HADOOP-19827. Upgrade kafka-clients to 3.9.2

[pan3793]

Description of PR

HADOOP-19747 intended to upgrade lz4-java from org.lz4:lz4-java to at.yawk.lz4:lz4-java but actually didn't succeed.

Download Hadoop 3.5.0 RC0

$ find hadoop-3.5.0 -iname '*lz4-java*'
hadoop-3.5.0/share/hadoop/tools/lib/lz4-java-1.8.0.jar

This is because kafka-clients 3.9.0 still pulls old org.lz4:lz4-java, it was fixed in

[KAFKA-19951] - switch lz4-java to at.yawk.lz4 version due to CVE

https://archive.apache.org/dist/kafka/3.9.2/RELEASE_NOTES.html

How was this patch tested?

$ ./start-build-env.sh
...
$ ./mvnw clean package -Pdist,native -DskipTests -Dtar -Dmaven.javadoc.skip=true
...
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  18:12 min
[INFO] Finished at: 2026-03-02T07:47:21Z
[INFO] ------------------------------------------------------------------------
$ find hadoop-dist/target/hadoop-3.6.0-SNAPSHOT -iname '*lz4-java*'
hadoop-dist/target/hadoop-3.6.0-SNAPSHOT/share/hadoop/tools/lib/lz4-java-1.10.2.jar

For code changes:

• Does the title or this PR starts with the corresponding JIRA issue id (HADOOP-19827)?
• Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
• If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
• If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

AI Tooling

No AI usage.

[pan3793]

cc @cnauroth @slfan1989

[slfan1989]

LGTM

[pan3793]

@cnauroth, this is also required for 3.5.0, otherwise, it still pulls vulnerable org.lz4:lz4-java:1.8.0

[hadoop-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	19m 55s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+0 🆗	xmllint	0m 0s		xmllint was not available.
+0 🆗	shelldocs	0m 0s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	1m 54s		Maven dependency ordering for branch
+1 💚	mvninstall	50m 25s		trunk passed
+1 💚	compile	17m 57s		trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04
+1 💚	compile	18m 3s		trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1
+1 💚	mvnsite	19m 45s		trunk passed
+1 💚	javadoc	9m 38s		trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04
+1 💚	javadoc	9m 25s		trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1
+1 💚	shadedclient	52m 28s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 34s		Maven dependency ordering for patch
+1 💚	mvninstall	50m 39s		the patch passed
-1 ❌	compile	1m 16s	/patch-compile-root-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt	root in the patch failed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04.
-1 ❌	javac	1m 16s	/patch-compile-root-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt	root in the patch failed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04.
-1 ❌	compile	0m 53s	/patch-compile-root-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt	root in the patch failed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1.
-1 ❌	javac	0m 53s	/patch-compile-root-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt	root in the patch failed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1.
+1 💚	blanks	0m 0s		The patch has no blanks issues.
-1 ❌	mvnsite	0m 50s	/patch-mvnsite-root.txt	root in the patch failed.
+1 💚	shellcheck	0m 0s		No new issues.
-1 ❌	javadoc	0m 59s	/patch-javadoc-root-jdkUbuntu-21.0.10+7-Ubuntu-124.04.txt	root in the patch failed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04.
-1 ❌	javadoc	0m 57s	/patch-javadoc-root-jdkUbuntu-17.0.18+8-Ubuntu-124.04.1.txt	root in the patch failed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1.
-1 ❌	shadedclient	7m 47s		patch has errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	0m 51s	/patch-unit-root.txt	root in the patch failed.
+0 🆗	asflicense	0m 51s		ASF License check generated no output?
		249m 5s

Subsystem	Report/Notes
Docker	ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8292/2/artifact/out/Dockerfile
GITHUB PR	#8292
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint shellcheck shelldocs
uname	Linux a926b1b21fbd 5.15.0-164-generic #174-Ubuntu SMP Fri Nov 14 20:25:16 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / 56a61cf
Default Java	Ubuntu-17.0.18+8-Ubuntu-124.04.1
Multi-JDK versions	/usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.10+7-Ubuntu-124.04 /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.18+8-Ubuntu-124.04.1
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8292/2/testReport/
Max. process+thread count	593 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8292/2/console
versions	git=2.43.0 maven=3.9.11 shellcheck=0.9.0
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

[hadoop-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 0s		Docker mode activated.
-1 ❌	patch	0m 21s		#8292 does not apply to trunk. Rebase required? Wrong Branch? See https://cwiki.apache.org/confluence/display/HADOOP/How+To+Contribute for help.

Subsystem	Report/Notes
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8292/3/console
versions	git=2.34.1
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.