#29012 Replace dependency org.lz4:lz4-java with at.yawk.lz4:lz4-java [SECURITY] CVE-2025-12183, CVE-2025-66566

enhancement

major

#27376

TLScript function "sessionRevision()"

minor

#28746

Tree grid with transient objects records selection with TransientTLObjectNaming

#28985

Update fasterxml to version 2.19.2

defect

critical

#29012

Replace dependency org.lz4:lz4-java with at.yawk.lz4:lz4-java [SECURITY] CVE-2025-12183, CVE-2025-66566

major

#28357

Do not include IDEResources by default

#28932

Deleted object access in the WebFolder

#28959

Drop into an empty table not possible

#29018

Prevent the creation of duplicate back references

#29040

Endless loop when exporting HTML attributes to Excel

minor

#27287

TL-Script add() returns error with set reference if value already contained

#28150

Long items in the Multi DropDown lead to selection problems

#28285

Strings sometimes have the wrong color in the TLScript editor

#28681

Error when displaying external "objects" in the form editor

#28699

Missing images in TL-Script description texts

#28921

Prevent Goto to FormOverlay's

#28928

In multi-select selection field, option cannot be deselected if not currently included in options

#28956

Client-side errors in "afterRendering" are swallowed up

#29003

Migration: Renaming references with legacy enums fails

#29035

Log display crashes with corrupt log files

update

critical

#29008

Update dependency org.mozilla:rhino to v1.7.14.1 [SECURITY]

#29034

Update dependency org.apache.logging.log4j:log4j-core to v2.25.3 [SECURITY]

defect

critical

#29012

Replace dependency org.lz4:lz4-java with at.yawk.lz4:lz4-java [SECURITY] CVE-2025-12183, CVE-2025-66566

SecurityIssue Update

The dependency org.lz4:lz4-java in v1.8.0 comes in transitively via org.apache.kafka:kafka-clients. The associated GitHub project(https://github.com/lz4/lz4-java) has been archived and it is noted in Maven Central that the artifact has been moved to at.yawk.lz4:lz4-java.

As two CVEs with a high classification have now been found, the dependency is explicitly replaced and upgraded to a current version.

https://nvd.nist.gov/vuln/detail/CVE-2025-12183

https://nvd.nist.gov/vuln/detail/CVE-2025-66566