FrankChen021 opened a new pull request, #19809: URL: https://github.com/apache/druid/pull/19809
## Summary - remove the vulnerable legacy `org.lz4:lz4-java` 1.8.1 dependency management entry - exclude remaining legacy `org.lz4` transitives from the Confluent Avro/Protobuf and Rabbit stream-client dependency paths - retain the maintained relocated `at.yawk.lz4:lz4-java` dependency - remove the obsolete `org.lz4` license inventory entry ## Why Dependabot alerts #472 and #741 report vulnerabilities in `org.lz4:lz4-java` 1.8.1. There is no patched release under those coordinates. Druid already uses the maintained relocated artifact, but several third-party paths could still introduce the legacy coordinates. ## Impact The reactor dependency graph no longer contains `org.lz4:lz4-java`. LZ4 functionality continues through `at.yawk.lz4:lz4-java` 1.11.1. ## Validation - complete reactor dependency tree filtered for `org.lz4:lz4-java` is clean - focused dependency trees resolve only `at.yawk.lz4:lz4-java` 1.11.1 - Avro extension tests: 45 passed - Protobuf extension tests: 40 passed - Rabbit stream indexing tests: 38 passed - generated Avro and Protobuf license reports pass - `git diff --check` passes The full Apache release workflow was not completed because its nested report requires installed snapshot modules and the default Python environment lacks PyYAML. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
