fix: optimize code and update risky deps

[kenssa4eedfd]

Purpose of the PR

• optimize code and update dependencies

Main Changes

Verifying these changes

• Trivial rework / code cleanup without any test coverage. (No Need)
• Already covered by existing tests, such as (please modify tests here).
• Need tests and can be verified as follows:

Does this PR potentially affect the following parts?

• Dependencies (add/update license info & regenerate_known_dependencies.sh)
• Modify configurations
• The public API
• Other affects (typed here)
• Nope

Documentation Status

• Doc - TODO
• Doc - Done
• Doc - No Need

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 31.90%. Comparing base (18569c4) to head (ff0565a).
⚠️ Report is 3 commits behind head on master.

Files with missing lines	Patch %	Lines
...n/java/org/apache/hugegraph/util/CompressUtil.java	83.33%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #2918      +/-   ##
============================================
- Coverage     35.61%   31.90%   -3.71%     
- Complexity      333      488     +155     
============================================
  Files           802      802              
  Lines         67539    67539              
  Branches       8774     8774              
============================================
- Hits          24051    21551    -2500     
- Misses        40927    43587    +2660     
+ Partials       2561     2401     -160     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR addresses security concerns by updating the lz4-java dependency and strengthening password hashing, while also refactoring zip slip protection code for better maintainability.

• Updates lz4-java from versions 1.7.1/1.8.0 to 1.8.1 in response to a security vulnerability
• Increases BCrypt work factor from 4 to 12 to strengthen password hashing security
• Refactors the zipSlipProtect method signature to accept a String instead of ArchiveEntry for better code reuse

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
install-dist/scripts/dependency/known-dependencies.txt	Updates dependency tracking to replace old lz4-java versions with 1.8.1
install-dist/release-docs/licenses/LICENSE-lz4-java-1.8.1.txt	Adds Apache 2.0 license file for the new lz4-java version
install-dist/release-docs/licenses/LICENSE-lz4-java-1.8.0.txt	Removes obsolete license file for lz4-java 1.8.0
install-dist/release-docs/LICENSE	Adds reference to lz4-java 1.8.1 in the main license file
hugegraph-struct/pom.xml	Updates lz4-java dependency version from 1.7.1 to 1.8.1 with CVE reference
hugegraph-struct/src/main/java/org/apache/hugegraph/util/StringEncoding.java	Increases BCrypt work factor from 4 to 12 for stronger password hashing
hugegraph-server/hugegraph-core/pom.xml	Updates lz4-java version property from 1.8.0 to 1.8.1 with CVE reference
hugegraph-server/hugegraph-core/src/main/java/org/apache/hugegraph/util/StringEncoding.java	Increases BCrypt work factor from 4 to 12 for stronger password hashing
hugegraph-server/hugegraph-core/src/main/java/org/apache/hugegraph/util/CompressUtil.java	Refactors zipSlipProtect to accept String instead of ArchiveEntry, applies protection to decompressZip
hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/unit/util/StringEncodingTest.java	Adds backward compatibility test for BCrypt work factor change

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.