Bump LZ4 version to latest by vandonr · Pull Request #12091 · DataDog/dd-trace-java

vandonr · 2026-07-28T14:03:14Z

What Does This Do

bump lz4 version to latest minor (fixes CVE GHSA-xx22-p4ch-683r)
solves #12090

Motivation

Additional Notes

Contributor Checklist

Format the title according to the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any other useful labels
Avoid using close, fix, or any linking keywords when referencing an issue
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, migration, or deletion
Update public documentation with any new configuration flags or behaviors
Once approved, use merge queue to merge the PR

Jira ticket: [PROJ-IDENT]

datadog-datadog-prod-us1

More details

The dependency-only upgrade is internally consistent: the version catalog and all seven affected lockfiles move together from LZ4 1.11.0 to 1.11.1, with no diff-only behavioral hazard identified. Runtime compression tests could not execute because the sandbox lacks the repository-required Java 25 toolchain.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 4be8fb0 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4be8fb094e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-28T14:07:58Z

 javaparser = "3.28.2"
 jctools = "4.0.6"
-lz4 = "1.11.0"
+lz4 = "1.11.1"


Regenerate the remaining LZ4 lock

The repo-wide lockfile search still finds at.yawk.lz4:lz4-java:1.11.0 in dd-java-agent/instrumentation/play/play-appsec-2.7/gradle.lockfile:6 for its test* and latestDepTest* configurations. Because this repository commits per-project dependency locks, the checked-in dependency state—and any lockfile-based CVE reporting—continues to include the vulnerable version despite this catalog bump; regenerate that module's lockfile as part of the update.

Useful? React with 👍 / 👎.

no biggie for tests

datadog-datadog-prod-us1 · 2026-07-28T14:19:49Z

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 57.70% (-0.00%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 4be8fb0 | Docs | Datadog PR Page | Give us feedback!}

dd-octo-sts · 2026-07-28T14:27:50Z

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.05 s	13.98 s	[-0.3%; +1.3%] (no difference)
startup:insecure-bank:tracing:Agent	12.88 s	13.03 s	[-1.8%; -0.5%] (maybe better)
startup:petclinic:appsec:Agent	17.05 s	16.65 s	[+1.2%; +3.5%] (significantly worse)
startup:petclinic:iast:Agent	17.02 s	16.93 s	[-0.4%; +1.4%] (no difference)
startup:petclinic:profiling:Agent	16.62 s	16.80 s	[-2.3%; +0.1%] (no difference)
startup:petclinic:sca:Agent	17.06 s	16.86 s	[+0.4%; +2.1%] (maybe worse)
startup:petclinic:tracing:Agent	16.10 s	16.25 s	[-2.0%; +0.2%] (no difference)

Commit: 4be8fb09 · CI Pipeline · Benchmarking Platform UI

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

dd-octo-sts · 2026-07-28T15:59:09Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-07-28T15:59:14Z

View all feedbacks in Devflow UI.

2026-07-28 15:59:13 UTC ℹ️ Start processing command /merge

2026-07-28 15:59:18 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

2026-07-28 16:58:05 UTC ❌ MergeQueue: The build pipeline contains failing jobs for this merge request

Build pipeline has failing jobs for 994cfcd:

⚠️ Do NOT retry failed jobs directly (why?).

What to do next?

Investigate the failures and when ready, re-add your pull request to the queue!
If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
Any question, go check the FAQ.

Details

Since those jobs are not marked as being allowed to fail, the pipeline will most likely fail.
Therefore, and to allow other builds to be processed, this merge request has been rejected and the pipeline got canceled.

PerfectSlayer

I would rather have profiling review /ack it before merging to evaluate the impact

vandonr · 2026-07-29T07:43:26Z

I would rather have profiling review /ack it before merging to evaluate the impact

I mean, why not, but really this minor release contains only the fix for the CVE, nothing else, so it's pretty safe to say the impact will be none.

https://github.com/yawkat/lz4-java/releases/tag/v1.11.1

jbachorik

As long as smoke tests are passing, LGTM!

dd-octo-sts · 2026-07-29T07:50:27Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-07-29T07:50:31Z

View all feedbacks in Devflow UI.

2026-07-29 07:50:30 UTC ℹ️ Start processing command /merge

2026-07-29 07:50:35 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

2026-07-29 09:18:07 UTC ℹ️ MergeQueue: This merge request was merged

vandonr added 2 commits July 28, 2026 15:36

bump version in toml file

1b50cff

lockfiles

4be8fb0

vandonr added comp: profiling Profiling type: bug report Bug report labels Jul 28, 2026

vandonr marked this pull request as ready for review July 28, 2026 14:03

vandonr requested review from a team as code owners July 28, 2026 14:03

vandonr requested a review from ygree July 28, 2026 14:03

vandonr changed the title ~~Vandonr patch 1~~ Bump LZ4 version to latest Jul 28, 2026

datadog-datadog-prod-us1 Bot reviewed Jul 28, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Jul 28, 2026

View reviewed changes

bric3 approved these changes Jul 28, 2026

View reviewed changes

vandonr added this pull request to the merge queue Jul 28, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jul 28, 2026

PerfectSlayer reviewed Jul 29, 2026

View reviewed changes

jbachorik approved these changes Jul 29, 2026

View reviewed changes

vandonr added this pull request to the merge queue Jul 29, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jul 29, 2026

gh-worker-dd-mergequeue-cf854d Bot merged commit 97bb5fc into master Jul 29, 2026
592 of 598 checks passed

gh-worker-dd-mergequeue-cf854d Bot deleted the vandonr-patch-1 branch July 29, 2026 09:18

github-actions Bot added this to the 1.65.0 milestone Jul 29, 2026

Uh oh!

Conversation

vandonr commented Jul 28, 2026

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

datadog-datadog-prod-us1 Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

vandonr Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

datadog-datadog-prod-us1 Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dd-octo-sts Bot commented Jul 28, 2026

🟢 Java Benchmark SLOs — All performance SLOs passed

Uh oh!

dd-octo-sts Bot commented Jul 28, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What to do next?

Uh oh!

Uh oh!

PerfectSlayer left a comment

Choose a reason for hiding this comment

Uh oh!

vandonr commented Jul 29, 2026

Uh oh!

jbachorik left a comment

Choose a reason for hiding this comment

Uh oh!

dd-octo-sts Bot commented Jul 29, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

datadog-datadog-prod-us1 Bot commented Jul 28, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Jul 28, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Jul 29, 2026 •

edited

Loading