Repository navigation
build(deps): upgrade brotli4j, lz4-java, Jackson and ASM - #3272
Merged
Merged
Conversation
Upgrade the dependencies listed in the issue to their latest releases: - brotli4j (and its native artifacts, e.g. native-linux-x86_64) 1.12.0 -> 1.24.0, fixes GHSA-x524-jrqf-vwq6 - at.yawk.lz4:lz4-java 1.11.4 -> 1.12.1, fixes GHSA-48mj-8f7c-7qfm - jackson-databind / jackson-core 2.22.0 -> 2.22.4, fixes GHSA-m8xf-2cr7-77ph; examples move to 2.22.4 too - org.ow2.asm:asm 9.7 -> 9.11.1 - guava is already at the latest release (33.7.2-jre) All new versions run on Java 8. The v1 compression docs now name at.yawk.lz4:lz4-java instead of the unmaintained org.lz4:lz4-java:1.8.0. Implements: #3269 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Client V2 CoverageCoverage Report
Class Coverage
|
JDBC V2 CoverageCoverage Report
Class Coverage
|
JDBC V1 CoverageCoverage Report
Class Coverage
|
Client V1 CoverageCoverage Report
Class Coverage
|
chernser
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Implements #3269.
Upgrades the dependencies listed in the issue to their latest releases. Each new version is in the same major line, and all of them still run on Java 8. Three of the upgrades fix published security advisories.
com.aayushatharva.brotli4j:brotli4j+ native artifacts (native-linux-x86_64, …)1.12.01.24.0<= 1.23.0incl.native-linux-x86_64at.yawk.lz4:lz4-java1.11.41.12.1<= 1.12.0jackson-databind,jackson-core(+jackson-dataformat-yaml, test scope)2.22.02.22.4<= 2.22.3) + the other advisories fixed in2.22.1–2.22.4org.ow2.asm:asm9.79.11.1com.google.guava:guava33.7.2-jremainjackson-annotationsstays at2.22, the latest 2.x release (since 2.20, annotations have no patch versions).Changes
pom.xml:asm.version,brotli4j.version(this property also sets the managednative-*artifacts),lz4.version,jackson.version.performance/pom.xml(standalone JMH project with its own property):brotli4j.version1.12.0→1.24.0.examples/client-v2/pom.xml:jackson-core/jackson-databind2.18.11→2.22.4.examples/client-v2-json-processors/pom.xml,examples/jdbc-v2-json-processors/pom.xml:jackson.version2.22.3→2.22.4. Both old versions are affected by GHSA-m8xf-2cr7-77ph.docs/clickhouse-docs/client.mdx(v1 compression section): the LZ4 snippets told users to addorg.lz4:lz4-java:1.8.0. That group is unmaintained, and GHSA-48mj-8f7c-7qfm lists all its versions as affected with no fix. The snippets now nameat.yawk.lz4:lz4-java:1.12.1, the artifact this project builds and tests against.docs/client-v2-json-support.md: the stated Jackson build version2.17.2→2.22.4.history/latest/3269.md: changelog entry.Not changed:
examples/r2dbc/clickhouse-r2dbc-spring-webflux-samplepinsjackson-datatype-jsr3102.17.1next to Spring Boot2.7.18. To upgrade it, the Spring Boot line must be checked too, which is a separate change.Compatibility
module-info; lz4-java: 51). brotli4j'snative-linux-x86_64still needs onlyGLIBC_2.6, as in1.12.0.BrotliSupportusesBrotli4jLoader,Encoder.Parameters#setQuality,BrotliOutputStreamandBrotliInputStream. These are unchanged, and the project compiles without code changes.1.12.x: validates its input more strictly, so malformed LZ4 data fails earlier with an exception (see the 1.12.0 release notes). Valid data behaves the same. All LZ4 tests below pass.lz4-javaandasmare compile dependencies ofclient-v2(lz4-javaalso ofclickhouse-jdbcandclickhouse-r2dbc), so users get them with the next release. brotli4j isoptional, and Jackson isprovidedinclient-v2/jdbc-v2: applications that add them must upgrade them themselves. The changelog says so.docs/features.mdchange.Test
All in the devbox (JDK 17 build, Java 8 target, ClickHouse 26.9.1):
mvn -DskipTests installof the full reactor (including thepackages/clickhouse-jdbc-allshading): success.mvn compileofexamples/client-v2,examples/client-v2-json-processors,examples/jdbc-v2-json-processorsandperformance/against the installed snapshot: success. They resolve Jackson2.22.4and brotli4j1.24.0.mvn dependency:treeonclickhouse-data,clickhouse-http-client,client-v2,jdbc-v2,clickhouse-jdbc,clickhouse-r2dbc: every module resolvesbrotli4j/native-linux-x86_641.24.0,lz4-java1.12.1,asm9.11.1,jackson-*2.22.4,guava33.7.2-jre.clickhouse-data(1691),clickhouse-http-client(26),client-v2(808),jdbc-v2(1963): 0 failures.client-v2integration testsInsertTests(POJO serializers generated with ASM),InsertClientContentLZ4CompressionTests,InsertClientHttpCompressionTests,QueryServerContentLZ4CompressionTests,QueryServerHttpCompressionTests,JacksonJSONEachRowFormatReaderTests: 347 / 348 pass. The one failure,testInsertAndReadBackWithSecureConnection, connects to a hard-codedhttps://localhost. That address is not the server in this test environment (Connection refused), so the failure is not related to this change.clickhouse-http-clientintegration testClickHouseHttpClientTest: 186 / 188 pass, including all 44 compression cases.testDecompressResponsereads brotli- and LZ4-compressed server responses. The 2 failures are the SSL client-auth tests (Unsupported or unrecognized SSL message), caused by this environment's port setup and not related to this change.ClickHouseCompressionAlgorithm.of(BROTLI)on Java 8 and Java 17: brotli4j1.24.0loads its native library (BrotliSupport$PreferredImplis selected, not the fallback), and levels -1 / 0 / 4 / 11 round-trip. The LZ4 round trip passes too.Pre-PR validation gate
history/latest/3269.md)AGENTS.mdanddocs/changes_checklist.md(no config/default/API changes. CI workflows not touched)🤖 Generated with Claude Code
Note
Medium Risk
Touches compression and JSON parsing paths used in production traffic; lz4-java 1.12.x rejects malformed streams more aggressively, and optional brotli4j/Jackson fixes require downstream apps to upgrade separately.
Overview
Bumps managed dependency versions across the reactor (root
pom.xmland aligned example/performance POMs) to address published security advisories and stay on supported artifacts, with no application code changes.Security-driven upgrades:
at.yawk.lz4:lz4-java1.11.4 → 1.12.1 (GHSA-48mj-8f7c-7qfm; stricter validation of malformed LZ4 input), optionalbrotli4jand native artifacts 1.12.0 → 1.24.0 (GHSA-x524-jrqf-vwq6), and Jacksonjackson-core/jackson-databind2.22.0 → 2.22.4 (GHSA-m8xf-2cr7-77ph and related 2.22.x fixes).org.ow2.asm:asmis bumped 9.7 → 9.11.1 for client-v2 POJO serialization.Docs and release notes: v1 compression docs now recommend
at.yawk.lz4:lz4-java:1.12.1instead of unmaintainedorg.lz4:lz4-java:1.8.0; JSON support docs and examples reflect Jackson 2.22.4. Changelog entry added inhistory/latest/3269.md, noting that brotli4j and Jackson remain optional/provided—apps that add them must upgrade their own copies.Reviewed by Cursor Bugbot for commit aff568d. Bugbot is set up for automated code reviews on this repo. Configure here.