[From nobody Sun Aug 30 22:37:06 2026 Received: (at 1122026-close) by bugs.debian.org; 30 Aug 2026 21:34:23 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,SPF_HELO_PASS,SPF_PASS, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 131; hammy, 150; neutral, 219; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:46014) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x0nAU-00582P-36 for 1122026-close@bugs.debian.org; Sun, 30 Aug 2026 21:34:23 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x0nAT-007Emh-1z for 1122026-close@bugs.debian.org; Sun, 30 Aug 2026 21:34:21 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=zWJMbo6+BShRnR7v9RlBZ/sjJKmBoF8PmE5qjQElWJU=; b=GfE7DoP/2Vt3h92qxW/ZmDDj3O mGIEA0RGjBX+FpppP4FRj204KiVYO6iU4nyzta292/yHbONINHTsBvG4wRb+pI9gy2MGMmg4bpMXo 6MjpHkvyknv171FYdym++I3pOxrmQ2xUH//+odZy5CbtteRbBYbDApuLOGmlh+B5nvVc1EZ2/6OcX 0KVs7AiPCIXwF3opJzvWieWZzLv595SEDEB6g5/znqVod7pEOEmV1o2PSa2zOAFloJZpmaptHZ9sL XSRrKa5wa6eaBpny0QHTYYTnQV5mO7Ou0sgvRdhRhnQfgsOh/OaLad6Uh+Pui3C3fKsfS9oI4WVHK bmK89TEA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1x0nAS-00000002Bfq-33zn; Sun, 30 Aug 2026 21:34:20 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: tony mancill <tmancill@debian.org> To: 1122026-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: lz4-java Debian: DAK Debian-Changes: lz4-java_1.11.2+ds1-1_source.changes Debian-Source: lz4-java Debian-Version: 1.11.2+ds1-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1122026: fixed in lz4-java 1.11.2+ds1-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============2833728788360571911==" Message-Id: <E1x0nAS-00000002Bfq-33zn@fasolo.debian.org> Date: Sun, 30 Aug 2026 21:34:20 +0000 X-CrossAssassin-Score: 2 --===============2833728788360571911== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: lz4-java Source-Version: 1.11.2+ds1-1 Done: tony mancill <tmancill@debian.org> We believe that the bug you reported is fixed in the latest version of lz4-java, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1122026@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. tony mancill <tmancill@debian.org> (supplier of updated lz4-java package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 30 Aug 2026 11:20:00 -0700 Source: lz4-java Architecture: source Version: 1.11.2+ds1-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian= .org> Changed-By: tony mancill <tmancill@debian.org> Closes: 1122026 1145019 Changes: lz4-java (1.11.2+ds1-1) unstable; urgency=3Dmedium . * Migrate to github.com/yawkat/lz4-java/ for upstream * New upstream version 1.11.2 - Addresses CVE-2025-66566, CVE-2025-12183 (Closes: #1122026) - Addresses CVE-2026-59949 (Closes: #1145019) * Freshen years in debian/copyright * Repack upstream tarball (+ds1) to exclude Maven wrapper JAR * liblz4-jni now links liblz4-java.so against liblz4.a instead of liblz4.so. Refer