[mcculls]

What Does This Do

Upgrade at.yawk.lz4:lz4-java from 1.11.4 to 1.12.1 and regenerate the eight affected Gradle lockfiles.

Motivation

1.12.1 addresses GHSA-48mj-8f7c-7qfm, which affects versions through 1.12.0. LZ4 input streams could allocate large block buffers before receiving the block data.

Even though the profiling uploader only uses output streams for compression rather than the affected input streams, keeping the bundled dependency patched avoids triggering false-positive vulnerability scanner findings.

Additional Notes

Compatibility assessment:

• All classes in both published JARs target Java 7 bytecode; there are no new runtime dependencies.
• The published compressor, frame output stream, factory, and XXHash classes are byte-for-byte unchanged from 1.11.4.
• The intervening 1.12.0 release tightens malformed-input validation and makes decompression stream failures permanent. These changes do not alter the uploader's compression path.

Validation:

• Profiling uploader suite: 68 tests passed on the default JVM (Java 25).
• Profiling uploader suite: 68 tests passed with -PtestJvm=8.
• :dd-java-agent:shadowJar and spotlessApply passed.
• Inspected the built agent: shaded LZ4 classes and Maven metadata identify version 1.12.1.
• git diff --check passed.

Full instrumentation and smoke suites are left to CI.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T10:09:15.502231Z	43274ba	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 43274ba293

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[datadog-datadog-prod-us1]

More details

The version catalog and all eight affected lockfiles consistently select LZ4 1.12.1. The completed static review found no actionable compatibility, shading, or profiling uploader regression.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 43274ba}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.95 s	13.92 s	[-0.5%; +0.8%] (no difference)
startup:insecure-bank:tracing:Agent	12.87 s	12.91 s	[-1.1%; +0.4%] (no difference)
startup:petclinic:appsec:Agent	17.14 s	17.01 s	[-0.2%; +1.8%] (no difference)
startup:petclinic:iast:Agent	16.58 s	16.60 s	[-6.3%; +6.0%] (unstable)
startup:petclinic:profiling:Agent	16.74 s	16.77 s	[-1.2%; +0.9%] (no difference)
startup:petclinic:sca:Agent	17.09 s	16.90 s	[+0.2%; +2.1%] (maybe worse)
startup:petclinic:tracing:Agent	16.17 s	15.77 s	[-1.6%; +6.7%] (no difference)

Commit: 13e2d81f · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-10-23 11:45:21 UTC ℹ️ Start processing command /merge

---

2026-10-23 11:45:25 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-10-23 13:07:59 UTC ℹ️ MergeQueue: This merge request was merged