[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
at.yawk.lz4:lz4-java	1.11.4 → 1.12.1

---

Release Notes

yawkat/lz4-java (at.yawk.lz4:lz4-java)

v1.12.1: lz4-java v1.12.1

Compare Source

Security release for GHSA-48mj-8f7c-7qfm.

What's Changed

• Update dependency me.qoomon:maven-git-versioning-extension to v9.12.3 by @​renovate[bot] in #​152
• Update dependency maven to v3.10.0 by @​renovate[bot] in #​153
• Update github/codeql-action action to v4.38.3 by @​renovate[bot] in #​156
• Update dependency org.sonatype.central:central-publishing-maven-plugin to v0.12.0 by @​renovate[bot] in #​159
• Update ossf/scorecard-action action to v2.5.0 by @​renovate[bot] in #​158
• Update astral-sh/setup-uv action to v10.3.0 by @​renovate[bot] in #​157
• Update actions/upload-artifact digest to cf430e0 by @​renovate[bot] in #​155
• Update actions/setup-java action to v6 by @​renovate[bot] in #​87
• Update actions/download-artifact digest to 9000827 by @​renovate[bot] in #​154
• Throw LZ4Exception for input shorter than the length prefix by @​yawkat in #​160
• Bound the compressed length of oversized LZ4 blocks by @​yawkat in #​162
• Update github/codeql-action action to v4.39.0 by @​renovate[bot] in #​163
• Use the buffer limit for the safe decompress(ByteBuffer, int, ByteBuffer, int) by @​yawkat in #​161
• Allocate stream block buffers only as block data arrives by @​yawkat in #​167
• Update astral-sh/setup-uv action to v10.3.1 by @​renovate[bot] in #​166
• Update github/codeql-action action to v4.39.1 by @​renovate[bot] in #​165
• Update dependency org.mvel:mvel2 to v2.6.0.Final by @​renovate[bot] in #​164

Full Changelog: yawkat/lz4-java@v1.12.0...v1.12.1

v1.12.0: lz4-java v1.12.0

Compare Source

Note that lz4-java v1.11.4, also released today, contains security fixes. This minor release contains some additional tightening of input validation that could in theory be breaking but should be fine for most if not all users. I recommend you upgrade to 1.12.0, but 1.11.4 is an option if that breaks.

What's Changed

• Render README tables on the website by @​yawkat in #​150
• Throw IOException for invalid or unsupported frame descriptors by @​yawkat in #​133
• Replace Codecov with a coverage badge from the documentation site by @​yawkat in #​151
• Reject short output in LZ4DecompressorWithLength safe paths by @​yawkat in #​126
• Make stream failures sticky in LZ4FrameInputStream and LZ4BlockInputStream by @​yawkat in #​145

Full Changelog: yawkat/lz4-java@v1.11.4...v1.12.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The parent POM updates the managed lz4-java dependency from version 1.11.4 to 1.12.1.

Possibly related issues

• Merge upstream apache/cassandra-java-driver 4.19.3 and 4.19.4 #1255 — The issue describes an upstream LZ4 version conflict involving the fork’s pin. This change updates that same pin.

Possibly related PRs

• scylladb/java-driver#1291 — That PR updates the documented lz4-java version to 1.11.4; this PR changes the managed version to 1.12.1.

Suggested reviewers: dkropachev, nikagra

Priority: Not assessed

Change: Other

Merge Risk: Minimal · up to 8665b

No actionable merge-blocking risk was identified.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

OSV Scanner (2.6.0)

pom.xml

OSV Scanner exited with code 128 without a usable report

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.85%. Comparing base (2731403) to head (8665b3f).
⚠️ Report is 3 commits behind head on scylla-4.x.

Additional details and impacted files

@@               Coverage Diff                @@
##             scylla-4.x    #1332      +/-   ##
================================================
+ Coverage         84.83%   84.85%   +0.01%     
- Complexity         8639     8646       +7     
================================================
  Files               851      851              
  Lines             31056    31056              
  Branches           4282     4282              
================================================
+ Hits              26346    26352       +6     
+ Misses             4710     4704       -6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.