You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@iotdb.apache.org by Haonan Hou <ha...@apache.org> on 2025/12/03 02:06:24 UTC
Switch to at.yawk.lz4:lz4-java?
Hi,
The org.lz4:lz4-java is no longer maintained[1] and there is a high risk issue CVE-2025-12183.
A community fork[2] is available to fix these issues. I think we should switch to the new one.
[1] https://github.com/lz4/lz4/issues/1346
[2] https://github.com/yawkat/lz4-java
Best regarts,
Haonan
Re: Switch to at.yawk.lz4:lz4-java?
Posted by Yuan Tian <ja...@gmail.com>.
Nice to see that, approved already.
Best regards,
--------------------
Yuan Tian
On Fri, Dec 5, 2025 at 12:20 PM Haonan Hou <ha...@apache.org> wrote:
> PR submitted https://github.com/apache/iotdb/pull/16871
> PTAL
>
> Haonan
>
> On 2025/12/03 22:37:07 冯 庆新 wrote:
> > ＋1
> >
> > 获取 Outlook for iOS<https://aka.ms/o0ukef>
> > ________________________________
> > 发件人: Christofer Dutz <ch...@c-ware.de>
> > 发送时间: Wednesday, December 3, 2025 9:53:33 PM
> > 收件人: dev@iotdb.apache.org <de...@iotdb.apache.org>
> > 主题: AW: Switch to at.yawk.lz4:lz4-java?
> >
> > +1
> >
> > Chris
> >
> > Von: Tian Jiang <jt...@163.com>
> > Datum: Mittwoch, 3. Dezember 2025 um 08:52
> > An: dev@iotdb.apache.org <de...@iotdb.apache.org>
> > Betreff: Re: Switch to at.yawk.lz4:lz4-java?
> >
> > +1
> >
> >
> > Under certain circumstances, the compression algorithm may block GC due
> to extensive JNI calls.
> > Switching to a maintaining repo makes it hopeful to optimize its
> performance.
> >
> >
> > Tian Jiang
> >
> >
> > ---- Replied Message ----
> > | From | Yuan Tian<ja...@gmail.com> |
> > | Date | 12/3/2025 14:00 |
> > | To | <de...@iotdb.apache.org> |
> > | Subject | Re: Switch to at.yawk.lz4:lz4-java? |
> > I think it's ok, +1 for replacing.
> >
> > On Wed, Dec 3, 2025 at 10:06 AM Haonan Hou <ha...@apache.org> wrote:
> >
> > Hi,
> >
> > The org.lz4:lz4-java is no longer maintained[1] and there is a high risk
> > issue CVE-2025-12183.
> > A community fork[2] is available to fix these issues. I think we should
> > switch to the new one.
> >
> > [1] https://github.com/lz4/lz4/issues/1346
> > [2] https://github.com/yawkat/lz4-java
> >
> > Best regarts,
> > Haonan
> >
> >
>
Re: Switch to at.yawk.lz4:lz4-java?
Posted by Haonan Hou <ha...@apache.org>.
PR submitted https://github.com/apache/iotdb/pull/16871
PTAL
Haonan
On 2025/12/03 22:37:07 冯 庆新 wrote:
> ＋1
>
> 获取 Outlook for iOS<https://aka.ms/o0ukef>
> ________________________________
> 发件人: Christofer Dutz <ch...@c-ware.de>
> 发送时间: Wednesday, December 3, 2025 9:53:33 PM
> 收件人: dev@iotdb.apache.org <de...@iotdb.apache.org>
> 主题: AW: Switch to at.yawk.lz4:lz4-java?
>
> +1
>
> Chris
>
> Von: Tian Jiang <jt...@163.com>
> Datum: Mittwoch, 3. Dezember 2025 um 08:52
> An: dev@iotdb.apache.org <de...@iotdb.apache.org>
> Betreff: Re: Switch to at.yawk.lz4:lz4-java?
>
> +1
>
>
> Under certain circumstances, the compression algorithm may block GC due to extensive JNI calls.
> Switching to a maintaining repo makes it hopeful to optimize its performance.
>
>
> Tian Jiang
>
>
> ---- Replied Message ----
> | From | Yuan Tian<ja...@gmail.com> |
> | Date | 12/3/2025 14:00 |
> | To | <de...@iotdb.apache.org> |
> | Subject | Re: Switch to at.yawk.lz4:lz4-java? |
> I think it's ok, +1 for replacing.
>
> On Wed, Dec 3, 2025 at 10:06 AM Haonan Hou <ha...@apache.org> wrote:
>
> Hi,
>
> The org.lz4:lz4-java is no longer maintained[1] and there is a high risk
> issue CVE-2025-12183.
> A community fork[2] is available to fix these issues. I think we should
> switch to the new one.
