google / google/ksp

Update `org.lz4:lz4-java` version

Open Beginner friendly
#3,035 3 comments 0 reactions 0 assignees View on GitHub
analysis-api build P4
Dominant language
Kotlin
Stars
3.5k
Forks
415
Avg merge
1d 2h
Merged PRs (30d)
53

Description

`org.lz4:lz4-java:1.8.1` is available on Maven Central:
https://central.sonatype.com/artifact/org.lz4/lz4-java/versions

KSP is using this old version which is flagged for some vulnerabilities.
https://github.com/google/ksp/blob/cd24221649e31d5bcf94d035a0aac6ce61f93788/kotlin-analysis-api/build.gradle.kts#L185

Please upgrade to `org.lz4:lz4-java:1.8.1`

Side note, if you look at the pom for `org.lz4:lz4-java:1.8.1`
https://repo1.maven.org/maven2/org/lz4/lz4-java/1.8.1/lz4-java-1.8.1.pom

you will see:
```xml
org.lz4
lz4-java
1.8.1


at.yawk.lz4

```

So ultimately, we should update to use `at.yawk.lz4` instead, but one step at a time.
https://github.com/yawkat/lz4-java

Contributor guide

Open the contributing guide

Research direction

Open kotlin-analysis-api/build.gradle.kts around line 185, where KSP declares org.lz4:lz4-java. Update the dependency to version 1.8.1, then verify the project resolves the dependency and its build or dependency checks pass. The later at.yawk.lz4 relocation is noted as follow-up work, not part of this issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
build-system, security
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.