fix: remove vulnerable legacy LZ4 dependency

[FrankChen021]

Summary

• remove the vulnerable legacy org.lz4:lz4-java 1.8.1 dependency management entry
• exclude remaining legacy org.lz4 transitives from the Confluent Avro/Protobuf and Rabbit stream-client dependency paths
• retain the maintained relocated at.yawk.lz4:lz4-java dependency
• remove the obsolete org.lz4 license inventory entry

Why

Dependabot alerts #472 and #741 report vulnerabilities in org.lz4:lz4-java 1.8.1. There is no patched release under those coordinates. Druid already uses the maintained relocated artifact, but several third-party paths could still introduce the legacy coordinates.

Impact

The reactor dependency graph no longer contains org.lz4:lz4-java. LZ4 functionality continues through at.yawk.lz4:lz4-java 1.11.1.

Validation

• complete reactor dependency tree filtered for org.lz4:lz4-java is clean
• focused dependency trees resolve only at.yawk.lz4:lz4-java 1.11.1
• Avro extension tests: 45 passed
• Protobuf extension tests: 40 passed
• Rabbit stream indexing tests: 38 passed
• generated Avro and Protobuf license reports pass
• git diff --check passes

The full Apache release workflow was not completed because its nested report requires installed snapshot modules and the default Python environment lacks PyYAML.

[Copilot]

Pull request overview

This PR removes the vulnerable legacy org.lz4:lz4-java coordinates from the build while preserving LZ4 support via the maintained relocated at.yawk.lz4:lz4-java dependency, and updates affected extensions to prevent legacy transitives from re-entering the reactor dependency graph.

Changes:

• Removed the legacy org.lz4:lz4-java:1.8.1 dependency management entry from the root pom.xml.
• Added targeted Maven exclusions for org.lz4:lz4-java in Avro, Protobuf, and Rabbit stream extension dependency paths.
• Removed the obsolete legacy org.lz4 license inventory entry, retaining the at.yawk.lz4 entry.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pom.xml	Drops legacy org.lz4:lz4-java management while keeping at.yawk.lz4:lz4-java managed.
licenses.yaml	Removes license inventory entry for the legacy org.lz4 coordinates; keeps the relocated artifact entry.
extensions-core/protobuf-extensions/pom.xml	Excludes org.lz4:lz4-java from Confluent dependency path.
extensions-core/avro-extensions/pom.xml	Excludes org.lz4:lz4-java from Confluent dependency path.
extensions-contrib/rabbit-stream-indexing-service/pom.xml	Excludes org.lz4:lz4-java from RabbitMQ stream-client transitives.

Comments suppressed due to low confidence (1)

pom.xml:993

• PR description references Dependabot alerts as “#472” and “#741”, which GitHub auto-links to Issue #472 and PR #741 (both unrelated to LZ4) per the metadata. This makes the rationale/traceability misleading; consider updating the PR description to reference the actual security advisory identifiers (e.g., GHSA/CVE) or the correct Dependabot alert URLs/IDs instead of bare “#” numbers.

            <dependency>
                <groupId>at.yawk.lz4</groupId>
                <artifactId>lz4-java</artifactId>
                <version>1.11.1</version>
            </dependency>

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[FrankChen021]

The failing KafkaIndexFaultToleranceTest.test_supervisorRecovers_afterChangeInTopicPartitions appears to be an unrelated flaky-test failure caused by publishing before newly added partitions are ready. PR #19817 waits for the expanded partition set and for non-transactional producer sends to complete.

[FrankChen021]

I have reviewed the code for correctness, edge cases, concurrency, and integration risks; no issues found.

Reviewed 5 of 5 changed files.

---

This is an automated review by Codex GPT-5.6-Sol