Override lz4-java dependency to 1.8.1 for CVE-2025-12183

2026-08-25 07:56:35 +00:00 · 2025-12-09 17:33:56 +09:00
parent 65233a5f56
commit b3a37801dd
1 changed files with 6 additions and 0 deletions
@@ -70,6 +70,12 @@
                <type>pom</type>
                <scope>import</scope>
            </dependency>
+            <!-- Override for CVE‐2025‐12183. This should be removed once kafka-clients updates it. -->
+            <dependency>
+                <groupId>org.lz4</groupId>
+                <artifactId>lz4-java</artifactId>
+                <version>1.8.1</version>
+            </dependency>
        </dependencies>
    </dependencyManagement>
 	<build>