You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spark.apache.org by ch...@apache.org on 2026/08/20 12:24:55 UTC
(spark) branch master updated: [SPARK-58877][BUILD] Upgrade Log4j from 2.26.0 to 2.26.1
This is an automated email from the ASF dual-hosted git repository.
pan3793 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/master by this push:
new 8acb55b6a844 [SPARK-58877][BUILD] Upgrade Log4j from 2.26.0 to 2.26.1
8acb55b6a844 is described below
commit 8acb55b6a8447c563c7a87095a737ed1363999cf
Author: anoopamS <an...@ericsson.com>
AuthorDate: Thu Aug 20 20:24:42 2026 +0800
[SPARK-58877][BUILD] Upgrade Log4j from 2.26.0 to 2.26.1
### What changes were proposed in this pull request?
Upgrade Log4j from 2.26.0 to 2.26.1.
### Why are the changes needed?
Fixes CVE-2026-49844 (MEDIUM 5.9): Improper encoding of non-finite floating-point values during MapMessage JSON serialization produces invalid JSON output.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Build passes with `./dev/make-distribution.sh --name hadoop3 --tgz -Phadoop-3 -DskipTests`.
### Was this patch authored or co-authored using generative AI tooling?
Yes
Closes #58127 from anoopamS/spark-log4j-upgrade.
Authored-by: anoopamS <an...@ericsson.com>
Signed-off-by: Cheng Pan <ch...@apache.org>
---
dev/deps/spark-deps-hadoop-3-hive-2.3 | 10 +++++-----
pom.xml | 2 +-
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3 b/dev/deps/spark-deps-hadoop-3-hive-2.3
index 0543c84e1168..c085c31fc86b 100644
--- a/dev/deps/spark-deps-hadoop-3-hive-2.3
+++ b/dev/deps/spark-deps-hadoop-3-hive-2.3
@@ -201,11 +201,11 @@ lapack/3.2.0//lapack-3.2.0.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
libfb303/0.9.3//libfb303-0.9.3.jar
libthrift/0.16.0//libthrift-0.16.0.jar
-log4j-1.2-api/2.26.0//log4j-1.2-api-2.26.0.jar
-log4j-api/2.26.0//log4j-api-2.26.0.jar
-log4j-core/2.26.0//log4j-core-2.26.0.jar
-log4j-layout-template-json/2.26.0//log4j-layout-template-json-2.26.0.jar
-log4j-slf4j2-impl/2.26.0//log4j-slf4j2-impl-2.26.0.jar
+log4j-1.2-api/2.26.1//log4j-1.2-api-2.26.1.jar
+log4j-api/2.26.1//log4j-api-2.26.1.jar
+log4j-core/2.26.1//log4j-core-2.26.1.jar
+log4j-layout-template-json/2.26.1//log4j-layout-template-json-2.26.1.jar
+log4j-slf4j2-impl/2.26.1//log4j-slf4j2-impl-2.26.1.jar
lz4-java/1.11.2//lz4-java-1.11.2.jar
metrics-core/4.2.37//metrics-core-4.2.37.jar
metrics-graphite/4.2.37//metrics-graphite-4.2.37.jar
diff --git a/pom.xml b/pom.xml
index e549d36de40f..ad475b77dd1c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -129,7 +129,7 @@
<sbt.project.name>spark</sbt.project.name>
<asm.version>9.10.1</asm.version>
<slf4j.version>2.0.17</slf4j.version>
- <log4j.version>2.26.0</log4j.version>
+ <log4j.version>2.26.1</log4j.version>
<!-- make sure to update IsolatedClientLoader whenever this version is changed -->
<hadoop.version>3.5.0</hadoop.version>
<!-- SPARK-41247: When updating `protobuf.version`, also need to update `protoVersion` in `SparkBuild.scala` -->
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org