build(subversion): Substitute the vulnerable lz4-java dependency

sschuberth · sschuberth · commit 32b9aea28f35 · 2026-01-13T07:53:22.000+01:00
Substitute with a maintained community fork that patches the vulnerability, see [1]. [1]: https://nvd.nist.gov/vuln/detail/CVE-2025-12183 Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>
diff --git a/buildSrc/src/main/kotlin/ort-base-conventions.gradle.kts b/buildSrc/src/main/kotlin/ort-base-conventions.gradle.kts
@@ -72,6 +72,14 @@ repositories {
     }
 }
 
+configurations.all {
+    resolutionStrategy.dependencySubstitution {
+        substitute(module("org.lz4:lz4-java:1.4.1"))
+            .using(module("at.yawk.lz4:lz4-java:1.10.2"))
+            .because("lz4-java is unmaintained and vulnerable to CVE‐2025‐12183")
+    }
+}
+
 tasks.withType<Jar>().configureEach {
     manifest {
         attributes["Implementation-Version"] = version

Original file line number	Diff line number	Diff line change
`@@ -72,6 +72,14 @@ repositories {`
`72`	`72`	`}`
`73`	`73`	`}`
`74`	`74`
	`75`	`+configurations.all {`
	`76`	`+ resolutionStrategy.dependencySubstitution {`
	`77`	`+ substitute(module("org.lz4:lz4-java:1.4.1"))`
	`78`	`+ .using(module("at.yawk.lz4:lz4-java:1.10.2"))`
	`79`	`+ .because("lz4-java is unmaintained and vulnerable to CVE‐2025‐12183")`
	`80`	`+ }`
	`81`	`+}`
	`82`	`+`
`75`	`83`	`tasks.withType<Jar>().configureEach {`
`76`	`84`	`manifest {`
`77`	`85`	`attributes["Implementation-Version"] = version`