dongjoon-hyun opened a new pull request, #59093: URL: https://github.com/apache/spark/pull/59093
### What changes were proposed in this pull request? This PR aims to upgrade `at.yawk.lz4:lz4-java` to 1.12.0. ### Why are the changes needed? To bring the latest security fixes of `v1.11.4` and the stricter input validation of `v1.12.0`. The upstream recommends `1.12.0` over `1.11.4`. - https://github.com/yawkat/lz4-java/releases/tag/v1.12.0 (2026-09-25) - [Throw IOException for invalid or unsupported frame descriptors](https://github.com/yawkat/lz4-java/pull/133) - [Reject short output in LZ4DecompressorWithLength safe paths](https://github.com/yawkat/lz4-java/pull/126) - [Make stream failures sticky in LZ4FrameInputStream and LZ4BlockInputStream](https://github.com/yawkat/lz4-java/pull/145) - https://github.com/yawkat/lz4-java/releases/tag/v1.11.4 (2026-09-25) - [LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs](https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv) - [LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError](https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr) - [Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user](https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g) Note that Apache Spark's `LZ4CompressionCodec` reads streams via `LZ4BlockInputStream` with `withStopOnEmptyBlock(false)`, which is the code path fixed by `GHSA-343h-94h5-c4wr`. **Full Changelog**: https://github.com/yawkat/lz4-java/compare/v1.11.3...v1.12.0 ### Does this PR introduce _any_ user-facing change? No. There is no behavior change for valid LZ4 streams. ### How was this patch tested? Pass the CIs. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Opus 5.5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