>
> [1] https://github.com/lz4/lz4/issues/1346
> [2] https://github.com/yawkat/lz4-java
>
> Best regarts,
> Haonan
>
>
Re: Switch to at.yawk.lz4:lz4-java?
Posted by 冯 庆新 <qi...@hotmail.com>.
＋1
获取 Outlook for iOS<https://aka.ms/o0ukef>
________________________________
发件人: Christofer Dutz <ch...@c-ware.de>
发送时间: Wednesday, December 3, 2025 9:53:33 PM
收件人: dev@iotdb.apache.org <de...@iotdb.apache.org>
主题: AW: Switch to at.yawk.lz4:lz4-java?
+1
Chris
Von: Tian Jiang <jt...@163.com>
Datum: Mittwoch, 3. Dezember 2025 um 08:52
An: dev@iotdb.apache.org <de...@iotdb.apache.org>
Betreff: Re: Switch to at.yawk.lz4:lz4-java?
+1
Under certain circumstances, the compression algorithm may block GC due to extensive JNI calls.
Switching to a maintaining repo makes it hopeful to optimize its performance.
Tian Jiang
---- Replied Message ----
| From | Yuan Tian<ja...@gmail.com> |
| Date | 12/3/2025 14:00 |
| To | <de...@iotdb.apache.org> |
| Subject | Re: Switch to at.yawk.lz4:lz4-java? |
I think it's ok, +1 for replacing.
On Wed, Dec 3, 2025 at 10:06 AM Haonan Hou <ha...@apache.org> wrote:
Hi,
The org.lz4:lz4-java is no longer maintained[1] and there is a high risk
issue CVE-2025-12183.
A community fork[2] is available to fix these issues. I think we should
switch to the new one.
[1] https://github.com/lz4/lz4/issues/1346
[2] https://github.com/yawkat/lz4-java
Best regarts,
Haonan
AW: Switch to at.yawk.lz4:lz4-java?
Posted by Christofer Dutz <ch...@c-ware.de>.
+1
Chris
Von: Tian Jiang <jt...@163.com>
Datum: Mittwoch, 3. Dezember 2025 um 08:52
An: dev@iotdb.apache.org <de...@iotdb.apache.org>
Betreff: Re: Switch to at.yawk.lz4:lz4-java?
+1
Under certain circumstances, the compression algorithm may block GC due to extensive JNI calls.
Switching to a maintaining repo makes it hopeful to optimize its performance.
Tian Jiang
---- Replied Message ----
| From | Yuan Tian<ja...@gmail.com> |
| Date | 12/3/2025 14:00 |
| To | <de...@iotdb.apache.org> |
| Subject | Re: Switch to at.yawk.lz4:lz4-java? |
I think it's ok, +1 for replacing.
On Wed, Dec 3, 2025 at 10:06 AM Haonan Hou <ha...@apache.org> wrote:
Hi,
The org.lz4:lz4-java is no longer maintained[1] and there is a high risk
issue CVE-2025-12183.
A community fork[2] is available to fix these issues. I think we should
switch to the new one.
[1] https://github.com/lz4/lz4/issues/1346
[2] https://github.com/yawkat/lz4-java
Best regarts,
Haonan
Re: Switch to at.yawk.lz4:lz4-java?
Posted by Tian Jiang <jt...@163.com>.
+1
Under certain circumstances, the compression algorithm may block GC due to extensive JNI calls.
Switching to a maintaining repo makes it hopeful to optimize its performance.
Tian Jiang
---- Replied Message ----
| From | Yuan Tian<ja...@gmail.com> |
| Date | 12/3/2025 14:00 |
| To | <de...@iotdb.apache.org> |
| Subject | Re: Switch to at.yawk.lz4:lz4-java? |
I think it's ok, +1 for replacing.
On Wed, Dec 3, 2025 at 10:06 AM Haonan Hou <ha...@apache.org> wrote:
Hi,
The org.lz4:lz4-java is no longer maintained[1] and there is a high risk
issue CVE-2025-12183.
A community fork[2] is available to fix these issues. I think we should
switch to the new one.
[1] https://github.com/lz4/lz4/issues/1346
[2] https://github.com/yawkat/lz4-java
Best regarts,
Haonan
Re: Switch to at.yawk.lz4:lz4-java?
Posted by Yuan Tian <ja...@gmail.com>.
I think it's ok, +1 for replacing.
On Wed, Dec 3, 2025 at 10:06 AM Haonan Hou <ha...@apache.org> wrote:
> Hi,
>
> The org.lz4:lz4-java is no longer maintained[1] and there is a high risk
> issue CVE-2025-12183.
> A community fork[2] is available to fix these issues. I think we should
> switch to the new one.
>
> [1] https://github.com/lz4/lz4/issues/1346
> [2] https://github.com/yawkat/lz4-java
>
> Best regarts,
> Haonan
>