From 5d874a53e62923364f29a45a796a613a638845c6 Mon Sep 17 00:00:00 2001
From: wwang <WAN@qlik.com>
Date: Tue, 11 Aug 2026 18:14:35 +0800
Subject: [PATCH] fix(QTDI-3238): CVE-2026-59949 at.yawk.lz4:lz4-java 1.11.2

Bump lz4-java from 1.10.4 to 1.11.2 in root pom.xml
dependencyManagement (used by component-runtime-testing-spark,
singer-parent/component-kitap) to fix CVE-2026-59949 (JVM crash
via insufficient byte array validation in JNI-based XXHash
implementations). 1.11.2 also carries the CVE-2025-12183 fix.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index b4557e639ce61..7154a18301870 100644
--- a/pom.xml
+++ b/pom.xml
@@ -913,7 +913,7 @@
       <dependency>
         <groupId>at.yawk.lz4</groupId>
         <artifactId>lz4-java</artifactId>
-        <version>1.10.4</version>
+        <version>1.11.2</version>
       </dependency>
       <dependency>
         <groupId>com.google.protobuf</groupId>