Hi Paul, Thank you for the response, and Olek, please excuse my delay. I regularly get overwhelmed by $dayjob.
I will upload zstd-jni-java to experimental, and then we can upload to unstable once bazel is ready healthy. Thanks! tony On Fri, Oct 02, 2026 at 03:36:24PM +0100, Ying-Chun Liu (PaulLiu) wrote: > Hi Olek and Tony, > > I think it is ok to just upgrade zstd-jni-java to the latest version. If > there's anything failed on bazel side, I'll fix it. > Should be not very hard. > > > > Yours, > > Paul > > > On 9/21/26 5:29 AM, Olek Wojnar wrote: > > Hey tony, > > > > On 9/20/26 13:37, tony mancill wrote: > > > Hi Olek, > > > > > > What needs to happen with the Bazel Build System [1,2] before we can > > > upgrade zstd-jni-java to the current upstream version? Would it help to > > > upload 1.5.7-17 to experimental? > > > > Thanks for bringing this to my attention! > > > > I'll check on the dependencies of the current (much newer) version that > > we have in sid. I'm also copying the Debian Bazel Discussion List in > > case anyone on there knows off the top of their head or can find the > > info sooner than I can. > > > > Update: just took a quick peek at the relevant parts of the code and it > > is not obvious to me whether a newer version would work, 1.5.2-3 is > > still what Bazel upstream has pinned [3], Debian uses a SLIGHTLY newer > > version without issues. > > > > > [1] > > > https://sources.debian.org/src/zstd-jni-java/1.5.2-5%2Bds-8/debian/README.source > > > [2] https://salsa.debian.org/bazel-team/meta/-/wikis/Bazel-Dependencies > > > > Paul, do you have any insights on this? We don't have a robust enough > > test suite that I'd be comfortable just doing a rebuild and trusting > > that it would work. > > > > Oh, tony, to answer your other question, I see no problem with having > > the newer version in experimental. It looks like 1.5.7-14 is the version > > that fixed these vulnerabilities. Do you know what the code delta is > > between -14 and -17?? > > > > Best regards, > > -Olek > > > > [3] > > https://salsa.debian.org/bazel-team/bazel-bootstrap/-/blob/main/MODULE.bazel#L22
