Skip to content

Bump LZ4 version to latest #12091

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vandonr wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Bump LZ4 version to latest #12091

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1b50cff
bump version in toml file
vandonr Jul 28, 2026
4be8fb0
lockfiles
vandonr Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion dd-java-agent/agent-profiling/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# Manual edits can break the build and are not advised.
# This file is expected to be part of source control.
# To regenerate this file, run: ./gradlew :dd-java-agent:agent-profiling:dependencies --write-locks
at.yawk.lz4:lz4-java:1.11.0=runtimeClasspath,testRuntimeClasspath
at.yawk.lz4:lz4-java:1.11.1=runtimeClasspath,testRuntimeClasspath
cafe.cryptography:curve25519-elisabeth:0.1.0=runtimeClasspath,testRuntimeClasspath
cafe.cryptography:ed25519-elisabeth:0.1.0=runtimeClasspath,testRuntimeClasspath
ch.qos.logback:logback-classic:1.2.13=testCompileClasspath,testRuntimeClasspath
Expand Down
2 changes: 1 addition & 1 deletion dd-java-agent/agent-profiling/profiling-controller-ddprof/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# Manual edits can break the build and are not advised.
# This file is expected to be part of source control.
# To regenerate this file, run: ./gradlew :dd-java-agent:agent-profiling:profiling-controller-ddprof:dependencies --write-locks
at.yawk.lz4:lz4-java:1.11.0=testRuntimeClasspath
at.yawk.lz4:lz4-java:1.11.1=testRuntimeClasspath
cafe.cryptography:curve25519-elisabeth:0.1.0=testRuntimeClasspath
cafe.cryptography:ed25519-elisabeth:0.1.0=testRuntimeClasspath
ch.qos.logback:logback-classic:1.2.13=testCompileClasspath,testRuntimeClasspath
Expand Down
2 changes: 1 addition & 1 deletion dd-java-agent/agent-profiling/profiling-controller-openjdk/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# Manual edits can break the build and are not advised.
# This file is expected to be part of source control.
# To regenerate this file, run: ./gradlew :dd-java-agent:agent-profiling:profiling-controller-openjdk:dependencies --write-locks
at.yawk.lz4:lz4-java:1.11.0=testRuntimeClasspath
at.yawk.lz4:lz4-java:1.11.1=testRuntimeClasspath
cafe.cryptography:curve25519-elisabeth:0.1.0=testRuntimeClasspath
cafe.cryptography:ed25519-elisabeth:0.1.0=testRuntimeClasspath
ch.qos.logback:logback-classic:1.2.13=testCompileClasspath,testRuntimeClasspath
Expand Down
2 changes: 1 addition & 1 deletion dd-java-agent/agent-profiling/profiling-controller-oracle/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# Manual edits can break the build and are not advised.
# This file is expected to be part of source control.
# To regenerate this file, run: ./gradlew :dd-java-agent:agent-profiling:profiling-controller-oracle:dependencies --write-locks
at.yawk.lz4:lz4-java:1.11.0=testRuntimeClasspath
at.yawk.lz4:lz4-java:1.11.1=testRuntimeClasspath
cafe.cryptography:curve25519-elisabeth:0.1.0=testRuntimeClasspath
cafe.cryptography:ed25519-elisabeth:0.1.0=testRuntimeClasspath
ch.qos.logback:logback-classic:1.2.13=testCompileClasspath,testRuntimeClasspath
Expand Down
2 changes: 1 addition & 1 deletion dd-java-agent/agent-profiling/profiling-uploader/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# Manual edits can break the build and are not advised.
# This file is expected to be part of source control.
# To regenerate this file, run: ./gradlew :dd-java-agent:agent-profiling:profiling-uploader:dependencies --write-locks
at.yawk.lz4:lz4-java:1.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
at.yawk.lz4:lz4-java:1.11.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
cafe.cryptography:curve25519-elisabeth:0.1.0=runtimeClasspath,testRuntimeClasspath
cafe.cryptography:ed25519-elisabeth:0.1.0=runtimeClasspath,testRuntimeClasspath
ch.qos.logback:logback-classic:1.2.13=testCompileClasspath,testRuntimeClasspath
Expand Down
2 changes: 1 addition & 1 deletion dd-java-agent/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# Manual edits can break the build and are not advised.
# This file is expected to be part of source control.
# To regenerate this file, run: ./gradlew :dd-java-agent:dependencies --write-locks
at.yawk.lz4:lz4-java:1.11.0=sharedShadowInclude
at.yawk.lz4:lz4-java:1.11.1=sharedShadowInclude
cafe.cryptography:curve25519-elisabeth:0.1.0=sharedShadowInclude,testRuntimeClasspath,traceShadowInclude
cafe.cryptography:ed25519-elisabeth:0.1.0=sharedShadowInclude,testRuntimeClasspath,traceShadowInclude
ch.qos.logback:logback-classic:1.2.13=testCompileClasspath,testRuntimeClasspath
Expand Down
2 changes: 1 addition & 1 deletion dd-smoke-tests/profiling-integration-tests/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# Manual edits can break the build and are not advised.
# This file is expected to be part of source control.
# To regenerate this file, run: ./gradlew :dd-smoke-tests:profiling-integration-tests:dependencies --write-locks
at.yawk.lz4:lz4-java:1.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
at.yawk.lz4:lz4-java:1.11.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
cafe.cryptography:curve25519-elisabeth:0.1.0=testRuntimeClasspath
cafe.cryptography:ed25519-elisabeth:0.1.0=testRuntimeClasspath
ch.qos.logback:logback-classic:1.2.13=testCompileClasspath,testRuntimeClasspath
Expand Down
2 changes: 1 addition & 1 deletion gradle/libs.versions.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ commons = "3.2"
guava = "33.6.0-jre"
javaparser = "3.28.2"
jctools = "4.0.6"
lz4 = "1.11.0"
lz4 = "1.11.1"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Regenerate the remaining LZ4 lock

The repo-wide lockfile search still finds at.yawk.lz4:lz4-java:1.11.0 in dd-java-agent/instrumentation/play/play-appsec-2.7/gradle.lockfile:6 for its test* and latestDepTest* configurations. Because this repository commits per-project dependency locks, the checked-in dependency state—and any lockfile-based CVE reporting—continues to include the vulnerable version despite this catalog bump; regenerate that module's lockfile as part of the update.

Useful? React with 👍 / 👎.

@vandonr vandonr Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no biggie for tests

re2j = "1.8"

# Logging
Expand Down
Loading