[FLINK-39139] Update lz4-java to 1.10.3

[eschcam]

What is the purpose of the change

lz4-java 1.8.0 has the following CVEs:

• CVE-2025-66566
• CVE-2025-12183

It has also been relocated to at.yawk.lz4

Brief change log

• Update lz4-java to 1.10.3

Verifying this change

Passes local tests

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): yes
• The public API, i.e., is any changed class annotated with @Public(Evolving): no
• The serializers: no
• The runtime per-record code paths (performance sensitive): no
• Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
• The S3 file system connector: no

Documentation

• Does this pull request introduce a new feature? no
• If yes, how is the feature documented? not applicable

[flinkbot]

CI report:

• 32d1065 Azure: FAILURE

Bot commands

The @flinkbot bot supports the following commands:

• @flinkbot run azure re-run the last Azure build

[eschcam]

@flinkbot run azure

[Savonitar]

Hi, thanks for removing the vulnerability!
I have one small comment:
could you please also update flink-dist/src/main/resources/META-INF/NOTICE:20 ?

Apart from that, LGTM.

[eschcam]

Hi, thanks for removing the vulnerability! I have one small comment: could you please also update flink-dist/src/main/resources/META-INF/NOTICE:20 ?

Apart from that, LGTM.

Thanks. I missed that.
Resolved

[Savonitar]

LGTM

[pnowojski]

@eschcam and @Savonitar , can you make sure this is backported to at least release 2.2 and release 2.1 branches?

[eschcam]

@eschcam and @Savonitar , can you make sure this is backported to at least release 2.2 and release 2.1 branches?

As requested
2.2: #27644
2.1: #27645

I will try to backport to 2.0, 1.20 & 1.19

[eschcam]

@pnowojski Here are the backports

2.2: #27644
2.1: #27645
2.0: #27646
1.20: #27647
1.19: #27648

[Savonitar]

@eschcam and @Savonitar , can you make sure this is backported to at least release 2.2 and release 2.1 branches?

Done.

[Savonitar]

@eschcam AFAIK there are no plans to release 1.19

[eschcam]

@eschcam AFAIK there are no plans to release 1.19

The only reason I backported to the 1.19 branch is because I noticed another contributor backporting PRs to it

[eschcam]

@Savonitar Is there any reason why #27646 wasn't merged?

[Savonitar]

@eschcam

The only reason I backported to the 1.19 branch is because I noticed another contributor backporting PRs to it

Docs are pushed to the website automatically and don't require us to cut a new official Flink release, whereas bug fixes do.

@Savonitar Is there any reason why #27646 wasn't merged?

We’ve just merged it. Thanks for the fix and the backports!