build(deps): upgrade brotli4j, lz4-java, Jackson and ASM

docs/clickhouse-docs/client.mdx

@@ -1633,27 +1633,27 @@ The client will by default use LZ4 compression, which requires this dependency:
 <Tab title="Maven">
 
 ```xml
-<!-- https://mvnrepository.com/artifact/org.lz4/lz4-java -->
+<!-- https://mvnrepository.com/artifact/at.yawk.lz4/lz4-java -->
 <dependency>
-    <groupId>org.lz4</groupId>
+    <groupId>at.yawk.lz4</groupId>
     <artifactId>lz4-java</artifactId>
-    <version>1.8.0</version>
+    <version>1.12.1</version>
 </dependency>
 ```
 
 </Tab>
 <Tab title="Gradle (Kotlin)">
 
 ```kotlin
-// https://mvnrepository.com/artifact/org.lz4/lz4-java
-implementation("org.lz4:lz4-java:1.8.0")
+// https://mvnrepository.com/artifact/at.yawk.lz4/lz4-java
+implementation("at.yawk.lz4:lz4-java:1.12.1")
 ```
 </Tab>
 <Tab title="Gradle">
 
 ```groovy
-// https://mvnrepository.com/artifact/org.lz4/lz4-java
-implementation 'org.lz4:lz4-java:1.8.0'
+// https://mvnrepository.com/artifact/at.yawk.lz4/lz4-java
+implementation 'at.yawk.lz4:lz4-java:1.12.1'
 ```
 
 </Tab>

docs/client-v2-json-support.md

@@ -291,7 +291,7 @@ selected factory to their runtime classpath:
 - Gson — `com.google.code.gson:gson`
   (required when using `GsonJsonParserFactory`).
 
-The repository builds against Jackson `2.17.2` and Gson `2.10.1`. The parser
+The repository builds against Jackson `2.22.4` and Gson `2.10.1`. The parser
 implementations rely only on the streaming token API and a single
 `Map<String, Object>` materialization call, so other recent versions of
 either library are expected to be compatible.

examples/client-v2-json-processors/pom.xml

@@ -18,7 +18,7 @@
         <maven.compiler.release>17</maven.compiler.release>
 
         <clickhouse-java.version>0.12.0-rc1-SNAPSHOT</clickhouse-java.version>
-        <jackson.version>2.22.3</jackson.version>
+        <jackson.version>2.22.4</jackson.version>
         <gson.version>2.14.0</gson.version>
         <slf4j.version>2.0.17</slf4j.version>
 

examples/client-v2/pom.xml

@@ -74,12 +74,12 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-            <version>2.18.11</version>
+            <version>2.22.4</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.18.11</version>
+            <version>2.22.4</version>
         </dependency>
 
         <!-- Popular Alternative to Jackson -->

examples/jdbc-v2-json-processors/pom.xml

@@ -18,7 +18,7 @@
         <maven.compiler.release>17</maven.compiler.release>
 
         <clickhouse-java.version>0.12.0-rc1-SNAPSHOT</clickhouse-java.version>
-        <jackson.version>2.22.3</jackson.version>
+        <jackson.version>2.22.4</jackson.version>
         <gson.version>2.14.0</gson.version>
         <slf4j.version>2.0.17</slf4j.version>
 

