Skip to content

[CELEBORN-2218] Bump lz4-java version from 1.8.0 to 1.10.1 to resolve CVE‐2025‐12183 and CVE-2025-66566 #3555

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SteNicholas wants to merge 2 commits into
base: main
Choose a base branch
from
+33 −22
Open

[CELEBORN-2218] Bump lz4-java version from 1.8.0 to 1.10.1 to resolve CVE‐2025‐12183 and CVE-2025-66566 #3555

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4b94a83
[CELEBORN-2218] Bump lz4-java version from 1.8.0 to 1.10.1 to resolve…
SteNicholas Dec 3, 2025
46db6c9
[CELEBORN-2218] Bump lz4-java version from 1.8.0 to 1.10.1 to resolve…
SteNicholas Dec 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions client-mr/mr-shaded/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,8 +64,8 @@
<shadedPattern>${shading.prefix}.org.scala-lang</shadedPattern>
</relocation>
<relocation>
<pattern>org.lz4</pattern>
<shadedPattern>${shading.prefix}.org.lz4</shadedPattern>
<pattern>${lz4-java.group}</pattern>
<shadedPattern>${shading.prefix}.${lz4-java.group}</shadedPattern>
</relocation>
<relocation>
<pattern>org.roaringbitmap</pattern>
Expand All @@ -81,7 +81,7 @@
<include>io.netty:*</include>
<include>org.apache.commons:commons-lang3</include>
<include>org.scala-lang:scala-library</include>
<include>org.lz4:lz4-java</include>
<include>${lz4-java.group}:lz4-java</include>
<include>com.github.luben:zstd-jni</include>
<include>org.roaringbitmap:RoaringBitmap</include>
</includes>
Expand Down
2 changes: 1 addition & 1 deletion client-mr/mr-shaded/src/main/resources/META-INF/LICENSE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,7 @@ This project bundles the following dependencies under the Apache License 2.0 (ht
Apache License 2.0
--------------------------------------

at.yawk.lz4:lz4-java
com.google.guava:failureaccess
com.google.guava:guava
io.netty:netty
Expand Down Expand Up @@ -240,7 +241,6 @@ io.netty:netty-transport-rxtx
io.netty:netty-transport-sctp
io.netty:netty-transport-udt
org.apache.commons:commons-lang3
org.lz4:lz4-java
org.roaringbitmap:RoaringBitmap
org.scala-lang:scala-library

Expand Down
2 changes: 1 addition & 1 deletion client-tez/tez-shaded/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@
<include>org.roaringbitmap:RoaringBitmap</include>
<include>org.scala-lang:scala-library</include>
<include>org.scala-lang:scala-reflect</include>
<include>org.lz4:lz4-java</include>
<include>at.yawk.lz4:lz4-java</include>
<include>io.dropwizard.metrics:metrics-core</include>
<include>com.codahale.metrics:metrics-core</include>
<include>com.github.luben:zstd-jni</include>
Expand Down
2 changes: 1 addition & 1 deletion client-tez/tez-shaded/src/main/resources/META-INF/LICENSE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,7 @@ This project bundles the following dependencies under the Apache License 2.0 (ht
Apache License 2.0
--------------------------------------

at.yawk.lz4:lz4-java
com.google.guava:failureaccess
com.google.guava:guava
io.netty:netty
Expand Down Expand Up @@ -240,7 +241,6 @@ io.netty:netty-transport-rxtx
io.netty:netty-transport-sctp
io.netty:netty-transport-udt
org.apache.commons:commons-lang3
org.lz4:lz4-java
org.roaringbitmap:RoaringBitmap
org.scala-lang:scala-library

