Hi, I did a quick scan on our dependencies and found the lz4-java version we currently use has a couple of CVEs. I opened https://github.com/apache/kafka/pull/23161
Thanks, Mickael On Fri, Aug 14, 2026 at 5:51 PM Matthias J. Sax <[email protected]> wrote: > > I have three smaller merged PRs I would like to cherry-pick to 4.4 > branch. If we don't cherry-pick now, I would need to cycle back to > cherry-pick for 4.4.1 release what seems unnecessary bookkeeping overhead. > > Given that we are waiting for some blockers to get resolved anyway, > there should be zero impact on the release; all three are low risk of > course. > > Please let me know: > - https://github.com/apache/kafka/pull/23080 > - https://github.com/apache/kafka/pull/23002 > - https://github.com/apache/kafka/pull/23143 > > > > -Matthias > > On 8/12/26 9:53 AM, José Armando García Sancio via dev wrote: > > Hi Chia-Ping, > > > > That decision sounds good to me. I marked it as fixed in 4.5.0 and > > will not cherry pick it to the 4.4 branch. > > > > Thanks! > > > > On Wed, Aug 12, 2026 at 12:36 PM Chia-Ping Tsai <[email protected]> wrote: > >> > >> hi José > >> > >> Actually, we did NOT extend the code freeze :) > >> > >> The only commits we are pushing to the 4.4 branch right now are to revert > >> incomplete KIPs. > >> > >> KAFKA-16517 is a kind of performance optimization, right? If so, it > >> doesn't seem necessary for 4.4.0. > >> > >> Please correct me if I am wrong. > >> > >> Best, > >> Chia-Ping > >> > >> José Armando García Sancio via dev <[email protected]> 於 2026年8月13日週四 > >> 上午12:28寫道： > >>> > >>> Hi Chia-Ping, > >>> > >>> Thanks for volunteering to release 4.4. Since we extended the code > >>> freeze to Aug 19th, I would like to include KAFKA-16517 in the 4.4 > >>> release. > >>> > >>> Do you agree? Can I cherry pick the commit > >>> (https://github.com/apache/kafka/pull/22805) to the 4.4 branch? > >>> > >>> Thanks, > >>> -José > > > > > > >
