From 3c0faf0a58b95ac78f99b37d1b274cfa4025f2f4 Mon Sep 17 00:00:00 2001
From: Dongjoon Hyun <dongjoon@apache.org>
Date: Thu, 4 Dec 2025 14:48:44 -0800
Subject: [PATCH 1/4] [SPARK-54597][BUILD] Upgrade `lz4-java` to 1.10.0

---
 connector/kafka-0-10-assembly/pom.xml | 2 +-
 core/pom.xml                          | 2 +-
 dev/deps/spark-deps-hadoop-3-hive-2.3 | 2 +-
 pom.xml                               | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/connector/kafka-0-10-assembly/pom.xml b/connector/kafka-0-10-assembly/pom.xml
index 57182612a6386..25147039a1b75 100644
--- a/connector/kafka-0-10-assembly/pom.xml
+++ b/connector/kafka-0-10-assembly/pom.xml
@@ -65,7 +65,7 @@
       <scope>provided</scope>
     </dependency>
     <dependency>
-      <groupId>org.lz4</groupId>
+      <groupId>at.yawk.lz4</groupId>
       <artifactId>lz4-java</artifactId>
       <scope>provided</scope>
     </dependency>
diff --git a/core/pom.xml b/core/pom.xml
index 69dde0d9cc052..21d21a9aab4bd 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -232,7 +232,7 @@
       <artifactId>snappy-java</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.lz4</groupId>
+      <groupId>at.yawk.lz4</groupId>
       <artifactId>lz4-java</artifactId>
     </dependency>
     <dependency>
diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3 b/dev/deps/spark-deps-hadoop-3-hive-2.3
index e591137656aae..0df51f15382a8 100644
--- a/dev/deps/spark-deps-hadoop-3-hive-2.3
+++ b/dev/deps/spark-deps-hadoop-3-hive-2.3
@@ -186,7 +186,7 @@ log4j-api/2.24.3//log4j-api-2.24.3.jar
 log4j-core/2.24.3//log4j-core-2.24.3.jar
 log4j-layout-template-json/2.24.3//log4j-layout-template-json-2.24.3.jar
 log4j-slf4j2-impl/2.24.3//log4j-slf4j2-impl-2.24.3.jar
-lz4-java/1.8.0//lz4-java-1.8.0.jar
+lz4-java/1.10.0//lz4-java-1.10.0.jar
 metrics-core/4.2.37//metrics-core-4.2.37.jar
 metrics-graphite/4.2.37//metrics-graphite-4.2.37.jar
 metrics-jmx/4.2.37//metrics-jmx-4.2.37.jar
diff --git a/pom.xml b/pom.xml
index abfd775984f0b..0de06d4ee33f5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -879,9 +879,9 @@
         <version>${snappy.version}</version>
       </dependency>
       <dependency>
-        <groupId>org.lz4</groupId>
+        <groupId>at.yawk.lz4</groupId>
         <artifactId>lz4-java</artifactId>
-        <version>1.8.0</version>
+        <version>1.10.0</version>
       </dependency>
       <dependency>
         <groupId>com.github.luben</groupId>

From a1440f9cf9a168d5db41613035a830fe35a6bb09 Mon Sep 17 00:00:00 2001
From: Dongjoon Hyun <dongjoon@apache.org>
Date: Thu, 4 Dec 2025 15:39:45 -0800
Subject: [PATCH 2/4] Explicitly ban legacy `org.lz4:lz4-java`

---
 connector/kafka-0-10-sql/pom.xml            | 4 ++++
 connector/kafka-0-10-token-provider/pom.xml | 4 ++++
 connector/kafka-0-10/pom.xml                | 4 ++++
 pom.xml                                     | 1 +
 4 files changed, 13 insertions(+)

