build(deps): bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-17

[dependabot]

Bumps com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-17.

Commits

• b00e4d3 Guard for negative offsets in Zstd.decompressedSize
• 14f9b9f Next version will be 1.5.7-17
• 1317433 Move MacOS target CC flags from the CI to build.sbt
• b74bc50 Guard agains negative frame content sizes
• 4188095 Forward error from setLong
• c66cdda Narrow to the private natives; keep the public signatures int
• 2836fbb Return long from the 31 natives whose C function returns size_t
• 625d27b Small tweaks in order of operations
• 1aeae2d Future version will be 1.5.7-16
• 212ec90 v1.5.7-15
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[FrankChen021]

This is an automated review by Codex GPT-5.6 Luna(Max).

Compatibility analysis

Dependency: com.github.luben:zstd-jni; source 1.5.7-11; target 1.5.7-17.

I reviewed every published upstream version in the source-to-target range: 1.5.7-12 (tag b1ab612ca2777d6937f418933b5899132517dab3), 1.5.7-13 (ff385b2f3c6a6911d993871faa077b1e89472509), 1.5.7-14 (3216860eea289fbbae0b191c0a4fd8b72dad949c), 1.5.7-15 (212ec905b12668b2a6f1e9a39e96f520a4c4506d), 1.5.7-16 (b74bc508f89c677310a7d863ccb77e0b98284662), and target 1.5.7-17 (b00e4d3a1a5f42fa3ac549754494b7a237080ac5). Maven Central metadata lists each version; the upstream tag comparison is v1.5.7-11...v1.5.7-17.

Transition history and evidence reviewed:

• -11 -> -12 (3 commits): Android linker hardening, OOM exception lookup correction, and stricter dictionary-training/null validation. Druid has no dictionary-training call site.
• -12 -> -13 (19 commits): Android/build updates, removal of upstream pre-1.0 legacy-format sources, heap-buffer streaming support, dictionary/context lifetime fixes, nullability annotations, and removal of private sequence-producer test helpers. Druid uses the non-streaming Zstd block API and standard current zstd frames.
• -13 -> -14 (13 commits): bounds/overflow guards, stream-closed checks, and dictionary/context lifetime fixes. Druid supplies non-negative, in-bounds offsets/sizes and does not use dictionary or stream APIs.
• -14 -> -15 (2 commits): native-loader lookup was simplified to try the versioned system name before extracting the bundled resource. Druid has no ZstdNativePath override or direct loader call, and both artifacts contain the same 18 platform resource paths with only the versioned filename changed.
• -15 -> -16 (6 commits): private native size_t results were widened to long, then public signatures were retained as int with range/error checks; native parameter error propagation and negative/overflow frame-size guards were added. The public Zstd methods used by Druid retain their descriptors.
• -16 -> -17 (3 commits): macOS build flags moved into the upstream build, the version tag was cut, and deprecated decompressedSize gained negative-offset/size guards. Druid does not call that deprecated method.

Carried-forward ROUND_1 verdict: SAFE. API/ABI SAFE: the source/target JARs have identical class sets and identical public APIs except one additive ZstdCompressCtx.compressByteBufferStream method; Druid’s direct Zstd signatures are unchanged. Runtime SAFE: the changes are guards, lifecycle/error handling, build/native-loader maintenance, and the target JAR contains the expected native resources. Configuration SAFE: zstd-jni properties and Druid’s compression configuration are unchanged. Serialization/wire SAFE: no Druid wire/client protocol or stream API is changed. Persistence SAFE: CompressionStrategy.ZSTD remains ID 0x2; Druid’s persisted blocks use standard ZSTD_compress/ZSTD_decompress frames, while the removed upstream legacy decoder is not a Druid call path. Clients SAFE: no Druid client API or HTTP compression path uses zstd-jni directly. Transitive dependencies SAFE: target POM adds only org.jetbrains:annotations:24.1.0 with provided scope; Druid’s effective dependency management resolves org.jetbrains:annotations to 26.1.0, with no new runtime dependency. Licenses SAFE: source and target POMs both declare BSD 2-Clause; the existing licenses/bin/zstd-jni.BSD2 covers the artifact and packaging CI passed. Extension/plugin SPI SAFE: no SPI or extension code changes; extension POMs retain the single Druid-managed copy/exclusions. No category is CONCERN, INCOMPATIBLE, or UNRESOLVED.

