Skip to content

Commit 85a7a2f

Browse files
committed
Bump lz4-java to 1.10.2 for CVE-2025-12183 & CVE-2025-66566 fixes.
1 parent 2f4d3a3 commit 85a7a2f

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

build.gradle

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,9 @@ subprojects {
203203
project.name.startsWith('iceberg-kafka-connect')) {
204204
exclude group: 'org.lz4', module: 'lz4-java'
205205
resolutionStrategy.capabilitiesResolution.withCapability("org.lz4:lz4-java") {
206+
// The ":0" is a Gradle variant selector that matches any version of at.yawk.lz4:lz4-java
207+
// Gradle will automatically resolve to the actual version (1.10.2) defined in libs.versions.toml
208+
// This allows the capability resolution to work without hardcoding the version number here
206209
select("at.yawk.lz4:lz4-java:0")
207210
because("Enforce lz4-java that contains CVE-2025-12183 and CVE-2025-66566 fixes")
208211
}

0 commit comments

Comments
 (0)