[dongjoon-hyun]

What changes were proposed in this pull request?

This PR aims to upgrade at.yawk.lz4:lz4-java to 1.12.1.

Why are the changes needed?

To bring the security fix of v1.12.1, which was released as a security release for GHSA-48mj-8f7c-7qfm (severity: low, availability impact only).

• https://github.com/yawkat/lz4-java/releases/tag/v1.12.1 (2026-10-22)
  • LZ4BlockInputStream and LZ4FrameInputStream allocate block buffers from the block header before the block data arrives: the streams now grow their buffers only as block data actually arrives (Allocate stream block buffers only as block data arrives yawkat/lz4-java#167).
  • Throw LZ4Exception for input shorter than the length prefix
  • Bound the compressed length of oversized LZ4 blocks
  • Use the buffer limit for the safe decompress(ByteBuffer, int, ByteBuffer, int)

Note that Apache Spark's LZ4CompressionCodec and Statistics read streams via LZ4BlockInputStream, which is one of the code paths fixed by GHSA-48mj-8f7c-7qfm.

Full Changelog: yawkat/lz4-java@v1.12.0...v1.12.1

Does this PR introduce any user-facing change?

No. There is no behavior change for valid LZ4 streams.

How was this patch tested?

• Regenerated the dependency manifest with dev/test-dependencies.sh --replace-manifest; the only diff is the lz4-java line.
• build/sbt core/compile
• build/sbt 'core/testOnly org.apache.spark.io.CompressionCodecSuite org.apache.spark.shuffle.sort.UnsafeShuffleWriterSuite org.apache.spark.FileSuite org.apache.spark.deploy.history.EventLogFileWritersSuite' (87 tests passed)
• Pass the CIs.

Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Sonnet 5.5

[dongjoon-hyun]

Thank you, @HyukjinKwon !

[dongjoon-hyun]

Merge Summary:

• merged into master 1a2450b

Posted by merge_spark_pr.py