You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@texera.apache.org by "Yicong-Huang (via GitHub)" <gi...@apache.org> on 2026/07/05 20:45:48 UTC
[PR] chore(deps): replace EOL log4j 1.2 with log4j 2.26.1 bridges [texera]
Yicong-Huang opened a new pull request, #6199:
URL: https://github.com/apache/texera/pull/6199
### What changes were proposed in this PR?
`log4j:log4j` 1.2.17 is pulled in transitively by Hadoop/ZooKeeper (declared in `common/workflow-core` and `amber`) and shipped in the dists of amber, computing-unit-managing-service, file-service, and workflow-compiling-service. log4j 1.x is EOL — none of its open CVEs have a fixed 1.x release; the remediation is moving to log4j 2.x.
Since the 2.x line lives under a different Maven coordinate (`org.apache.logging.log4j`), a plain version bump isn't possible. This PR follows the Apache log4j migration path:
| Before | After |
| --- | --- |
| `log4j:log4j` 1.2.17 | excluded build-wide (`ThisBuild / excludeDependencies`, root `build.sbt`) |
| — | `log4j-1.2-api` 2.26.1 + `log4j-to-slf4j` 2.26.1 in `common/workflow-core` |
The bridges keep Hadoop/ZooKeeper's `org.apache.log4j` API calls working, routing them through the log4j 2 API into slf4j and on to logback (the existing Dropwizard logging backend). All affected services inherit the bridges through `workflow-core`.
### Any related issues, documentation, discussions?
Resolves the six open Dependabot security alerts on `log4j:log4j`:
| Alert | CVE | Severity |
| --- | --- | --- |
| [#726](https://github.com/apache/texera/security/dependabot/726) | CVE-2023-26464 | high |
| [#670](https://github.com/apache/texera/security/dependabot/670) | CVE-2019-17571 | critical |
| [#663](https://github.com/apache/texera/security/dependabot/663) | CVE-2022-23307 | critical |
| [#650](https://github.com/apache/texera/security/dependabot/650) | CVE-2022-23305 | critical |
| [#649](https://github.com/apache/texera/security/dependabot/649) | CVE-2022-23302 | high |
| [#648](https://github.com/apache/texera/security/dependabot/648) | CVE-2021-4104 | high |
### How was this PR tested?
Dependency-only change; existing CI compile/test stacks cover it. Verified resolution locally:
```
sbt --batch "show WorkflowCore/Runtime/externalDependencyClasspath" \
"show WorkflowExecutionService/Runtime/externalDependencyClasspath"
```
- `log4j-1.2.17.jar` no longer appears on any resolved classpath.
- `log4j-1.2-api-2.26.1.jar`, `log4j-api-2.26.1.jar`, `log4j-to-slf4j-2.26.1.jar` are resolved.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Claude Fable 5)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): replace EOL log4j 1.2 with log4j 2.26.1 bridges [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #6199:
URL: https://github.com/apache/texera/pull/6199#issuecomment-4887537107
<!-- texera-reviewer-suggestion -->
### Automated Reviewer Suggestions
Based on the `git blame` history of the changed files, we recommend the following reviewers:
- **Committers with relevant context:** `@pjfanning`
You can request their reviews formally with `/request-review @pjfanning`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps): replace EOL log4j 1.2 with log4j 2.26.1 bridges [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang commented on PR #6199:
URL: https://github.com/apache/texera/pull/6199#issuecomment-4887602937
@xuan I will backport this to v1.2 separately.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): replace EOL log4j 1.2 with log4j 2.26.1 bridges [texera]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #6199:
URL: https://github.com/apache/texera/pull/6199#issuecomment-4887543519
## [Codecov](https://app.codecov.io/gh/apache/texera/pull/6199?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 59.91%. Comparing base ([`aaed085`](https://app.codecov.io/gh/apache/texera/commit/aaed0857c8a73a4b13fd174417cd9a823f1bab25?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`242ddc5`](https://app.codecov.io/gh/apache/texera/commit/242ddc53d506935e0e82681bf52c18a906c0cc61?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #6199 +/- ##
=========================================
Coverage 59.91% 59.91%
Complexity 3312 3312
=========================================
Files 1131 1131
Lines 43805 43805
Branches 4745 4745
=========================================
Hits 26246 26246
Misses 16138 16138
Partials 1421 1421
```
| [Flag](https://app.codecov.io/gh/apache/texera/pull/6199/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | | *Carryforward flag |
|---|---|---|---|
