[Backport 3.4] Bump org.lz4:lz4-java from 1.8.0 to 1.10.1 (#5847)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <craig5008@gmail.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Andriy Redko <drreta@gmail.com>
Co-authored-by: Craig Perkins <cwperx@amazon.com>

Author: 4 people

CHANGELOG.md

@@ -79,6 +79,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `org.bouncycastle:bcpkix-jdk18on` from 1.82 to 1.83 ([#5825](https://github.com/opensearch-project/security/pull/5825))
 - Bump `commons-codec:commons-codec` from 1.19.0 to 1.20.0 ([#5823](https://github.com/opensearch-project/security/pull/5823))
 - Upgrade springframework to 7.0.1 and zookeeper to 3.9.4 ([#5829](https://github.com/opensearch-project/security/pull/5829))
+- Bump `org.lz4:lz4-java` from 1.8.0 to 1.10.1 ([#5845](https://github.com/opensearch-project/security/pull/5845))
 
 ### Documentation
 

build.gradle

@@ -522,6 +522,8 @@ configurations {
 
             // For org.opensearch.plugin:transport-grpc
             force "com.google.guava:failureaccess:1.0.3"
+
+            exclude group: "org.lz4", module: "lz4-java"
         }
     }
 }
@@ -733,7 +735,7 @@ dependencies {
     runtimeOnly "org.glassfish.jaxb:jaxb-runtime:${jaxb_version}"
     runtimeOnly 'com.google.j2objc:j2objc-annotations:3.1'
     compileOnly 'com.google.code.findbugs:jsr305:3.0.2'
-    runtimeOnly 'org.lz4:lz4-java:1.8.0'
+    runtimeOnly 'at.yawk.lz4:lz4-java:1.10.1'
     runtimeOnly 'org.slf4j:slf4j-api:1.7.36'
     runtimeOnly "org.apache.logging.log4j:log4j-slf4j-impl:${versions.log4j}"
     runtimeOnly 'org.xerial.snappy:snappy-java:1.1.10.8'