Update `org.lz4:lz4-java` version
- Dominant language
- Kotlin
- Stars
- 3.5k
- Forks
- 415
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 53
Description
`org.lz4:lz4-java:1.8.1` is available on Maven Central:
https://central.sonatype.com/artifact/org.lz4/lz4-java/versions
KSP is using this old version which is flagged for some vulnerabilities.
https://github.com/google/ksp/blob/cd24221649e31d5bcf94d035a0aac6ce61f93788/kotlin-analysis-api/build.gradle.kts#L185
Please upgrade to `org.lz4:lz4-java:1.8.1`
Side note, if you look at the pom for `org.lz4:lz4-java:1.8.1`
https://repo1.maven.org/maven2/org/lz4/lz4-java/1.8.1/lz4-java-1.8.1.pom
you will see:
```xml
org.lz4
lz4-java
1.8.1
at.yawk.lz4
```
So ultimately, we should update to use `at.yawk.lz4` instead, but one step at a time.
https://github.com/yawkat/lz4-java
Contributor guide
Research direction
Open kotlin-analysis-api/build.gradle.kts around line 185, where KSP declares org.lz4:lz4-java. Update the dependency to version 1.8.1, then verify the project resolves the dependency and its build or dependency checks pass. The later at.yawk.lz4 relocation is noted as follow-up work, not part of this issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 74/100