history/latest/3269.md

@@ -0,0 +1,27 @@
+- **[client-v1, client-v2, jdbc-v1, r2dbc]** Upgraded `at.yawk.lz4:lz4-java` from `1.11.4` to `1.12.1` to fix
+  [GHSA-48mj-8f7c-7qfm](https://github.com/yawkat/lz4-java/security/advisories/GHSA-48mj-8f7c-7qfm). Since `1.12.0` the
+  library validates LZ4 input more strictly: malformed data fails earlier with an exception, and a stream that failed
+  once keeps failing. Valid data is not affected. The v1 compression docs now name `at.yawk.lz4:lz4-java:1.12.1`
+  instead of the unmaintained `org.lz4:lz4-java:1.8.0`.
+  (https://github.com/ClickHouse/clickhouse-java/issues/3269)
+
+- **[client-v1]** Upgraded the optional `com.aayushatharva.brotli4j:brotli4j` dependency and its native artifacts
+  (`native-linux-x86_64` and the others) from `1.12.0` to `1.24.0`. Versions up to `1.23.0` bundle a Brotli decoder with
+  an out-of-bounds write
+  ([GHSA-x524-jrqf-vwq6](https://github.com/hyperxpro/Brotli4j/security/advisories/GHSA-x524-jrqf-vwq6)). brotli4j is
+  not bundled: applications that add it for Brotli compression must upgrade it themselves.
+  (https://github.com/ClickHouse/clickhouse-java/issues/3269)
+
+- **[client-v2, jdbc-v2]** Upgraded `com.fasterxml.jackson.core:jackson-databind` and `jackson-core` from `2.22.0` to
+  `2.22.4` to fix
+  [GHSA-m8xf-2cr7-77ph](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph) and the
+  other advisories fixed in `2.22.1`-`2.22.4`. Jackson is a `provided` dependency: applications that use
+  `JacksonJsonParserFactory` must upgrade their own Jackson. `jackson-annotations` stays at `2.22`, the latest 2.x
+  version.
+  (https://github.com/ClickHouse/clickhouse-java/issues/3269)
+
+- **[client-v2]** Upgraded `org.ow2.asm:asm` from `9.7` to `9.11.1`.
+  (https://github.com/ClickHouse/clickhouse-java/issues/3269)
+
+- **[examples]** Upgraded Jackson in `examples/client-v2` (from `2.18.11`) and in the JSON processor examples (from
+  `2.22.3`) to `2.22.4`. (https://github.com/ClickHouse/clickhouse-java/issues/3269)

performance/pom.xml

@@ -20,7 +20,7 @@
         <testcontainers.version>2.0.2</testcontainers.version>
         <zstd-jni.version>1.5.7-23</zstd-jni.version>
         <brotli.version>0.1.2</brotli.version>
-        <brotli4j.version>1.12.0</brotli4j.version>
+        <brotli4j.version>1.24.0</brotli4j.version>
 
         <antrun-plugin.version>3.1.0</antrun-plugin.version>
         <assembly-plugin.version>3.6.0</assembly-plugin.version>

pom.xml

@@ -81,10 +81,10 @@
         <annotations-api.version>6.0.53</annotations-api.version>
         <apache.httpclient.version>5.6.4</apache.httpclient.version>
         <arrow.version>12.0.1</arrow.version>
-        <asm.version>9.7</asm.version>
+        <asm.version>9.11.1</asm.version>
         <avro.version>1.11.4</avro.version>
         <brotli.version>0.1.2</brotli.version>
-        <brotli4j.version>1.12.0</brotli4j.version>
+        <brotli4j.version>1.24.0</brotli4j.version>
         <caffeine.version>3.1.7</caffeine.version>
         <compress.version>1.28.0</compress.version>
         <commons-lang3.version>3.20.0</commons-lang3.version>
@@ -96,7 +96,7 @@
         <opencensus.version>0.31.1</opencensus.version>
         <opentelemetry.version>1.51.0</opentelemetry.version>
         <protobuf.version>3.23.4</protobuf.version>
-        <lz4.version>1.11.4</lz4.version>
+        <lz4.version>1.12.1</lz4.version>
         <msgpack.version>0.9.5</msgpack.version>
         <roaring-bitmap.version>1.0.6</roaring-bitmap.version>
         <slf4j.version>2.0.7</slf4j.version>
@@ -146,7 +146,7 @@
         <jmh.version>1.37</jmh.version>
         <guava.version>33.7.2-jre</guava.version>
         <sonar.publish-pluing.version>0.8.0</sonar.publish-pluing.version>
-        <jackson.version>2.22.0</jackson.version>
+        <jackson.version>2.22.4</jackson.version>
         <jackson.version.annotations>2.22</jackson.version.annotations>
 
         <minTargetJdk>1.8</minTargetJdk>