Re: change default default_toast_compression to lz4?

On 2025-Nov-21, Daniel Gustafsson wrote:

> > On 21 Nov 2025, at 12:33, Aleksander Alekseev <aleksander@tigerdata.com> wrote:
> 
> > Are there good reasons why we can't simply make lz4 a required
> > dependency? In the worst case we could simply copy its implementation,
> > the license permits.
> 
> I think we should, as much as we can, avoid vendoring code, especially
> something like lz4 which can be expected to be available nearly everywhere.

Yeah.  There's the security aspect: if lz4 is found to have a security
bug, we would be obliged to issue an advisory and matching release.
It's best if the library code is kept separate, so their own security
advisory is enough.

-- 
Álvaro Herrera         PostgreSQL Developer  —  https://www.EnterpriseDB.com/