This is an automated email from the ASF dual-hosted git repository.
MartijnVisser pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/flink.git
The following commit(s) were added to refs/heads/master by this push:
new c1e1d359c73 [FLINK-41022][build] Update lz4-java to 1.12.0
c1e1d359c73 is described below
commit c1e1d359c73f8ddcfb19984a994ce9e438e14177
Author: Martijn Visser <[email protected]>
AuthorDate: Sun Oct 18 17:12:58 2026 +0200
[FLINK-41022][build] Update lz4-java to 1.12.0
1.12.0 fixes CVE-2026-59949 and CVE-2026-106449 to CVE-2026-106453.
Flink only uses the block compressor and fast decompressor; the
stricter validation in 1.12.0 is in classes Flink does not use.
Round-trip throughput of Lz4BlockCompressor and Lz4BlockDecompressor on
the JNI path is within noise of 1.10.3.
Generated-by: Claude Code (Claude Opus 5.5)
---
flink-dist/src/main/resources/META-INF/NOTICE | 2 +-
pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/flink-dist/src/main/resources/META-INF/NOTICE
b/flink-dist/src/main/resources/META-INF/NOTICE
index ffeb7c67ee3..2357174f382 100644
--- a/flink-dist/src/main/resources/META-INF/NOTICE
+++ b/flink-dist/src/main/resources/META-INF/NOTICE
@@ -17,7 +17,7 @@ This project bundles the following dependencies under the
Apache Software Licens
- org.apache.commons:commons-math3:3.6.1
- org.apache.commons:commons-text:1.10.0
- org.javassist:javassist:3.24.0-GA
-- at.yawk.lz4:lz4-java:1.10.3
+- at.yawk.lz4:lz4-java:1.12.0
- org.objenesis:objenesis:3.4
- org.xerial.snappy:snappy-java:1.1.10.7
- tools.profiler:async-profiler:2.9
diff --git a/pom.xml b/pom.xml
index e2e87141081..8e30270db65 100644
--- a/pom.xml
+++ b/pom.xml
@@ -170,7 +170,7 @@ under the License.
<protobuf.compiler.version>${protoc.version}</protobuf.compiler.version>
<okhttp.version>3.14.9</okhttp.version>
<testcontainers.version>2.0.5</testcontainers.version>
- <lz4.version>1.10.3</lz4.version>
+ <lz4.version>1.12.0</lz4.version>
<commons.io.version>2.15.1</commons.io.version>
<japicmp.skip>false</japicmp.skip>
<flink.convergence.phase>validate</flink.convergence.phase>