Expand Down
2 changes: 1 addition & 1 deletion client/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@
<artifactId>guava</artifactId>
</dependency>
<dependency>
<groupId>org.lz4</groupId>
<groupId>${lz4-java.group}</groupId>
<artifactId>lz4-java</artifactId>
</dependency>
<dependency>
Expand Down
2 changes: 1 addition & 1 deletion dev/deps/dependencies-client-flink-1.16
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jcl-over-slf4j/1.7.36//jcl-over-slf4j-1.7.36.jar
jsr305/1.3.9//jsr305-1.3.9.jar
jul-to-slf4j/1.7.36//jul-to-slf4j-1.7.36.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
lz4-java/1.10.1//lz4-java-1.10.1.jar
maven-jdk-tools-wrapper/0.1//maven-jdk-tools-wrapper-0.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
metrics-graphite/4.2.25//metrics-graphite-4.2.25.jar
Expand Down
2 changes: 1 addition & 1 deletion dev/deps/dependencies-client-flink-1.17
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jcl-over-slf4j/1.7.36//jcl-over-slf4j-1.7.36.jar
jsr305/1.3.9//jsr305-1.3.9.jar
jul-to-slf4j/1.7.36//jul-to-slf4j-1.7.36.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
lz4-java/1.10.1//lz4-java-1.10.1.jar
maven-jdk-tools-wrapper/0.1//maven-jdk-tools-wrapper-0.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
metrics-graphite/4.2.25//metrics-graphite-4.2.25.jar
Expand Down
2 changes: 1 addition & 1 deletion dev/deps/dependencies-client-flink-1.18
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jcl-over-slf4j/1.7.36//jcl-over-slf4j-1.7.36.jar
jsr305/1.3.9//jsr305-1.3.9.jar
jul-to-slf4j/1.7.36//jul-to-slf4j-1.7.36.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
lz4-java/1.10.1//lz4-java-1.10.1.jar
maven-jdk-tools-wrapper/0.1//maven-jdk-tools-wrapper-0.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
metrics-graphite/4.2.25//metrics-graphite-4.2.25.jar
Expand Down
2 changes: 1 addition & 1 deletion dev/deps/dependencies-client-flink-1.19
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jcl-over-slf4j/1.7.36//jcl-over-slf4j-1.7.36.jar
jsr305/1.3.9//jsr305-1.3.9.jar
jul-to-slf4j/1.7.36//jul-to-slf4j-1.7.36.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
lz4-java/1.10.1//lz4-java-1.10.1.jar
maven-jdk-tools-wrapper/0.1//maven-jdk-tools-wrapper-0.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
metrics-graphite/4.2.25//metrics-graphite-4.2.25.jar
Expand Down
2 changes: 1 addition & 1 deletion dev/deps/dependencies-client-flink-1.20
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jcl-over-slf4j/1.7.36//jcl-over-slf4j-1.7.36.jar
jsr305/1.3.9//jsr305-1.3.9.jar
jul-to-slf4j/1.7.36//jul-to-slf4j-1.7.36.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
lz4-java/1.10.1//lz4-java-1.10.1.jar
maven-jdk-tools-wrapper/0.1//maven-jdk-tools-wrapper-0.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
metrics-graphite/4.2.25//metrics-graphite-4.2.25.jar
Expand Down
2 changes: 1 addition & 1 deletion dev/deps/dependencies-client-flink-2.0
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jcl-over-slf4j/1.7.36//jcl-over-slf4j-1.7.36.jar
jsr305/1.3.9//jsr305-1.3.9.jar
jul-to-slf4j/1.7.36//jul-to-slf4j-1.7.36.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
lz4-java/1.10.1//lz4-java-1.10.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
metrics-graphite/4.2.25//metrics-graphite-4.2.25.jar
metrics-jvm/4.2.25//metrics-jvm-4.2.25.jar
Expand Down
2 changes: 1 addition & 1 deletion dev/deps/dependencies-client-flink-2.1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jcl-over-slf4j/1.7.36//jcl-over-slf4j-1.7.36.jar
jsr305/1.3.9//jsr305-1.3.9.jar
jul-to-slf4j/1.7.36//jul-to-slf4j-1.7.36.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
lz4-java/1.10.1//lz4-java-1.10.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
metrics-graphite/4.2.25//metrics-graphite-4.2.25.jar
metrics-jvm/4.2.25//metrics-jvm-4.2.25.jar
Expand Down
2 changes: 1 addition & 1 deletion dev/deps/dependencies-client-flink-2.2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jcl-over-slf4j/1.7.36//jcl-over-slf4j-1.7.36.jar
jsr305/1.3.9//jsr305-1.3.9.jar
jul-to-slf4j/1.7.36//jul-to-slf4j-1.7.36.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
lz4-java/1.10.1//lz4-java-1.10.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
metrics-graphite/4.2.25//metrics-graphite-4.2.25.jar
metrics-jvm/4.2.25//metrics-jvm-4.2.25.jar
Expand Down
2 changes: 1 addition & 1 deletion dev/deps/dependencies-client-mr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,7 @@ kerby-xdr/1.0.1//kerby-xdr-1.0.1.jar
