This is an automated email from the ASF dual-hosted git repository.
dongjoon-hyun pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/master by this push:
new 2e6d44f77aba [SPARK-58665][BUILD] Upgrade `lz4-java` to 1.11.2
2e6d44f77aba is described below
commit 2e6d44f77abaa35786999bddb1002276303752ca
Author: Dongjoon Hyun <[email protected]>
AuthorDate: Sun Aug 9 21:14:37 2026 -0700
[SPARK-58665][BUILD] Upgrade `lz4-java` to 1.11.2
### What changes were proposed in this pull request?
This PR aims to upgrade `at.yawk.lz4:lz4-java` to 1.11.2.
### Why are the changes needed?
This is a security release to bring the latest security fixes from the
following release.
- https://github.com/yawkat/lz4-java/releases/tag/v1.11.2 (2026-08-06)
- [LZ4DecompressorWithLength allocates the unvalidated size from the
4-byte length header, so a 5-byte input triggers a 1 GiB allocation and
OutOfMemoryError](https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g)
- [LZ4BlockInputStream allocates an unvalidated compressed length from
the stream
header](https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464)
**Full Changelog**:
https://github.com/yawkat/lz4-java/compare/v1.11.1...v1.11.2
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Pass the CIs.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Fable 5
Closes #57874 from dongjoon-hyun/dongjoon/upgrade-lz4-java-66a987.
Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
---
dev/deps/spark-deps-hadoop-3-hive-2.3 | 2 +-
pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3
b/dev/deps/spark-deps-hadoop-3-hive-2.3
index ec3c3fb70df4..943a82d0c0e4 100644
--- a/dev/deps/spark-deps-hadoop-3-hive-2.3
+++ b/dev/deps/spark-deps-hadoop-3-hive-2.3
@@ -190,7 +190,7 @@ log4j-api/2.26.0//log4j-api-2.26.0.jar
log4j-core/2.26.0//log4j-core-2.26.0.jar
log4j-layout-template-json/2.26.0//log4j-layout-template-json-2.26.0.jar
log4j-slf4j2-impl/2.26.0//log4j-slf4j2-impl-2.26.0.jar
-lz4-java/1.11.1//lz4-java-1.11.1.jar
+lz4-java/1.11.2//lz4-java-1.11.2.jar
metrics-core/4.2.37//metrics-core-4.2.37.jar
metrics-graphite/4.2.37//metrics-graphite-4.2.37.jar
metrics-jmx/4.2.37//metrics-jmx-4.2.37.jar
diff --git a/pom.xml b/pom.xml
index 3ae320dcfe99..842638156908 100644
--- a/pom.xml
+++ b/pom.xml
@@ -878,7 +878,7 @@
<dependency>
<groupId>at.yawk.lz4</groupId>
<artifactId>lz4-java</artifactId>
- <version>1.11.1</version>
+ <version>1.11.2</version>
</dependency>
<dependency>
<groupId>com.github.luben</groupId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
