Bug#1147397: zstd-jni-java: multiple CVEs and upgrading past upstream version 1.5.2-5

[Olek Wojnar]

Hey tony,

On 9/20/26 13:37, tony mancill wrote:
> Hi Olek,
> 
> What needs to happen with the Bazel Build System [1,2] before we can
> upgrade zstd-jni-java to the current upstream version?  Would it help to
> upload 1.5.7-17 to experimental?

Thanks for bringing this to my attention!

I'll check on the dependencies of the current (much newer) version that 
we have in sid. I'm also copying the Debian Bazel Discussion List in 
case anyone on there knows off the top of their head or can find the 
info sooner than I can.

Update: just took a quick peek at the relevant parts of the code and it 
is not obvious to me whether a newer version would work, 1.5.2-3 is 
still what Bazel upstream has pinned [3], Debian uses a SLIGHTLY newer 
version without issues.

> [1] https://sources.debian.org/src/zstd-jni-java/1.5.2-5%2Bds-8/debian/README.source
> [2] https://salsa.debian.org/bazel-team/meta/-/wikis/Bazel-Dependencies

Paul, do you have any insights on this? We don't have a robust enough 
test suite that I'd be comfortable just doing a rebuild and trusting 
that it would work.

Oh, tony, to answer your other question, I see no problem with having 
the newer version in experimental. It looks like 1.5.7-14 is the version 
that fixed these vulnerabilities. Do you know what the code delta is 
between -14 and -17??

Best regards,
-Olek

[3] 
https://salsa.debian.org/bazel-team/bazel-bootstrap/-/blob/main/MODULE.bazel#L22