From aff568d25b3ae8906c5caa42d9805093d6c2817f Mon Sep 17 00:00:00 2001
From: Polyglot AI <293096396+polyglotAI-bot@users.noreply.github.com>
Date: Thu, 29 Oct 2026 19:39:14 +0000
Subject: [PATCH] build(deps): upgrade brotli4j, lz4-java, Jackson and ASM

Upgrade the dependencies listed in the issue to their latest releases:

- brotli4j (and its native artifacts, e.g. native-linux-x86_64)
  1.12.0 -> 1.24.0, fixes GHSA-x524-jrqf-vwq6
- at.yawk.lz4:lz4-java 1.11.4 -> 1.12.1, fixes GHSA-48mj-8f7c-7qfm
- jackson-databind / jackson-core 2.22.0 -> 2.22.4, fixes
  GHSA-m8xf-2cr7-77ph; examples move to 2.22.4 too
- org.ow2.asm:asm 9.7 -> 9.11.1
- guava is already at the latest release (33.7.2-jre)

All new versions run on Java 8. The v1 compression docs now name
at.yawk.lz4:lz4-java instead of the unmaintained org.lz4:lz4-java:1.8.0.

Implements: https://github.com/ClickHouse/clickhouse-java/issues/3269

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/clickhouse-docs/client.mdx            | 14 +++++------
 docs/client-v2-json-support.md             |  2 +-
 examples/client-v2-json-processors/pom.xml |  2 +-
 examples/client-v2/pom.xml                 |  4 ++--
 examples/jdbc-v2-json-processors/pom.xml   |  2 +-
 history/latest/3269.md                     | 27 ++++++++++++++++++++++
 performance/pom.xml                        |  2 +-
 pom.xml                                    |  8 +++----
 8 files changed, 44 insertions(+), 17 deletions(-)
 create mode 100644 history/latest/3269.md

diff --git a/docs/clickhouse-docs/client.mdx b/docs/clickhouse-docs/client.mdx
index 91c32c137..5b44a771d 100644
--- a/docs/clickhouse-docs/client.mdx
+++ b/docs/clickhouse-docs/client.mdx
@@ -1633,11 +1633,11 @@ The client will by default use LZ4 compression, which requires this dependency:
 <Tab title="Maven">
 
 ```xml
-<!-- https://mvnrepository.com/artifact/org.lz4/lz4-java -->
+<!-- https://mvnrepository.com/artifact/at.yawk.lz4/lz4-java -->
 <dependency>
-    <groupId>org.lz4</groupId>
+    <groupId>at.yawk.lz4</groupId>
     <artifactId>lz4-java</artifactId>
-    <version>1.8.0</version>
+    <version>1.12.1</version>
 </dependency>
 ```
 
@@ -1645,15 +1645,15 @@ The client will by default use LZ4 compression, which requires this dependency:
 <Tab title="Gradle (Kotlin)">
 
 ```kotlin
-// https://mvnrepository.com/artifact/org.lz4/lz4-java
-implementation("org.lz4:lz4-java:1.8.0")
+// https://mvnrepository.com/artifact/at.yawk.lz4/lz4-java
+implementation("at.yawk.lz4:lz4-java:1.12.1")
 ```
 </Tab>
 <Tab title="Gradle">
 
 ```groovy
-// https://mvnrepository.com/artifact/org.lz4/lz4-java
-implementation 'org.lz4:lz4-java:1.8.0'
+// https://mvnrepository.com/artifact/at.yawk.lz4/lz4-java
+implementation 'at.yawk.lz4:lz4-java:1.12.1'
 ```
 
 </Tab>
diff --git a/docs/client-v2-json-support.md b/docs/client-v2-json-support.md
index f630724db..d2efc0700 100644
--- a/docs/client-v2-json-support.md
+++ b/docs/client-v2-json-support.md
@@ -291,7 +291,7 @@ selected factory to their runtime classpath:
 - Gson — `com.google.code.gson:gson`
   (required when using `GsonJsonParserFactory`).
 
-The repository builds against Jackson `2.17.2` and Gson `2.10.1`. The parser
+The repository builds against Jackson `2.22.4` and Gson `2.10.1`. The parser
 implementations rely only on the streaming token API and a single
 `Map<String, Object>` materialization call, so other recent versions of
 either library are expected to be compatible.
diff --git a/examples/client-v2-json-processors/pom.xml b/examples/client-v2-json-processors/pom.xml
index f7dc8d1c4..65331c292 100644
--- a/examples/client-v2-json-processors/pom.xml
+++ b/examples/client-v2-json-processors/pom.xml
@@ -18,7 +18,7 @@
         <maven.compiler.release>17</maven.compiler.release>
 
         <clickhouse-java.version>0.12.0-rc1-SNAPSHOT</clickhouse-java.version>
-        <jackson.version>2.22.3</jackson.version>
+        <jackson.version>2.22.4</jackson.version>
         <gson.version>2.14.0</gson.version>
         <slf4j.version>2.0.17</slf4j.version>
 
diff --git a/examples/client-v2/pom.xml b/examples/client-v2/pom.xml
index c63f0cdeb..ef6c0b65c 100644
--- a/examples/client-v2/pom.xml
+++ b/examples/client-v2/pom.xml
@@ -74,12 +74,12 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-            <version>2.18.11</version>
+            <version>2.22.4</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.18.11</version>
+            <version>2.22.4</version>
         </dependency>
 
         <!-- Popular Alternative to Jackson -->
diff --git a/examples/jdbc-v2-json-processors/pom.xml b/examples/jdbc-v2-json-processors/pom.xml
index 198ea54c2..34eb9fcda 100644
--- a/examples/jdbc-v2-json-processors/pom.xml
+++ b/examples/jdbc-v2-json-processors/pom.xml
@@ -18,7 +18,7 @@
         <maven.compiler.release>17</maven.compiler.release>
 
