From b3a37801ddb04d1c9752527223da3ea7dcc2bb01 Mon Sep 17 00:00:00 2001
From: Alex Osborne <aosborne@nla.gov.au>
Date: Tue, 9 Dec 2025 17:32:44 +0900
Subject: [PATCH] Override lz4-java dependency to 1.8.1 for CVE-2025-12183

---
 contrib/pom.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/contrib/pom.xml b/contrib/pom.xml
index 19f3b51f..f193ebac 100644
--- a/contrib/pom.xml
+++ b/contrib/pom.xml
@@ -70,6 +70,12 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- Override for CVE‐2025‐12183. This should be removed once kafka-clients updates it. -->
+            <dependency>
+                <groupId>org.lz4</groupId>
+                <artifactId>lz4-java</artifactId>
+                <version>1.8.1</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 	<build>