[SPARK-59820][BUILD] Upgrade lz4-java to 1.12.0

[dongjoon-hyun]

What changes were proposed in this pull request?

This PR aims to upgrade at.yawk.lz4:lz4-java to 1.12.0.

Why are the changes needed?

To bring the latest security fixes of v1.11.4 and the stricter input validation of v1.12.0. The upstream recommends 1.12.0 over 1.11.4.

• https://github.com/yawkat/lz4-java/releases/tag/v1.12.0 (2026-09-25)
  • Throw IOException for invalid or unsupported frame descriptors
  • Reject short output in LZ4DecompressorWithLength safe paths
  • Make stream failures sticky in LZ4FrameInputStream and LZ4BlockInputStream
• https://github.com/yawkat/lz4-java/releases/tag/v1.11.4 (2026-09-25)
  • LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs
  • LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
  • Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

Note that Apache Spark's LZ4CompressionCodec reads streams via LZ4BlockInputStream with withStopOnEmptyBlock(false), which is the code path fixed by GHSA-343h-94h5-c4wr.

Full Changelog: yawkat/lz4-java@v1.11.3...v1.12.0

Does this PR introduce any user-facing change?

No. There is no behavior change for valid LZ4 streams.

How was this patch tested?

Pass the CIs.

Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Opus 5.5

[uros-b]

Thank you @dongjoon-hyun and @HyukjinKwon!

[dongjoon-hyun]

Thank you, @HyukjinKwon and @uros-b !

[dongjoon-hyun]

Merge Summary:

• merged into master c585d12

Posted by merge_spark_pr.py