Bump lz4-java to 1.10.2 for CVE-2025-12183 & CVE-2025-66566 fixes. #14941
Conversation
slfan1989
force-pushed
the
bump-lz4-java-1.10.2
branch
from
04cf844 to
3906ecc
Compare
slfan1989
force-pushed
the
bump-lz4-java-1.10.2
branch
from
3906ecc to
805cd56
Compare
|
@huaxingao Could you please help review this PR? Thank you very much! |
|
I’m seeing org.lz4:lz4-java:1.8.0 still present on Spark 3.5/4.0 compileClasspath. Does this need to be fixed too? |
Thanks for the review! You're right — even as a transitive dependency, the vulnerable I'll update the PR to add a global Pushing the change shortly. Thanks again! |
| project.name.startsWith('iceberg-kafka-connect')) { | ||
|
|
||
| configurations.all { | ||
| exclude group: 'org.lz4', module: 'lz4-java' |
There was a problem hiding this comment.
This is a global exclusion rule. After applying this rule, we can use the following command for validation.
gradlew --parallel \
-DsparkVersions=4.0 \
-DscalaVersion=2.13 \
:iceberg-spark:iceberg-spark-4.0_2.13:dependencies \
:iceberg-spark:iceberg-spark-extensions-4.0_2.13:dependencies \
:iceberg-spark:iceberg-spark-runtime-4.0_2.13:dependencies \
--configuration compileClasspath \
-Pquick=true \
--refresh-dependencies|grep "lz4"
The result is as follows:
| +--- at.yawk.lz4:lz4-java:1.10.2
| +--- at.yawk.lz4:lz4-java:1.10.2
| +--- at.yawk.lz4:lz4-java:1.10.2
| +--- at.yawk.lz4:lz4-java:1.10.2
| +--- at.yawk.lz4:lz4-java:1.10.2
|
@huaxingao Could you please help review this PR again? Thank you very much! |
build.gradle
Outdated
| } | ||
| } | ||
|
|
||
| configurations.all { |
There was a problem hiding this comment.
Is this change still needed?
There was a problem hiding this comment.
Thanks for the review and suggestions! I agree—this part can be removed. I'll make further improvements and update the PR soon.
| if (project.name.startsWith('iceberg-spark') || | ||
| project.name.startsWith('iceberg-flink') || | ||
| project.name.startsWith('iceberg-delta-lake') || | ||
| project.name.startsWith('iceberg-kafka-connect')) { |
There was a problem hiding this comment.
why only these module, shouldn't we doing it for all ?
There was a problem hiding this comment.
Currently, only a few modules depend on org.lz4:lz4-java. Promoting this dependency to the project level is safe and will improve consistency and standardization in dependency management. I plan to implement this change.
There was a problem hiding this comment.
Is it better to keep this rule scoped (e.g., Spark/Flink/Kafka Connect) because the vulnerable org.lz4:lz4-java is coming from the Spark/Flink/Kafka dependency trees?
There was a problem hiding this comment.
@huaxingao Thank you very much for reviewing the code and for the helpful suggestions.
From my perspective, I also lean toward scoping this rule to the relevant components (e.g., Spark / Flink / Kafka Connect), since the current org.lz4:lz4-java vulnerability is primarily introduced via transitive dependencies in the Spark/Flink/Kafka dependency trees. This would help reduce the impact on other unrelated modules.
From my side: +1 to scoping the rule to Spark / Flink / Kafka Connect.
@singhpk234 Can you agree with this improvement?
slfan1989
force-pushed
the
bump-lz4-java-1.10.2
branch
from
9a950df to
7a7eee9
Compare
3 participants
Why are the changes needed?
To fully address two recently disclosed CVEs in lz4-java:
The current version in main (1.10.2) already includes the fix from 1.10.1 and subsequent improvements. This PR ensures we are on the latest patch release to eliminate any vulnerability scanner alerts and benefit from minor bug fixes/performance improvements.
References: