You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@accumulo.apache.org by "dlmarion (via GitHub)" <gi...@apache.org> on 2025/12/03 21:15:00 UTC
[PR] Upgrade lz4-java dependency [accumulo]
dlmarion opened a new pull request, #6000:
URL: https://github.com/apache/accumulo/pull/6000
The lz4-java dependency, which is only used in PropertyTest, was flagged due to CVE-2025-12183. This changes the dependency in accordance with the recommendation at https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@accumulo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade lz4-java dependency [accumulo]
Posted by "dlmarion (via GitHub)" <gi...@apache.org>.
dlmarion commented on PR #6000:
URL: https://github.com/apache/accumulo/pull/6000#issuecomment-3608886452
Additionally, I don't think we ever create a Decompressor, we use Hadoop's CodecPool class.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@accumulo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade lz4-java dependency [accumulo]
Posted by "dlmarion (via GitHub)" <gi...@apache.org>.
dlmarion commented on PR #6000:
URL: https://github.com/apache/accumulo/pull/6000#issuecomment-3608873472
This was noted by Dependabot at https://github.com/apache/accumulo/security/dependabot/21. At runtime our Lz4 dependency comes from Hadoop. They are tracking this issue at https://issues.apache.org/jira/browse/HADOOP-19747.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@accumulo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade lz4-java dependency [accumulo]
Posted by "dlmarion (via GitHub)" <gi...@apache.org>.
dlmarion merged PR #6000:
URL: https://github.com/apache/accumulo/pull/6000
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@accumulo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org