[PR] [FLINK-41022][build] Update lz4-java to 1.12.0 [flink]

["MartijnVisser (via GitHub)" <gi...@apache.org>]

MartijnVisser opened a new pull request, #29515:
URL: https://github.com/apache/flink/pull/29515

   ## What is the purpose of the change
   
   Replaces the open Dependabot PRs for lz4-java. Supersedes #28820 and #29440, which both miss the flink-dist NOTICE.
   
   ## Brief change log
   
     - lz4-java 1.12.0 and the flink-dist NOTICE
   
   Dependabot proposes 1.11.4, which has the same CVE fixes. This takes 1.12.0 because the lz4-java maintainer recommends it, and its changes are limited to `LZ4BlockInputStream`, `LZ4FrameInputStream` and `LZ4DecompressorWithLength`, none of which Flink uses.
   
   ## Verifying this change
   
   This change is already covered by existing tests: the compression, hash table and sorter tests in flink-runtime and flink-table-runtime pass, and the license checker passes for flink-dist. Round-trip throughput of 32 KiB blocks through `Lz4BlockCompressor`/`Lz4BlockDecompressor` on the JNI path is within noise between 1.10.3 and 1.12.0.
   
   ## Does this pull request potentially affect one of the following parts:
   
     - Dependencies (does it add or upgrade a dependency): yes
     - The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no
     - The serializers: no
     - The runtime per-record code paths (performance sensitive): yes
     - Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
     - The S3 file system connector: no
   
   ## Documentation
   
     - Does this pull request introduce a new feature? no
     - If yes, how is the feature documented? not applicable
   
   ---
   
   ##### Was generative AI tooling used to co-author this PR?
   
   - [X] Yes (please specify the tool below)
   
   Generated-by: Claude Code (Claude Opus 5.5)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-41022][build] Update lz4-java to 1.12.0 [flink]

["flinkbot (via GitHub)" <gi...@apache.org>]

flinkbot commented on PR #29515:
URL: https://github.com/apache/flink/pull/29515#issuecomment-6253033839

   <!--
   Meta data
   {
     "version" : 1,
     "metaDataEntries" : [ {
       "hash" : "8b90dea872e08ee1204a1bf51a04a9beac85d3f9",
       "status" : "UNKNOWN",
       "url" : "TBD",
       "triggerID" : "8b90dea872e08ee1204a1bf51a04a9beac85d3f9",
       "triggerType" : "PUSH"
     } ]
   }-->
   ## CI report:
   
   * 8b90dea872e08ee1204a1bf51a04a9beac85d3f9 UNKNOWN
   
   <details>
   <summary>Bot commands</summary>
     The @flinkbot bot supports the following commands:
   
    - `@flinkbot run azure` re-run the last Azure build
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-41022][build] Update lz4-java to 1.12.0 [flink]

["MartijnVisser (via GitHub)" <gi...@apache.org>]

MartijnVisser merged PR #29515:
URL: https://github.com/apache/flink/pull/29515


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org