Bug#1147397: zstd-jni-java: multiple CVEs and upgrading past upstream version 1.5.2-5

[Ying-Chun Liu (PaulLiu)]

Hi Olek and Tony,

I think it is ok to just upgrade zstd-jni-java to the latest version. If 
there's anything failed on bazel side, I'll fix it.
Should be not very hard.



Yours,

Paul


On 9/21/26 5:29 AM, Olek Wojnar wrote:
> Hey tony,
>
> On 9/20/26 13:37, tony mancill wrote:
>> Hi Olek,
>>
>> What needs to happen with the Bazel Build System [1,2] before we can
>> upgrade zstd-jni-java to the current upstream version?  Would it help to
>> upload 1.5.7-17 to experimental?
>
> Thanks for bringing this to my attention!
>
> I'll check on the dependencies of the current (much newer) version 
> that we have in sid. I'm also copying the Debian Bazel Discussion List 
> in case anyone on there knows off the top of their head or can find 
> the info sooner than I can.
>
> Update: just took a quick peek at the relevant parts of the code and 
> it is not obvious to me whether a newer version would work, 1.5.2-3 is 
> still what Bazel upstream has pinned [3], Debian uses a SLIGHTLY newer 
> version without issues.
>
>> [1] 
>> https://sources.debian.org/src/zstd-jni-java/1.5.2-5%2Bds-8/debian/README.source
>> [2] https://salsa.debian.org/bazel-team/meta/-/wikis/Bazel-Dependencies
>
> Paul, do you have any insights on this? We don't have a robust enough 
> test suite that I'd be comfortable just doing a rebuild and trusting 
> that it would work.
>
> Oh, tony, to answer your other question, I see no problem with having 
> the newer version in experimental. It looks like 1.5.7-14 is the 
> version that fixed these vulnerabilities. Do you know what the code 
> delta is between -14 and -17??
>
> Best regards,
> -Olek
>
> [3] 
> https://salsa.debian.org/bazel-team/bazel-bootstrap/-/blob/main/MODULE.bazel#L22
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x44173FA13D058888.asc
Type: application/pgp-keys
Size: 7875 bytes
Desc: OpenPGP public key
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20261002/f31e3472/attachment.asc>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20261002/f31e3472/attachment.sig>