Hey tony,
On 9/20/26 13:37, tony mancill wrote:
Hi Olek,
What needs to happen with the Bazel Build System [1,2] before we can
upgrade zstd-jni-java to the current upstream version? Would it help to
upload 1.5.7-17 to experimental?
Thanks for bringing this to my attention!
I'll check on the dependencies of the current (much newer) version that
we have in sid. I'm also copying the Debian Bazel Discussion List in
case anyone on there knows off the top of their head or can find the
info sooner than I can.
Update: just took a quick peek at the relevant parts of the code and it
is not obvious to me whether a newer version would work, 1.5.2-3 is
still what Bazel upstream has pinned [3], Debian uses a SLIGHTLY newer
version without issues.
[1]
https://sources.debian.org/src/zstd-jni-java/1.5.2-5%2Bds-8/debian/README.source
[2] https://salsa.debian.org/bazel-team/meta/-/wikis/Bazel-Dependencies
Paul, do you have any insights on this? We don't have a robust enough
test suite that I'd be comfortable just doing a rebuild and trusting
that it would work.
Oh, tony, to answer your other question, I see no problem with having
the newer version in experimental. It looks like 1.5.7-14 is the version
that fixed these vulnerabilities. Do you know what the code delta is
between -14 and -17??
Best regards,
-Olek
[3]
https://salsa.debian.org/bazel-team/bazel-bootstrap/-/blob/main/MODULE.bazel#L22
