This is an automated email from the ASF dual-hosted git repository.
dongjoon-hyun pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/master by this push:
new 1a2450b3e5c1 [SPARK-60628][BUILD] Upgrade `lz4-java` to 1.12.1
1a2450b3e5c1 is described below
commit 1a2450b3e5c1b77457bf47674dac16e6553278eb
Author: Dongjoon Hyun <[email protected]>
AuthorDate: Wed Oct 28 13:44:58 2026 -0700
[SPARK-60628][BUILD] Upgrade `lz4-java` to 1.12.1
### What changes were proposed in this pull request?
This PR aims to upgrade `at.yawk.lz4:lz4-java` to 1.12.1.
### Why are the changes needed?
To bring the security fix of `v1.12.1`, which was released as a security
release for
[GHSA-48mj-8f7c-7qfm](https://github.com/yawkat/lz4-java/security/advisories/GHSA-48mj-8f7c-7qfm)
(severity: low, availability impact only).
- https://github.com/yawkat/lz4-java/releases/tag/v1.12.1 (2026-10-22)
- [LZ4BlockInputStream and LZ4FrameInputStream allocate block buffers
from the block header before the block data
arrives](https://github.com/yawkat/lz4-java/security/advisories/GHSA-48mj-8f7c-7qfm):
the streams now grow their buffers only as block data actually arrives
(https://github.com/yawkat/lz4-java/pull/167).
- [Throw LZ4Exception for input shorter than the length
prefix](https://github.com/yawkat/lz4-java/pull/160)
- [Bound the compressed length of oversized LZ4
blocks](https://github.com/yawkat/lz4-java/pull/162)
- [Use the buffer limit for the safe decompress(ByteBuffer, int,
ByteBuffer, int)](https://github.com/yawkat/lz4-java/pull/161)
Note that Apache Spark's `LZ4CompressionCodec` and `Statistics` read
streams via `LZ4BlockInputStream`, which is one of the code paths fixed by
`GHSA-48mj-8f7c-7qfm`.
**Full Changelog**:
https://github.com/yawkat/lz4-java/compare/v1.12.0...v1.12.1
### Does this PR introduce _any_ user-facing change?
No. There is no behavior change for valid LZ4 streams.
### How was this patch tested?
- Regenerated the dependency manifest with `dev/test-dependencies.sh
--replace-manifest`; the only diff is the `lz4-java` line.
- `build/sbt core/compile`
- `build/sbt 'core/testOnly org.apache.spark.io.CompressionCodecSuite
org.apache.spark.shuffle.sort.UnsafeShuffleWriterSuite
org.apache.spark.FileSuite
org.apache.spark.deploy.history.EventLogFileWritersSuite'` (87 tests passed)
- Pass the CIs.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Sonnet 5.5
Closes #59870 from dongjoon-hyun/SPARK-60628.
Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
---
dev/deps/spark-deps-hadoop-3-hive-2.3 | 2 +-
pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3
b/dev/deps/spark-deps-hadoop-3-hive-2.3
index 6d7844bb849d..4e507db98e9d 100644
--- a/dev/deps/spark-deps-hadoop-3-hive-2.3
+++ b/dev/deps/spark-deps-hadoop-3-hive-2.3
@@ -190,7 +190,7 @@ log4j-api/2.26.1//log4j-api-2.26.1.jar
log4j-core/2.26.1//log4j-core-2.26.1.jar
log4j-layout-template-json/2.26.1//log4j-layout-template-json-2.26.1.jar
log4j-slf4j2-impl/2.26.1//log4j-slf4j2-impl-2.26.1.jar
-lz4-java/1.12.0//lz4-java-1.12.0.jar
+lz4-java/1.12.1//lz4-java-1.12.1.jar
metrics-core/4.2.37//metrics-core-4.2.37.jar
metrics-graphite/4.2.37//metrics-graphite-4.2.37.jar
metrics-jmx/4.2.37//metrics-jmx-4.2.37.jar
diff --git a/pom.xml b/pom.xml
index 170ff1124935..f31a670d7d7e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -880,7 +880,7 @@
<dependency>
<groupId>at.yawk.lz4</groupId>
<artifactId>lz4-java</artifactId>
- <version>1.12.0</version>
+ <version>1.12.1</version>
</dependency>
<dependency>
<groupId>com.github.luben</groupId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
