Martijn Visser created FLINK-41022:
--------------------------------------
Summary: Update lz4-java to 1.12.0
Key: FLINK-41022
URL: https://issues.apache.org/jira/browse/FLINK-41022
Project: Flink
Issue Type: Technical Debt
Components: Build System, Runtime / Network
Reporter: Martijn Visser
Assignee: Martijn Visser
Fix For: 2.4.0
lz4-java 1.10.3, which flink-dist bundles, has six open advisories, all fixed
in 1.11.4. We should update to 1.12.0, which the lz4-java maintainer recommends
and which only adds validation to stream classes Flink doesn't use. The
Dependabot PRs don't update the flink-dist NOTICE.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
