You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by "FrankChen021 (via GitHub)" <gi...@apache.org> on 2026/07/30 14:39:25 UTC
[PR] Remove vulnerable legacy LZ4 dependency (druid)
FrankChen021 opened a new pull request, #19809:
URL: https://github.com/apache/druid/pull/19809
## Summary
- remove the vulnerable legacy `org.lz4:lz4-java` 1.8.1 dependency management entry
- exclude remaining legacy `org.lz4` transitives from the Confluent Avro/Protobuf and Rabbit stream-client dependency paths
- retain the maintained relocated `at.yawk.lz4:lz4-java` dependency
- remove the obsolete `org.lz4` license inventory entry
## Why
Dependabot alerts #472 and #741 report vulnerabilities in `org.lz4:lz4-java` 1.8.1. There is no patched release under those coordinates. Druid already uses the maintained relocated artifact, but several third-party paths could still introduce the legacy coordinates.
## Impact
The reactor dependency graph no longer contains `org.lz4:lz4-java`. LZ4 functionality continues through `at.yawk.lz4:lz4-java` 1.11.1.
## Validation
- complete reactor dependency tree filtered for `org.lz4:lz4-java` is clean
- focused dependency trees resolve only `at.yawk.lz4:lz4-java` 1.11.1
- Avro extension tests: 45 passed
- Protobuf extension tests: 40 passed
- Rabbit stream indexing tests: 38 passed
- generated Avro and Protobuf license reports pass
- `git diff --check` passes
The full Apache release workflow was not completed because its nested report requires installed snapshot modules and the default Python environment lacks PyYAML.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] fix: remove vulnerable legacy LZ4 dependency (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 commented on PR #19809:
URL: https://github.com/apache/druid/pull/19809#issuecomment-5133656459
The failing `KafkaIndexFaultToleranceTest.test_supervisorRecovers_afterChangeInTopicPartitions` appears to be an unrelated flaky-test failure caused by publishing before newly added partitions are ready. [PR #19817](https://github.com/apache/druid/pull/19817) waits for the expanded partition set and for non-transactional producer sends to complete.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] fix: remove vulnerable legacy LZ4 dependency (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 merged PR #19809:
URL: https://github.com/apache/druid/pull/19809
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org