diff --git a/connector/kafka-0-10-sql/pom.xml b/connector/kafka-0-10-sql/pom.xml
index a1a85ac985f93..fd0ca36d36dfe 100644
--- a/connector/kafka-0-10-sql/pom.xml
+++ b/connector/kafka-0-10-sql/pom.xml
@@ -87,6 +87,10 @@
           <groupId>com.github.luben</groupId>
           <artifactId>zstd-jni</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>org.lz4</groupId>
+          <artifactId>lz4-java</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
     <dependency>
diff --git a/connector/kafka-0-10-token-provider/pom.xml b/connector/kafka-0-10-token-provider/pom.xml
index 57b0d6a1a86ef..cd259c37fb277 100644
--- a/connector/kafka-0-10-token-provider/pom.xml
+++ b/connector/kafka-0-10-token-provider/pom.xml
@@ -57,6 +57,10 @@
           <groupId>com.github.luben</groupId>
           <artifactId>zstd-jni</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>org.lz4</groupId>
+          <artifactId>lz4-java</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
     <dependency>
diff --git a/connector/kafka-0-10/pom.xml b/connector/kafka-0-10/pom.xml
index 463daa6601890..e18aa6e04263d 100644
--- a/connector/kafka-0-10/pom.xml
+++ b/connector/kafka-0-10/pom.xml
@@ -72,6 +72,10 @@
           <groupId>com.github.luben</groupId>
           <artifactId>zstd-jni</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>org.lz4</groupId>
+          <artifactId>lz4-java</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
     <dependency>
diff --git a/pom.xml b/pom.xml
index 0de06d4ee33f5..383632cb99056 100644
--- a/pom.xml
+++ b/pom.xml
@@ -2653,6 +2653,7 @@
                       <exclude>org.jboss.netty</exclude>
                       <exclude>org.codehaus.groovy</exclude>
                       <exclude>com.amazonaws:aws-java-sdk-bundle</exclude>
+                      <exclude>org.lz4:lz4-java</exclude>
                       <exclude>*:*_2.12</exclude>
                       <exclude>*:*_2.11</exclude>
                       <exclude>*:*_2.10</exclude>

From 4cc0449fc0d1ff2e3f1cc2916bbe3dd26d97115c Mon Sep 17 00:00:00 2001
From: Dongjoon Hyun <dongjoon@apache.org>
Date: Thu, 4 Dec 2025 17:21:13 -0800
Subject: [PATCH 3/4] Explicitly exclude `org.lz4:lz4-java` from kinesis-asl
 too

---
 connector/kinesis-asl/pom.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/connector/kinesis-asl/pom.xml b/connector/kinesis-asl/pom.xml
index e20d0d48d9e23..8fd1ad1d0eced 100644
--- a/connector/kinesis-asl/pom.xml
+++ b/connector/kinesis-asl/pom.xml
@@ -73,6 +73,10 @@
           <groupId>com.kjetland</groupId>
           <artifactId>mbknor-jackson-jsonschema_2.12</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>org.lz4</groupId>
+          <artifactId>lz4-java</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
     <!-- manage this up explicitly to match Spark; com.amazonaws:aws-java-sdk-pom specifies

From 7b351eb09aa6df16707b3373ce9cf73e687641bb Mon Sep 17 00:00:00 2001
From: Dongjoon Hyun <dongjoon@apache.org>
Date: Thu, 4 Dec 2025 18:50:46 -0800
Subject: [PATCH 4/4] Update LICENSE-binary and NOTICE-binary

---
 LICENSE-binary | 2 +-
 NOTICE-binary  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/LICENSE-binary b/LICENSE-binary
index fcc54c51bc820..07d93bdd27f9e 100644
--- a/LICENSE-binary
+++ b/LICENSE-binary
@@ -204,6 +204,7 @@
 This project bundles some components that are also licensed under the Apache
 License Version 2.0:
 
+at.yawk.lz4:lz4-java
 com.clearspring.analytics:stream
 com.fasterxml.jackson.core:jackson-annotations
 com.fasterxml.jackson.core:jackson-core
@@ -388,7 +389,6 @@ org.json4s:json4s-core_2.13
 org.json4s:json4s-jackson-core_2.13
 org.json4s:json4s-jackson_2.13
 org.json4s:json4s-scalap_2.13
-org.lz4:lz4-java
 org.objenesis:objenesis
 org.roaringbitmap:RoaringBitmap
 org.rocksdb:rocksdbjni
diff --git a/NOTICE-binary b/NOTICE-binary
index 4fb47cb8a24ab..b007c03673dc7 100644
--- a/NOTICE-binary
+++ b/NOTICE-binary
@@ -205,7 +205,7 @@ and decompression library written by Adrien Grand. It can be obtained at:
   * LICENSE:
     * license/LICENSE.lz4.txt (Apache License 2.0)
   * HOMEPAGE:
-    * https://github.com/jpountz/lz4-java
+    * https://github.com/yawkat/lz4-java
 
 This product optionally depends on 'lzma-java', a LZMA Java compression
 and decompression library, which can be obtained at: