You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by lh...@apache.org on 2026/08/14 11:41:38 UTC
(pulsar) branch branch-4.0 updated (5a6f93129591 -> c6c9278984b9)
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a change to branch branch-4.0
in repository https://gitbox.apache.org/repos/asf/pulsar.git
from 5a6f93129591 [improve][misc] Upgrade Conscrypt to 2.6.2 to restore the native library glibc baseline (#26315)
new d5ee207a1b36 [improve][misc] Upgrade log4j to 2.26.0 and slf4j to 2.0.18 (#25973)
new c6c9278984b9 [fix][sec] Bump log4j2 from 2.26.0 to 2.26.1 (#26329)
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
distribution/server/src/assemble/LICENSE.bin.txt | 14 +++++++-------
distribution/shell/src/assemble/LICENSE.bin.txt | 10 +++++-----
pom.xml | 4 ++--
3 files changed, 14 insertions(+), 14 deletions(-)
(pulsar) 02/02: [fix][sec] Bump log4j2 from 2.26.0 to 2.26.1 (#26329)
Posted by lh...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch branch-4.0
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit c6c9278984b93cc4b2a2307eeaaa29344086ec98
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Fri Aug 14 14:05:20 2026 +0300
[fix][sec] Bump log4j2 from 2.26.0 to 2.26.1 (#26329)
Signed-off-by: dependabot[bot] <su...@github.com>
Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
Co-authored-by: Lari Hotari <lh...@apache.org>
(cherry picked from commit 307035b752fa74a9cb52cdf91dccc4f22e6d03b1)
---
distribution/server/src/assemble/LICENSE.bin.txt | 10 +++++-----
distribution/shell/src/assemble/LICENSE.bin.txt | 8 ++++----
pom.xml | 2 +-
3 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index af543428a912..a057e743c33e 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -348,11 +348,11 @@ The Apache Software License, Version 2.0
- jakarta.validation-jakarta.validation-api-2.0.2.jar
- javax.validation-validation-api-1.1.0.Final.jar
* Log4J
- - org.apache.logging.log4j-log4j-api-2.26.0.jar
- - org.apache.logging.log4j-log4j-core-2.26.0.jar
- - org.apache.logging.log4j-log4j-slf4j2-impl-2.26.0.jar
- - org.apache.logging.log4j-log4j-web-2.26.0.jar
- - org.apache.logging.log4j-log4j-layout-template-json-2.26.0.jar
+ - org.apache.logging.log4j-log4j-api-2.26.1.jar
+ - org.apache.logging.log4j-log4j-core-2.26.1.jar
+ - org.apache.logging.log4j-log4j-slf4j2-impl-2.26.1.jar
+ - org.apache.logging.log4j-log4j-web-2.26.1.jar
+ - org.apache.logging.log4j-log4j-layout-template-json-2.26.1.jar
* Java Native Access JNA
- net.java.dev.jna-jna-jpms-5.18.1.jar
- net.java.dev.jna-jna-platform-jpms-5.18.1.jar
diff --git a/distribution/shell/src/assemble/LICENSE.bin.txt b/distribution/shell/src/assemble/LICENSE.bin.txt
index 746819557dc9..15ee626b051c 100644
--- a/distribution/shell/src/assemble/LICENSE.bin.txt
+++ b/distribution/shell/src/assemble/LICENSE.bin.txt
@@ -381,10 +381,10 @@ The Apache Software License, Version 2.0
- simpleclient_tracer_otel-0.16.0.jar
- simpleclient_tracer_otel_agent-0.16.0.jar
* Log4J
- - log4j-api-2.26.0.jar
- - log4j-core-2.26.0.jar
- - log4j-slf4j2-impl-2.26.0.jar
- - log4j-web-2.26.0.jar
+ - log4j-api-2.26.1.jar
+ - log4j-core-2.26.1.jar
+ - log4j-slf4j2-impl-2.26.1.jar
+ - log4j-web-2.26.1.jar
* OpenTelemetry
- opentelemetry-api-1.62.0.jar
- opentelemetry-api-incubator-1.62.0-alpha.jar
diff --git a/pom.xml b/pom.xml
index 68ad2118a79e..5157f8afa2e7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -197,7 +197,7 @@ flexible messaging model and an intuitive client API.</description>
<rocksdb.version>7.9.2</rocksdb.version>
<slf4j.version>2.0.18</slf4j.version>
<commons.collections4.version>4.5.0</commons.collections4.version>
- <log4j2.version>2.26.0</log4j2.version>
+ <log4j2.version>2.26.1</log4j2.version>
<!-- bouncycastle dependencies aren't necessarily aligned -->
<bouncycastle.version>1.84</bouncycastle.version>