kotlin-stdlib-common/1.4.10//kotlin-stdlib-common-1.4.10.jar
kotlin-stdlib/1.4.10//kotlin-stdlib-1.4.10.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
lz4-java/1.10.1//lz4-java-1.10.1.jar
maven-jdk-tools-wrapper/0.1//maven-jdk-tools-wrapper-0.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
metrics-graphite/4.2.25//metrics-graphite-4.2.25.jar
Expand Down
2 changes: 1 addition & 1 deletion dev/deps/dependencies-client-tez
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ kerby-util/1.0.1//kerby-util-1.0.1.jar
kerby-xdr/1.0.1//kerby-xdr-1.0.1.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
log4j/1.2.17//log4j-1.2.17.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
lz4-java/1.10.1//lz4-java-1.10.1.jar
maven-jdk-tools-wrapper/0.1//maven-jdk-tools-wrapper-0.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
metrics-graphite/4.2.25//metrics-graphite-4.2.25.jar
Expand Down
2 changes: 1 addition & 1 deletion dev/deps/dependencies-server
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ log4j-1.2-api/2.24.3//log4j-1.2-api-2.24.3.jar
log4j-api/2.24.3//log4j-api-2.24.3.jar
log4j-core/2.24.3//log4j-core-2.24.3.jar
log4j-slf4j-impl/2.24.3//log4j-slf4j-impl-2.24.3.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
lz4-java/1.10.1//lz4-java-1.10.1.jar
maven-jdk-tools-wrapper/0.1//maven-jdk-tools-wrapper-0.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
metrics-graphite/4.2.25//metrics-graphite-4.2.25.jar
Expand Down
13 changes: 11 additions & 2 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,8 @@
<leveldb.version>1.8</leveldb.version>
<log4j2.version>2.24.3</log4j2.version>
<disruptor.version>3.4.4</disruptor.version>
<lz4-java.version>1.8.0</lz4-java.version>
<lz4-java.group>at.yawk.lz4</lz4-java.group>
<lz4-java.version>1.10.1</lz4-java.version>
<mockito.version>4.11.0</mockito.version>
<mockito-scalatest.version>1.17.14</mockito-scalatest.version>
<netty.version>4.1.118.Final</netty.version>
Expand Down Expand Up @@ -441,7 +442,7 @@
<version>${leveldb.version}</version>
</dependency>
<dependency>
<groupId>org.lz4</groupId>
<groupId>${lz4-java.group}</groupId>
<artifactId>lz4-java</artifactId>
<version>${lz4-java.version}</version>
</dependency>
Expand Down Expand Up @@ -1424,6 +1425,7 @@
<module>tests/spark-it</module>
</modules>
<properties>
<lz4-java.group>org.lz4</lz4-java.group>
<lz4-java.version>1.4.0</lz4-java.version>
<scala.version>2.11.12</scala.version>
<scala.binary.version>2.11</scala.binary.version>
Expand All @@ -1443,6 +1445,7 @@
<module>tests/spark-it</module>
</modules>
<properties>
<lz4-java.group>org.lz4</lz4-java.group>
<lz4-java.version>1.7.1</lz4-java.version>
<scala.version>2.12.10</scala.version>
<scala.binary.version>2.12</scala.binary.version>
Expand All @@ -1463,6 +1466,7 @@
<module>tests/spark-it</module>
</modules>
<properties>
<lz4-java.group>org.lz4</lz4-java.group>
<lz4-java.version>1.7.1</lz4-java.version>
<scala.version>2.12.10</scala.version>
<scala.binary.version>2.12</scala.binary.version>
Expand All @@ -1483,6 +1487,7 @@
<module>tests/spark-it</module>
</modules>
<properties>
<lz4-java.group>org.lz4</lz4-java.group>
<lz4-java.version>1.7.1</lz4-java.version>
<scala.version>2.12.15</scala.version>
<scala.binary.version>2.12</scala.binary.version>
Expand All @@ -1502,6 +1507,7 @@
<module>tests/spark-it</module>
</modules>
<properties>
<lz4-java.group>org.lz4</lz4-java.group>
<lz4-java.version>1.8.0</lz4-java.version>
<scala.version>2.12.15</scala.version>
<scala.binary.version>2.12</scala.binary.version>
Expand All @@ -1521,6 +1527,7 @@
<module>tests/spark-it</module>
</modules>
<properties>
<lz4-java.group>org.lz4</lz4-java.group>
<lz4-java.version>1.8.0</lz4-java.version>
<scala.version>2.12.17</scala.version>
<scala.binary.version>2.12</scala.binary.version>
Expand All @@ -1540,6 +1547,7 @@
<module>tests/spark-it</module>
</modules>
<properties>
<lz4-java.group>org.lz4</lz4-java.group>
<lz4-java.version>1.8.0</lz4-java.version>
<scala.version>2.12.18</scala.version>
<scala.binary.version>2.12</scala.binary.version>
Expand All @@ -1559,6 +1567,7 @@
<module>tests/spark-it</module>
</modules>
<properties>
<lz4-java.group>org.lz4</lz4-java.group>
<lz4-java.version>1.8.0</lz4-java.version>
<scala.version>2.13.16</scala.version>
<scala.binary.version>2.13</scala.binary.version>
Expand Down
6 changes: 4 additions & 2 deletions project/CelebornBuild.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,8 @@ import CelebornCommonSettings._
object Dependencies {