         <clickhouse-java.version>0.12.0-rc1-SNAPSHOT</clickhouse-java.version>
-        <jackson.version>2.22.3</jackson.version>
+        <jackson.version>2.22.4</jackson.version>
         <gson.version>2.14.0</gson.version>
         <slf4j.version>2.0.17</slf4j.version>
 
diff --git a/history/latest/3269.md b/history/latest/3269.md
new file mode 100644
index 000000000..42030a583
--- /dev/null
+++ b/history/latest/3269.md
@@ -0,0 +1,27 @@
+- **[client-v1, client-v2, jdbc-v1, r2dbc]** Upgraded `at.yawk.lz4:lz4-java` from `1.11.4` to `1.12.1` to fix
+  [GHSA-48mj-8f7c-7qfm](https://github.com/yawkat/lz4-java/security/advisories/GHSA-48mj-8f7c-7qfm). Since `1.12.0` the
+  library validates LZ4 input more strictly: malformed data fails earlier with an exception, and a stream that failed
+  once keeps failing. Valid data is not affected. The v1 compression docs now name `at.yawk.lz4:lz4-java:1.12.1`
+  instead of the unmaintained `org.lz4:lz4-java:1.8.0`.
+  (https://github.com/ClickHouse/clickhouse-java/issues/3269)
+
+- **[client-v1]** Upgraded the optional `com.aayushatharva.brotli4j:brotli4j` dependency and its native artifacts
+  (`native-linux-x86_64` and the others) from `1.12.0` to `1.24.0`. Versions up to `1.23.0` bundle a Brotli decoder with
+  an out-of-bounds write
+  ([GHSA-x524-jrqf-vwq6](https://github.com/hyperxpro/Brotli4j/security/advisories/GHSA-x524-jrqf-vwq6)). brotli4j is
+  not bundled: applications that add it for Brotli compression must upgrade it themselves.
+  (https://github.com/ClickHouse/clickhouse-java/issues/3269)
+
+- **[client-v2, jdbc-v2]** Upgraded `com.fasterxml.jackson.core:jackson-databind` and `jackson-core` from `2.22.0` to
+  `2.22.4` to fix
+  [GHSA-m8xf-2cr7-77ph](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph) and the
+  other advisories fixed in `2.22.1`-`2.22.4`. Jackson is a `provided` dependency: applications that use
+  `JacksonJsonParserFactory` must upgrade their own Jackson. `jackson-annotations` stays at `2.22`, the latest 2.x
+  version.
+  (https://github.com/ClickHouse/clickhouse-java/issues/3269)
+
+- **[client-v2]** Upgraded `org.ow2.asm:asm` from `9.7` to `9.11.1`.
+  (https://github.com/ClickHouse/clickhouse-java/issues/3269)
+
+- **[examples]** Upgraded Jackson in `examples/client-v2` (from `2.18.11`) and in the JSON processor examples (from
+  `2.22.3`) to `2.22.4`. (https://github.com/ClickHouse/clickhouse-java/issues/3269)
diff --git a/performance/pom.xml b/performance/pom.xml
index a8498de1b..8c50b1365 100644
--- a/performance/pom.xml
+++ b/performance/pom.xml
@@ -20,7 +20,7 @@
         <testcontainers.version>2.0.2</testcontainers.version>
         <zstd-jni.version>1.5.7-23</zstd-jni.version>
         <brotli.version>0.1.2</brotli.version>
-        <brotli4j.version>1.12.0</brotli4j.version>
+        <brotli4j.version>1.24.0</brotli4j.version>
 
         <antrun-plugin.version>3.1.0</antrun-plugin.version>
         <assembly-plugin.version>3.6.0</assembly-plugin.version>
diff --git a/pom.xml b/pom.xml
index c9c0bd43e..10b82f3cd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -81,10 +81,10 @@
         <annotations-api.version>6.0.53</annotations-api.version>
         <apache.httpclient.version>5.6.4</apache.httpclient.version>
         <arrow.version>12.0.1</arrow.version>
-        <asm.version>9.7</asm.version>
+        <asm.version>9.11.1</asm.version>
         <avro.version>1.11.4</avro.version>
         <brotli.version>0.1.2</brotli.version>
-        <brotli4j.version>1.12.0</brotli4j.version>
+        <brotli4j.version>1.24.0</brotli4j.version>
         <caffeine.version>3.1.7</caffeine.version>
         <compress.version>1.28.0</compress.version>
         <commons-lang3.version>3.20.0</commons-lang3.version>
@@ -96,7 +96,7 @@
         <opencensus.version>0.31.1</opencensus.version>
         <opentelemetry.version>1.51.0</opentelemetry.version>
         <protobuf.version>3.23.4</protobuf.version>
-        <lz4.version>1.11.4</lz4.version>
+        <lz4.version>1.12.1</lz4.version>
         <msgpack.version>0.9.5</msgpack.version>
         <roaring-bitmap.version>1.0.6</roaring-bitmap.version>
         <slf4j.version>2.0.7</slf4j.version>
@@ -146,7 +146,7 @@
         <jmh.version>1.37</jmh.version>
         <guava.version>33.7.2-jre</guava.version>
         <sonar.publish-pluing.version>0.8.0</sonar.publish-pluing.version>
-        <jackson.version>2.22.0</jackson.version>
+        <jackson.version>2.22.4</jackson.version>
         <jackson.version.annotations>2.22</jackson.version.annotations>
 
         <minTargetJdk>1.8</minTargetJdk>