[
https://issues.apache.org/jira/browse/FLINK-41022?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated FLINK-41022:
-----------------------------------
Labels: pull-request-available (was: )
> Update lz4-java to 1.12.0
> -------------------------
>
> Key: FLINK-41022
> URL: https://issues.apache.org/jira/browse/FLINK-41022
> Project: Flink
> Issue Type: Technical Debt
> Components: Build System, Runtime / Network
> Reporter: Martijn Visser
> Assignee: Martijn Visser
> Priority: Major
> Labels: pull-request-available
> Fix For: 2.4.0
>
>
> lz4-java 1.10.3, which flink-dist bundles, has six open advisories, all fixed
> in 1.11.4. We should update to 1.12.0, which the lz4-java maintainer
> recommends and which only adds validation to stream classes Flink doesn't
> use. The Dependabot PRs don't update the flink-dist NOTICE.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
