build(deps): Bump zstd.version from 0.7 to 0.10

[dependabot]

Bumps zstd.version from 0.7 to 0.10.
Updates io.github.dfa1.zstd:zstd from 0.7 to 0.10

Release notes

Sourced from io.github.dfa1.zstd:zstd's releases.

v0.10

Added

• Native builds now compile with ZSTD_MULTITHREAD, making ZstdCompressParameter.NB_WORKERS (plus JOB_SIZE and OVERLAP_LOG) functional instead of a silent no-op. Workers engage above zstd's 512 KiB job-size minimum; multithreaded frames are format-valid but not byte-identical to single-threaded output. A context that compressed with workers holds its native worker threads until close() — reset() does not release them, so give such contexts a dedicated owner (never pool them). See ADR 0015, which supersedes ADR 0014. (#80)

v0.9

Added

• Native builds now decode legacy zstd frame formats v0.4-v0.7 (ZSTD_LEGACY_SUPPORT=4, matching zstd-jni's default). v0.1-v0.3 stay unsupported — they predate zstd's 1.0 stabilization and are essentially never seen in practice. Verified against a real fixture of five concatenated legacy frames extracted from zstd's own test suite. (#73)

Changed

• linux-x86_64/osx-x86_64/windows-x86_64 native builds now include zstd's hand-written BMI2 Huffman-decode assembly (previously disabled). It is a no-op on non-x86_64 targets and only activates via zstd's own runtime CPU detection; benchmarked as throughput-neutral on this project's synthetic workload but carries no measured downside either. (#71)
• aarch64 native builds now target an ARMv8-A + CRC baseline (-mcpu=generic+crc, zig's spelling of -march=armv8-a+crc), instead of the fully generic baseline. Measured +6.9% compress / +12-14% decompress throughput on Apple Silicon. (#71)

Security

• linux-x86_64/linux-aarch64 native builds now link with full RELRO and immediate binding (-Wl,-z,relro,-z,now), closing off the classic GOT-overwrite exploit primitive. Verified with llvm-readelf. (#71)
• windows-x86_64/windows-aarch64 native builds now export only zstd's public API (ZSTD_*/ZDICT_*) from the DLL, via -DZSTD_DLL_EXPORT=1 (the PE analogue of the -fvisibility=hidden surface already used on ELF/Mach-O), instead of dumping every internal symbol (FSE_*/HUF_*/COVER_*/...) into the export table via --export-all-symbols. Cut the windows-x86_64 export table from 576 to 185 symbols. (#79)

Fixed

• Building the native library from source on Windows was silently broken:

... (truncated)

Changelog

Sourced from io.github.dfa1.zstd:zstd's changelog.

[0.10] - 2026-07-18

Added

• Native builds now compile with ZSTD_MULTITHREAD, making ZstdCompressParameter.NB_WORKERS (plus JOB_SIZE and OVERLAP_LOG) functional instead of a silent no-op. Workers engage above zstd's 512 KiB job-size minimum; multithreaded frames are format-valid but not byte-identical to single-threaded output. A context that compressed with workers holds its native worker threads until close() — reset() does not release them, so give such contexts a dedicated owner (never pool them). See ADR 0015, which supersedes ADR 0014. (#80)

[0.9] - 2026-07-18

Added

• Native builds now decode legacy zstd frame formats v0.4-v0.7 (ZSTD_LEGACY_SUPPORT=4, matching zstd-jni's default). v0.1-v0.3 stay unsupported — they predate zstd's 1.0 stabilization and are essentially never seen in practice. Verified against a real fixture of five concatenated legacy frames extracted from zstd's own test suite. (#73)