<bouncycastle.bcprov-jdk18on.version>${bouncycastle.version}</bouncycastle.bcprov-jdk18on.version>
(pulsar) 01/02: [improve][misc] Upgrade log4j to 2.26.0 and slf4j to 2.0.18 (#25973)
Posted by lh...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch branch-4.0
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit d5ee207a1b36f31e0ae281a3487f116cf8161165
Author: Lari Hotari <lh...@users.noreply.github.com>
AuthorDate: Mon Jun 8 20:44:36 2026 +0300
[improve][misc] Upgrade log4j to 2.26.0 and slf4j to 2.0.18 (#25973)
(cherry picked from commit 492a231c06fb838be8e36975980145eeb3014943)
---
distribution/server/src/assemble/LICENSE.bin.txt | 14 +++++++-------
distribution/shell/src/assemble/LICENSE.bin.txt | 10 +++++-----
pom.xml | 4 ++--
3 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index 939bf5f9a45a..af543428a912 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -348,11 +348,11 @@ The Apache Software License, Version 2.0
- jakarta.validation-jakarta.validation-api-2.0.2.jar
- javax.validation-validation-api-1.1.0.Final.jar
* Log4J
- - org.apache.logging.log4j-log4j-api-2.25.4.jar
- - org.apache.logging.log4j-log4j-core-2.25.4.jar
- - org.apache.logging.log4j-log4j-slf4j2-impl-2.25.4.jar
- - org.apache.logging.log4j-log4j-web-2.25.4.jar
- - org.apache.logging.log4j-log4j-layout-template-json-2.25.4.jar
+ - org.apache.logging.log4j-log4j-api-2.26.0.jar
+ - org.apache.logging.log4j-log4j-core-2.26.0.jar
+ - org.apache.logging.log4j-log4j-slf4j2-impl-2.26.0.jar
+ - org.apache.logging.log4j-log4j-web-2.26.0.jar
+ - org.apache.logging.log4j-log4j-layout-template-json-2.26.0.jar
* Java Native Access JNA
- net.java.dev.jna-jna-jpms-5.18.1.jar
- net.java.dev.jna-jna-platform-jpms-5.18.1.jar
@@ -577,8 +577,8 @@ BSD 2-Clause License
MIT License
* Java SemVer -- com.github.zafarkhaja-java-semver-0.9.0.jar -- ../licenses/LICENSE-SemVer.txt
* SLF4J -- ../licenses/LICENSE-SLF4J.txt
- - org.slf4j-slf4j-api-2.0.17.jar
- - org.slf4j-jcl-over-slf4j-2.0.17.jar
+ - org.slf4j-slf4j-api-2.0.18.jar
+ - org.slf4j-jcl-over-slf4j-2.0.18.jar
* The Checker Framework
- org.checkerframework-checker-qual-3.33.0.jar
* oshi
diff --git a/distribution/shell/src/assemble/LICENSE.bin.txt b/distribution/shell/src/assemble/LICENSE.bin.txt
index 7e0c7a7f097c..746819557dc9 100644
--- a/distribution/shell/src/assemble/LICENSE.bin.txt
+++ b/distribution/shell/src/assemble/LICENSE.bin.txt
@@ -381,10 +381,10 @@ The Apache Software License, Version 2.0
- simpleclient_tracer_otel-0.16.0.jar
- simpleclient_tracer_otel_agent-0.16.0.jar
* Log4J
- - log4j-api-2.25.4.jar
- - log4j-core-2.25.4.jar
- - log4j-slf4j2-impl-2.25.4.jar
- - log4j-web-2.25.4.jar
+ - log4j-api-2.26.0.jar
+ - log4j-core-2.26.0.jar
+ - log4j-slf4j2-impl-2.26.0.jar
+ - log4j-web-2.26.0.jar
* OpenTelemetry
- opentelemetry-api-1.62.0.jar
- opentelemetry-api-incubator-1.62.0-alpha.jar
@@ -431,7 +431,7 @@ BSD 3-clause "New" or "Revised" License
MIT License
* SLF4J -- ../licenses/LICENSE-SLF4J.txt
- - slf4j-api-2.0.17.jar
+ - slf4j-api-2.0.18.jar
* The Checker Framework
- checker-qual-3.33.0.jar
diff --git a/pom.xml b/pom.xml
index b3d30297ad1d..68ad2118a79e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -195,9 +195,9 @@ flexible messaging model and an intuitive client API.</description>
<prometheus.version>0.16.0</prometheus.version>
<vertx.version>4.5.28</vertx.version>
<rocksdb.version>7.9.2</rocksdb.version>
- <slf4j.version>2.0.17</slf4j.version>
+ <slf4j.version>2.0.18</slf4j.version>
<commons.collections4.version>4.5.0</commons.collections4.version>
- <log4j2.version>2.25.4</log4j2.version>
+ <log4j2.version>2.26.0</log4j2.version>
<!-- bouncycastle dependencies aren't necessarily aligned -->
<bouncycastle.version>1.84</bouncycastle.version>
<bouncycastle.bcprov-jdk18on.version>${bouncycastle.version}</bouncycastle.bcprov-jdk18on.version>