Thank you for your contribution to Debian.
Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 30 Aug 2026 11:20:00 -0700 Source: lz4-java Architecture: source Version: 1.11.2+ds1-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <[email protected]> Changed-By: tony mancill <[email protected]> Closes: 1122026 1145019 Changes: lz4-java (1.11.2+ds1-1) unstable; urgency=medium . * Migrate to github.com/yawkat/lz4-java/ for upstream * New upstream version 1.11.2 - Addresses CVE-2025-66566, CVE-2025-12183 (Closes: #1122026) - Addresses CVE-2026-59949 (Closes: #1145019) * Freshen years in debian/copyright * Repack upstream tarball (+ds1) to exclude Maven wrapper JAR * liblz4-jni now links liblz4-java.so against liblz4.a instead of liblz4.so. Refer to debian/README.source for rationale. * Declare Static-Built-Using for liblz4-jni to detect when rebuilds/binNMUs are needed. * Refresh and drop unnecessary patches * Update build system to use maven-debian-helper - Add no-git-versioning-extension.patch - Add no-bnd-manifest.patch - Add exclude-fuzz-tests.patch * Enable Maven coordinate relocation for org.lz4:lz4-java * Enable tests during arch package build * Add debian/README.source * Add DEP-12 debian/upstream/metadata * Clean up unused Build-Depends * Remove liblz4-jni.lintian-overrides * Bump Standards-Version to 4.7.4 Checksums-Sha1: 6c7a7e4c50f589ee0d2543cb462465a15206c06c 2336 lz4-java_1.11.2+ds1-1.dsc b246ca7e1c7b81a55c4fe9b92b608686e0169b43 443268 lz4-java_1.11.2+ds1.orig.tar.xz 30104975b54008791d983fa094a75d936a3f6293 9660 lz4-java_1.11.2+ds1-1.debian.tar.xz ad5ec9e2acee373d4b9274ed37410ff0a2448e00 15106 lz4-java_1.11.2+ds1-1_arm64.buildinfo Checksums-Sha256: 9226982f038b158ad7e0f5409be4c115c300ffd1741c6e82e1e8ea7c868ea80e 2336 lz4-java_1.11.2+ds1-1.dsc 7f35bc1922cd77fd633d8917de666493c65e8eb349d5054809571b843872c726 443268 lz4-java_1.11.2+ds1.orig.tar.xz f88092d9ca0f783adb0fd7245ec5256db5834dc50abeaba7404f583a56b60c0c 9660 lz4-java_1.11.2+ds1-1.debian.tar.xz b4de4d155ff4dcbdeaec0548f0d1cc2869739cbe193f08c3c66304599d7224df 15106 lz4-java_1.11.2+ds1-1_arm64.buildinfo Files: f89e9d50ce997d48484acbc9582aafb4 2336 java optional lz4-java_1.11.2+ds1-1.dsc 16572baa719430d8f7b7e5aea6f0db88 443268 java optional lz4-java_1.11.2+ds1.orig.tar.xz df3b709f10d36947e1323f7d11da7957 9660 java optional lz4-java_1.11.2+ds1-1.debian.tar.xz d88520de53339b128e32c29beedf1129 15106 java optional lz4-java_1.11.2+ds1-1_arm64.buildinfo -----BEGIN PGP SIGNATURE----- iQJIBAEBCgAyFiEE5Qr9Va3SequXFjqLIdIFiZdLPpYFAmqUncIUHHRtYW5jaWxs QGRlYmlhbi5vcmcACgkQIdIFiZdLPpYzIA//Qcmtt7RpgTSpP7H9ZbhTPaINoFIY 281gD4nRuZbHb/2y5ahHjdAfTl0UKj0/1RXFAPOpEIejjFbUcZ2TAx1BY5vrcod3 J3+NNDzaB44ReM2/0An/MoOeAohOupaEPu9PNnAqYMbF0myL1Si2IftQ3yRIs7+W EOVcAibEB2iX8YN7tMqX+5hs/FJqwEBuAJDiP6t09YEgQLC0OqYypKaUzCorq7od lEjdhq/a6Y0S+YxKt2f+iUINhkTlQ+M95xHRsQKheKZy+PgvMPxADLKSce+nKsLw AdWjhL/OOmozBJRH+ujsw4F0KCb+GUuCCKS+vrc4/a+gMiaVkbIYZwJ8edfdRC5n tq00AOrw8Wxqc7rLaMMhgN0O89YWovufhrSDkIRlOxFqruOEwjt8SLP6EgC/O4I1 wLl+PPPWrebMK3nfhy42iqxwv9kMGUUyplDRTrmrWiHD2RmBjOAgRig8M+ZGudDO hupkJKHonCGUeDrUxyDIOQxrC12Rz4UfYbFtxtWi9GtxFmhxQW2BW/FmL1v3x1Fj ABx3X+X1B68OMgVqJmzj4HJ8HFGtUI7j9LB6Zzh/U82ZNM5YNemVSmsiR5TIgdr0 Xl01l1bnIiobNEepcntlrBjxsrfiPzdvkaAV95FNWjMJr0xOcTpoMFf5grKGqtGN 0YScadGFqhczgl0= =p2ER -----END PGP SIGNATURE-----
pgpboQNqZdxmM.pgp
Description: PGP signature
__ This is the maintainer address of Debian's Java team <https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use [email protected] for discussions and questions.