Changed

• linux-x86_64/osx-x86_64/windows-x86_64 native builds now include zstd's hand-written BMI2 Huffman-decode assembly (previously disabled). It is a no-op on non-x86_64 targets and only activates via zstd's own runtime CPU detection; benchmarked as throughput-neutral on this project's synthetic workload but carries no measured downside either. (#71)
• aarch64 native builds now target an ARMv8-A + CRC baseline (-mcpu=generic+crc, zig's spelling of -march=armv8-a+crc), instead of the fully generic baseline. Measured +6.9% compress / +12-14% decompress throughput on Apple Silicon. (#71)

Security

• linux-x86_64/linux-aarch64 native builds now link with full RELRO and immediate binding (-Wl,-z,relro,-z,now), closing off the classic GOT-overwrite exploit primitive. Verified with llvm-readelf. (#71)
• windows-x86_64/windows-aarch64 native builds now export only zstd's public API (ZSTD_*/ZDICT_*) from the DLL, via -DZSTD_DLL_EXPORT=1 (the PE analogue of the -fvisibility=hidden surface already used on ELF/Mach-O), instead of dumping every internal symbol (FSE_*/HUF_*/COVER_*/...) into the export table via --export-all-symbols. Cut the windows-x86_64 export table from 576 to 185 symbols. (#79)

Fixed

• Building the native library from source on Windows was silently broken:

... (truncated)

Commits

• 8b9ab52 release: 0.10
• d3c1a0f docs: supported.md - streaming classes cover NB_WORKERS and MemorySegment (#86)
• 88224d8 feat: expose NB_WORKERS parameter setter on streaming compressors (#82) (#85)
• 25aba11 bench: MtCompressBenchmark - NB_WORKERS scaling on multi-job payloads (#84)
• 6326696 build: enable ZSTD_MULTITHREAD - NB_WORKERS works, MT contexts must not be po...
• b0ea1a5 release: 0.9
• 2d9569c docs: correct misleading 'hermetic' framing on ZSTD_MULTITHREAD off (#81)
• bdced75 build: export only the public API on Windows, not every symbol (#79)
• 955dc96 build: parallelize native compile with xargs -P, not batch-and-wait (#78)
• 65f48f7 docs: link issue #77 for macOS LTO tracking in changelog
• Additional commits viewable in compare view

Updates io.github.dfa1.zstd:zstd-platform from 0.7 to 0.10

Release notes

Sourced from io.github.dfa1.zstd:zstd-platform's releases.

v0.10

Added

• Native builds now compile with ZSTD_MULTITHREAD, making ZstdCompressParameter.NB_WORKERS (plus JOB_SIZE and OVERLAP_LOG) functional instead of a silent no-op. Workers engage above zstd's 512 KiB job-size minimum; multithreaded frames are format-valid but not byte-identical to single-threaded output. A context that compressed with workers holds its native worker threads until close() — reset() does not release them, so give such contexts a dedicated owner (never pool them). See ADR 0015, which supersedes ADR 0014. (#80)

v0.9

Added

• Native builds now decode legacy zstd frame formats v0.4-v0.7 (ZSTD_LEGACY_SUPPORT=4, matching zstd-jni's default). v0.1-v0.3 stay unsupported — they predate zstd's 1.0 stabilization and are essentially never seen in practice. Verified against a real fixture of five concatenated legacy frames extracted from zstd's own test suite. (#73)

Changed

• linux-x86_64/osx-x86_64/windows-x86_64 native builds now include zstd's hand-written BMI2 Huffman-decode assembly (previously disabled). It is a no-op on non-x86_64 targets and only activates via zstd's own runtime CPU detection; benchmarked as throughput-neutral on this project's synthetic workload but carries no measured downside either. (#71)
• aarch64 native builds now target an ARMv8-A + CRC baseline (-mcpu=generic+crc, zig's spelling of -march=armv8-a+crc), instead of the fully generic baseline. Measured +6.9% compress / +12-14% decompress throughput on Apple Silicon. (#71)