to debian/README.source for rationale. * Declare Static-Built-Using for liblz4-jni to detect when rebuilds/binNMUs are needed. * Refresh and drop unnecessary patches * Update build system to use maven-debian-helper - Add no-git-versioning-extension.patch - Add no-bnd-manifest.patch - Add exclude-fuzz-tests.patch * Enable Maven coordinate relocation for org.lz4:lz4-java * Enable tests during arch package build * Add debian/README.source * Add DEP-12 debian/upstream/metadata * Clean up unused Build-Depends * Remove liblz4-jni.lintian-overrides * Bump Standards-Version to 4.7.4 Checksums-Sha1: 6c7a7e4c50f589ee0d2543cb462465a15206c06c 2336 lz4-java_1.11.2+ds1-1.dsc b246ca7e1c7b81a55c4fe9b92b608686e0169b43 443268 lz4-java_1.11.2+ds1.orig.tar= .xz 30104975b54008791d983fa094a75d936a3f6293 9660 lz4-java_1.11.2+ds1-1.debian.t= ar.xz ad5ec9e2acee373d4b9274ed37410ff0a2448e00 15106 lz4-java_1.11.2+ds1-1_arm64.b= uildinfo Checksums-Sha256: 9226982f038b158ad7e0f5409be4c115c300ffd1741c6e82e1e8ea7c868ea80e 2336 lz4-ja= va_1.11.2+ds1-1.dsc 7f35bc1922cd77fd633d8917de666493c65e8eb349d5054809571b843872c726 443268 lz4-= java_1.11.2+ds1.orig.tar.xz f88092d9ca0f783adb0fd7245ec5256db5834dc50abeaba7404f583a56b60c0c 9660 lz4-ja= va_1.11.2+ds1-1.debian.tar.xz b4de4d155ff4dcbdeaec0548f0d1cc2869739cbe193f08c3c66304599d7224df 15106 lz4-j= ava_1.11.2+ds1-1_arm64.buildinfo Files: f89e9d50ce997d48484acbc9582aafb4 2336 java optional lz4-java_1.11.2+ds1-1.dsc 16572baa719430d8f7b7e5aea6f0db88 443268 java optional lz4-java_1.11.2+ds1.or= ig.tar.xz df3b709f10d36947e1323f7d11da7957 9660 java optional lz4-java_1.11.2+ds1-1.de= bian.tar.xz d88520de53339b128e32c29beedf1129 15106 java optional lz4-java_1.11.2+ds1-1_a= rm64.buildinfo -----BEGIN PGP SIGNATURE----- iQJIBAEBCgAyFiEE5Qr9Va3SequXFjqLIdIFiZdLPpYFAmqUncIUHHRtYW5jaWxs QGRlYmlhbi5vcmcACgkQIdIFiZdLPpYzIA//Qcmtt7RpgTSpP7H9ZbhTPaINoFIY 281gD4nRuZbHb/2y5ahHjdAfTl0UKj0/1RXFAPOpEIejjFbUcZ2TAx1BY5vrcod3 J3+NNDzaB44ReM2/0An/MoOeAohOupaEPu9PNnAqYMbF0myL1Si2IftQ3yRIs7+W EOVcAibEB2iX8YN7tMqX+5hs/FJqwEBuAJDiP6t09YEgQLC0OqYypKaUzCorq7od lEjdhq/a6Y0S+YxKt2f+iUINhkTlQ+M95xHRsQKheKZy+PgvMPxADLKSce+nKsLw AdWjhL/OOmozBJRH+ujsw4F0KCb+GUuCCKS+vrc4/a+gMiaVkbIYZwJ8edfdRC5n tq00AOrw8Wxqc7rLaMMhgN0O89YWovufhrSDkIRlOxFqruOEwjt8SLP6EgC/O4I1 wLl+PPPWrebMK3nfhy42iqxwv9kMGUUyplDRTrmrWiHD2RmBjOAgRig8M+ZGudDO hupkJKHonCGUeDrUxyDIOQxrC12Rz4UfYbFtxtWi9GtxFmhxQW2BW/FmL1v3x1Fj ABx3X+X1B68OMgVqJmzj4HJ8HFGtUI7j9LB6Zzh/U82ZNM5YNemVSmsiR5TIgdr0 Xl01l1bnIiobNEepcntlrBjxsrfiPzdvkaAV95FNWjMJr0xOcTpoMFf5grKGqtGN 0YScadGFqhczgl0=3D =3Dp2ER -----END PGP SIGNATURE----- --===============2833728788360571911== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCapSh3AAKCRCb9qggYcy5 IRhUAQCh7iKyL5BshtvF38dLkQ0Pjti+Qig+jzZIgG4ISQikBwEA+Q3MStsbCUoc A2wYzRKhRYXyBhSK/CBF9VnOmz4VaQA= =rWbG -----END PGP SIGNATURE----- --===============2833728788360571911==-- ]