Hi Olek and Tony,I think it is ok to just upgrade zstd-jni-java to the latest version. If there's anything failed on bazel side, I'll fix it.
Should be not very hard.
Yours, Paul On 9/21/26 5:29 AM, Olek Wojnar wrote:
Hey tony, On 9/20/26 13:37, tony mancill wrote:Hi Olek, What needs to happen with the Bazel Build System [1,2] before we can upgrade zstd-jni-java to the current upstream version? Would it help to upload 1.5.7-17 to experimental?Thanks for bringing this to my attention!I'll check on the dependencies of the current (much newer) version that we have in sid. I'm also copying the Debian Bazel Discussion List in case anyone on there knows off the top of their head or can find the info sooner than I can.Update: just took a quick peek at the relevant parts of the code and it is not obvious to me whether a newer version would work, 1.5.2-3 is still what Bazel upstream has pinned [3], Debian uses a SLIGHTLY newer version without issues.[1] https://sources.debian.org/src/zstd-jni-java/1.5.2-5%2Bds-8/debian/README.source[2] https://salsa.debian.org/bazel-team/meta/-/wikis/Bazel-DependenciesPaul, do you have any insights on this? We don't have a robust enough test suite that I'd be comfortable just doing a rebuild and trusting that it would work.Oh, tony, to answer your other question, I see no problem with having the newer version in experimental. It looks like 1.5.7-14 is the version that fixed these vulnerabilities. Do you know what the code delta is between -14 and -17??Best regards, -Olek[3] https://salsa.debian.org/bazel-team/bazel-bootstrap/-/blob/main/MODULE.bazel#L22
OpenPGP_0x44173FA13D058888.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