Security

• linux-x86_64/linux-aarch64 native builds now link with full RELRO and immediate binding (-Wl,-z,relro,-z,now), closing off the classic GOT-overwrite exploit primitive. Verified with llvm-readelf. (#71)
• windows-x86_64/windows-aarch64 native builds now export only zstd's public API (ZSTD_*/ZDICT_*) from the DLL, via -DZSTD_DLL_EXPORT=1 (the PE analogue of the -fvisibility=hidden surface already used on ELF/Mach-O), instead of dumping every internal symbol (FSE_*/HUF_*/COVER_*/...) into the export table via --export-all-symbols. Cut the windows-x86_64 export table from 576 to 185 symbols. (#79)

Fixed

• Building the native library from source on Windows was silently broken:

... (truncated)

Changelog

Sourced from io.github.dfa1.zstd:zstd-platform's changelog.

[0.10] - 2026-07-18

Added

• Native builds now compile with ZSTD_MULTITHREAD, making ZstdCompressParameter.NB_WORKERS (plus JOB_SIZE and OVERLAP_LOG) functional instead of a silent no-op. Workers engage above zstd's 512 KiB job-size minimum; multithreaded frames are format-valid but not byte-identical to single-threaded output. A context that compressed with workers holds its native worker threads until close() — reset() does not release them, so give such contexts a dedicated owner (never pool them). See ADR 0015, which supersedes ADR 0014. (#80)

[0.9] - 2026-07-18

Added

• Native builds now decode legacy zstd frame formats v0.4-v0.7 (ZSTD_LEGACY_SUPPORT=4, matching zstd-jni's default). v0.1-v0.3 stay unsupported — they predate zstd's 1.0 stabilization and are essentially never seen in practice. Verified against a real fixture of five concatenated legacy frames extracted from zstd's own test suite. (#73)

Changed

• linux-x86_64/osx-x86_64/windows-x86_64 native builds now include zstd's hand-written BMI2 Huffman-decode assembly (previously disabled). It is a no-op on non-x86_64 targets and only activates via zstd's own runtime CPU detection; benchmarked as throughput-neutral on this project's synthetic workload but carries no measured downside either. (#71)
• aarch64 native builds now target an ARMv8-A + CRC baseline (-mcpu=generic+crc, zig's spelling of -march=armv8-a+crc), instead of the fully generic baseline. Measured +6.9% compress / +12-14% decompress throughput on Apple Silicon. (#71)

Security

• linux-x86_64/linux-aarch64 native builds now link with full RELRO and immediate binding (-Wl,-z,relro,-z,now), closing off the classic GOT-overwrite exploit primitive. Verified with llvm-readelf. (#71)
• windows-x86_64/windows-aarch64 native builds now export only zstd's public API (ZSTD_*/ZDICT_*) from the DLL, via -DZSTD_DLL_EXPORT=1 (the PE analogue of the -fvisibility=hidden surface already used on ELF/Mach-O), instead of dumping every internal symbol (FSE_*/HUF_*/COVER_*/...) into the export table via --export-all-symbols. Cut the windows-x86_64 export table from 576 to 185 symbols. (#79)

Fixed

• Building the native library from source on Windows was silently broken:

... (truncated)

Commits

• 8b9ab52 release: 0.10
• d3c1a0f docs: supported.md - streaming classes cover NB_WORKERS and MemorySegment (#86)
• 88224d8 feat: expose NB_WORKERS parameter setter on streaming compressors (#82) (#85)
• 25aba11 bench: MtCompressBenchmark - NB_WORKERS scaling on multi-job payloads (#84)
• 6326696 build: enable ZSTD_MULTITHREAD - NB_WORKERS works, MT contexts must not be po...
• b0ea1a5 release: 0.9
• 2d9569c docs: correct misleading 'hermetic' framing on ZSTD_MULTITHREAD off (#81)
• bdced75 build: export only the public API on Windows, not every symbol (#79)
• 955dc96 build: parallelize native compile with xargs -P, not batch-and-wait (#78)
• 65f48f7 docs: link issue #77 for macOS LTO tracking in changelog
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)