val zstdJniVersion = sparkClientProjects.map(_.zstdJniVersion).getOrElse("1.5.7-1")
val lz4JavaVersion = sparkClientProjects.map(_.lz4JavaVersion).getOrElse("1.8.0")
val lz4JavaGroup = sparkClientProjects.map(_.lz4JavaGroup).getOrElse("at.yawk.lz4")
val lz4JavaVersion = sparkClientProjects.map(_.lz4JavaVersion).getOrElse("1.10.1")

// Dependent library versions
val apLoaderVersion = "4.0-10"
Expand Down Expand Up @@ -152,7 +153,7 @@ object Dependencies {
val log4j12Api = "org.apache.logging.log4j" % "log4j-1.2-api" % log4j2Version
val log4jSlf4jImpl = "org.apache.logging.log4j" % "log4j-slf4j-impl" % log4j2Version
val disruptor = "com.lmax" % "disruptor" % disruptorVersion
val lz4Java = "org.lz4" % "lz4-java" % lz4JavaVersion
val lz4Java = lz4JavaGroup % "lz4-java" % lz4JavaVersion
val protobufJava = "com.google.protobuf" % "protobuf-java" % protoVersion
val ratisClient = "org.apache.ratis" % "ratis-client" % ratisVersion
val ratisCommon = "org.apache.ratis" % "ratis-common" % ratisVersion
Expand Down Expand Up @@ -946,6 +947,7 @@ trait SparkClientProjects {
val sparkClientShadedProjectPath: String
val sparkClientShadedProjectName: String

val lz4JavaGroup: String = "org.lz4"
val lz4JavaVersion: String
val sparkProjectScalaVersion: String
val sparkVersion: String
Expand Down
Loading