Update `org.lz4:lz4-java` version

[yogurtearl]

org.lz4:lz4-java:1.8.1 is available on Maven Central:
https://central.sonatype.com/artifact/org.lz4/lz4-java/versions

KSP is using this old version which is flagged for some vulnerabilities.

ksp/kotlin-analysis-api/build.gradle.kts

Line 185 in cd24221

implementation("org.lz4:lz4-java:1.7.1") { isTransitive = false }

Please upgrade to org.lz4:lz4-java:1.8.1

Side note, if you look at the pom for org.lz4:lz4-java:1.8.1
https://repo1.maven.org/maven2/org/lz4/lz4-java/1.8.1/lz4-java-1.8.1.pom

you will see:

<groupId>org.lz4</groupId>
<artifactId>lz4-java</artifactId>
<version>1.8.1</version>
<distributionManagement>
  <relocation>
     <groupId>at.yawk.lz4</groupId>
  </relocation>

So ultimately, we should update to use at.yawk.lz4 instead, but one step at a time.
https://github.com/yawkat/lz4-java

[jaschdoc]

Hi, thank you for opening the issue. This dependency is required by the Kotlin compiler / Analysis API, so this should be reported to JetBrains instead.

[yogurtearl]

But ksp seems to be hard coding a version? can we remove this, so it be purely picks up the version from kotlin?

ksp/kotlin-analysis-api/build.gradle.kts

Line 185 in cd24221

implementation("org.lz4:lz4-java:1.7.1") { isTransitive = false }

[yogurtearl]

Filed here as well, but KSP should probably not hard code the version of lz4-java ?

https://youtrack.jetbrains.com/issue/KT-87772/Upgrade-lz4-java-to-latest-version.