3:3.6.1
- org.lz4:lz4-java:1.8.0
- at.yawk.lz4:lz4-java:1.10.2
- org.xerial.snappy:snappy-java:1.1.10.4

This project bundles the following dependencies under the MIT (https://opensource.org/licenses/MIT)
Expand All @@ -25,6 +25,6 @@ See bundled license files for details.
This project bundles the following dependencies under BSD License (https://opensource.org/licenses/bsd-license.php).
See bundled license files for details.

- com.github.luben:zstd-jni:1.5.7-1
- com.github.luben:zstd-jni:1.5.7-6