Druid impact

The complete PR diff is one line in pom.xml:731-733, changing the dependency-management version from 1.5.7-11 to 1.5.7-17. The compile dependency is consumed by processing/pom.xml:260-262. The only production zstd-jni call site is processing/src/main/java/org/apache/druid/segment/data/CompressionStrategy.java:376-461: compressBound, direct-buffer compress, direct-buffer decompress, heap-array decompress, isError, getErrorName, and maxCompressionLevel. The Parquet extension excludes Parquet’s transitive zstd-jni at extensions-core/parquet-extensions/pom.xml:80-86, and the Rabbit extension excludes the stream client’s copy at extensions-contrib/rabbit-stream-indexing-service/pom.xml:124-129; both consume druid-processing as provided. No Druid source or test files are changed by this PR, and no Maven plugin scope changes.

Validation

• Exact reserved worktree is clean at head f2a32b8ce7fd5d8d36c2ba0349cafd3866435661; the supplied merge-base is f81c3c19c9da7d19a7e1305c0e4ff4aaa87ca534; git diff --check passes and the complete diff is one file/one line.
• Narrow Maven resolution checks pass. processing resolves com.github.luben:zstd-jni:1.5.7-17:compile; Parquet and Rabbit resolve it only through their provided druid-processing dependency, with their upstream transitive copies excluded. The effective POM resolves the root-managed annotations version to 26.1.0.
• Maven Central source/target artifact SHA-1 checks match the published .sha1 files: 1.5.7-11 4e88b2ca784e3530070c074dc38052876e74b9ab; 1.5.7-17 b4fea046fcd925681fa10c61be99da059f4f745a. Source/target POM diff confirms the unchanged BSD 2-Clause license and the target-only provided annotation dependency.
• javap -public comparison across all classes found no removed or changed public descriptor; only the additive context streaming method differs. A target-artifact smoke test on Darwin arm64/JDK 25 passed both heap-array and direct-buffer compress/decompress round trips.
• No source/test fix, commit, push, or CI rerun was needed.

CI gate

Fresh pre-approval state for exact head f2a32b8ce7fd5d8d36c2ba0349cafd3866435661: PR OPEN, non-draft, MERGEABLE, CLEAN. Complete rollup: 27/27 CheckRuns are COMPLETED/SUCCESS, 0 CheckRuns are failed or active, 0 StatusContexts are present, and the rollup-success evidence is true. The five workflow runs attached to this head are successful. Artifact inventory contains only artifacts from successful runs (13 unit-test-report artifacts and 1 web-checks log artifact); there are no failed jobs or failed-job artifacts to diagnose. No reruns were triggered.

Automation actions

The exact reserved head was reviewed in the isolated worktree. No bounded repair was necessary, so no files were changed, committed, or pushed. No active or deterministic CI job was rerun. This evidence-bearing native review approves the dependency update at the exact current head.

No merge was performed.

[FrankChen021]

Compatibility correction for exact head f2a32b8ce7fd5d8d36c2ba0349cafd3866435661: INCOMPATIBLE.

The complete PR diff is one line: com.github.luben:zstd-jni 1.5.7-11 → 1.5.7-17. Upstream publishes every release 1.5.7-12 through 1.5.7-17; 1.5.7-12 is the last release with pre-1.0 v0.4–v0.7 legacy-frame decoding, and 1.5.7-13 removes the legacy native sources and fixtures. A smoke test with upstream xml_v04.zst decodes 5,345,280 bytes on 1.5.7-11 and 1.5.7-12, but fails with Unknown frame descriptor on every release from 1.5.7-13 through 1.5.7-17.

Druid’s documented .zst batch-ingestion path in CompressionUtils constructs Commons Compress ZstdCompressorInputStream, whose constructor creates com.github.luben.zstd.ZstdInputStream. The dependency-only bump would therefore regress externally supplied legacy .zst batch ingestion. This supersedes the prior SAFE approval (review 5273889567); the earlier closures of #20110 and #20228 establish the same compatibility issue.

Closing without merge. A safe repair requires an explicit compatibility/product decision, a legacy-capable build or version cap, or a migration plan; that is beyond a bounded dependency-only repair.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.