[GHSA-mrhq-xxpp-qf7j] Add affected package and fixed version for snappy-java

[xerial]

I'm the maintainer of snappy-java (xerial/snappy-java).

This advisory (CVE-2026-90559) currently has an empty affected list, so dependency scanners flag every snappy-java version and report no fix. This PR adds:

• Affected package: Maven org.xerial.snappy:snappy-java, affected <= 1.1.10.8, fixed in 1.1.10.9
• References:
  • the repository advisory GHSA-wmgv-28fv-894x, which carries the same CVE ID
  • the fix PR (Fix buffer overflows and unbounded allocations from untrusted input (CVE-2026-90559 and others) xerial/snappy-java#739) and its commit
  • the 1.1.10.9 release

The fix: Snappy.uncompress(ByteBuffer, ByteBuffer) now throws IllegalArgumentException when uncompressed.remaining() is smaller than the uncompressed length declared in the compressed data. 1.1.10.9 is published on Maven Central.

Fix commit: xerial/snappy-java@943c604

[Copilot]

Copilot review overview

🟢 Approval recommended

The package coordinates, version range, fix commit, and release are consistent with the upstream sources.

Review effort: Balanced
Findings: None

What changed in this PR

Adds accurate Maven affected-version metadata and remediation references for CVE-2026-90559.

Changes:

• Marks versions through 1.1.10.8 as affected and 1.1.10.9 as fixed.
• Adds advisory, fix, release, and package references.

File	Description
GHSA-mrhq-xxpp-qf7j.json	Updates affected ranges and supporting references.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.