| [access-control-service](https://app.codecov.io/gh/apache/texera/pull/6199/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `70.00% <ø> (ø)` | | Carriedforward from [aaed085](https://app.codecov.io/gh/apache/texera/commit/aaed0857c8a73a4b13fd174417cd9a823f1bab25?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [agent-service](https://app.codecov.io/gh/apache/texera/pull/6199/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `44.59% <ø> (ø)` | | Carriedforward from [aaed085](https://app.codecov.io/gh/apache/texera/commit/aaed0857c8a73a4b13fd174417cd9a823f1bab25?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [amber](https://app.codecov.io/gh/apache/texera/pull/6199/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `65.16% <ø> (ø)` | | Carriedforward from [aaed085](https://app.codecov.io/gh/apache/texera/commit/aaed0857c8a73a4b13fd174417cd9a823f1bab25?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [computing-unit-managing-service](https://app.codecov.io/gh/apache/texera/pull/6199/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `0.00% <ø> (ø)` | | Carriedforward from [aaed085](https://app.codecov.io/gh/apache/texera/commit/aaed0857c8a73a4b13fd174417cd9a823f1bab25?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [config-service](https://app.codecov.io/gh/apache/texera/pull/6199/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `52.30% <ø> (ø)` | | |
| [file-service](https://app.codecov.io/gh/apache/texera/pull/6199/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `62.81% <ø> (ø)` | | Carriedforward from [aaed085](https://app.codecov.io/gh/apache/texera/commit/aaed0857c8a73a4b13fd174417cd9a823f1bab25?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [frontend](https://app.codecov.io/gh/apache/texera/pull/6199/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `51.42% <ø> (ø)` | | Carriedforward from [aaed085](https://app.codecov.io/gh/apache/texera/commit/aaed0857c8a73a4b13fd174417cd9a823f1bab25?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [notebook-migration-service](https://app.codecov.io/gh/apache/texera/pull/6199/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `78.57% <ø> (ø)` | | |
| [pyamber](https://app.codecov.io/gh/apache/texera/pull/6199/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `91.18% <ø> (ø)` | | Carriedforward from [aaed085](https://app.codecov.io/gh/apache/texera/commit/aaed0857c8a73a4b13fd174417cd9a823f1bab25?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [workflow-compiling-service](https://app.codecov.io/gh/apache/texera/pull/6199/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `55.14% <ø> (ø)` | | Carriedforward from [aaed085](https://app.codecov.io/gh/apache/texera/commit/aaed0857c8a73a4b13fd174417cd9a823f1bab25?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
*This pull request uses carry forward flags. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/texera/pull/6199?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): replace EOL log4j 1.2 with log4j 2.26.1 bridges [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #6199:
URL: https://github.com/apache/texera/pull/6199#issuecomment-4887552291
<!-- texera-benchmarks-comment -->
## ⚠️ Benchmark changes need a look
🟢 0 better · 🔴 5 worse · ⚪ 10 noise (<±5%) · 0 without baseline
> Compared against main `aaed085` benchmarked on **this same runner**, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.
[Dashboard](https://apache.github.io/texera/dev/bench/) · [Run](https://github.com/apache/texera/actions/runs/28754356296)
| | config | throughput | MB/s | latency | max Δ latest / 7d |
|---|---|---:|---:|---:|---:|
| 🔴 | bs=10 sw=10 sl=64 | 401 | 0.245 | 23,224/44,227/44,227 us | 🔴 +32.3% / 🔴 +190.7% |
| ⚪ | bs=100 sw=10 sl=64 | 936 | 0.571 | 104,616/127,232/127,232 us | ⚪ within ±5% / 🔴 +17.9% |
| ⚪ | bs=1000 sw=10 sl=64 | 1,085 | 0.662 | 916,222/958,659/958,659 us | ⚪ within ±5% / 🟢 -9.1% |
<details><summary>Baseline details</summary>
Latest main `aaed085` from same runner
| config | metric | PR | latest main | 7d avg | Δ latest | Δ 7d |
|---|---|---:|---:|---:|---:|---:|
| bs=10 sw=10 sl=64 | throughput | 401 tuples/sec | 432 tuples/sec | 777.63 tuples/sec | -7.2% | -48.4% |
| bs=10 sw=10 sl=64 | MB/s | 0.245 MB/s | 0.263 MB/s | 0.475 MB/s | -6.8% | -48.4% |
| bs=10 sw=10 sl=64 | p50 | 23,224 us | 21,357 us | 12,603 us | +8.7% | +84.3% |
| bs=10 sw=10 sl=64 | p95 | 44,227 us | 33,425 us | 15,215 us | +32.3% | +190.7% |
| bs=10 sw=10 sl=64 | p99 | 44,227 us | 33,425 us | 18,617 us | +32.3% | +137.6% |
| bs=100 sw=10 sl=64 | throughput | 936 tuples/sec | 933 tuples/sec | 987.11 tuples/sec | +0.3% | -5.2% |
| bs=100 sw=10 sl=64 | MB/s | 0.571 MB/s | 0.57 MB/s | 0.602 MB/s | +0.2% | -5.2% |
| bs=100 sw=10 sl=64 | p50 | 104,616 us | 105,096 us | 101,428 us | -0.5% | +3.1% |
| bs=100 sw=10 sl=64 | p95 | 127,232 us | 126,562 us | 107,959 us | +0.5% | +17.9% |
| bs=100 sw=10 sl=64 | p99 | 127,232 us | 126,562 us | 114,777 us | +0.5% | +10.9% |
| bs=1000 sw=10 sl=64 | throughput | 1,085 tuples/sec | 1,097 tuples/sec | 1,021 tuples/sec | -1.1% | +6.2% |
| bs=1000 sw=10 sl=64 | MB/s | 0.662 MB/s | 0.67 MB/s | 0.623 MB/s | -1.2% | +6.2% |
| bs=1000 sw=10 sl=64 | p50 | 916,222 us | 912,141 us | 986,363 us | +0.4% | -7.1% |
| bs=1000 sw=10 sl=64 | p95 | 958,659 us | 973,588 us | 1,026,594 us | -1.5% | -6.6% |
| bs=1000 sw=10 sl=64 | p99 | 958,659 us | 973,588 us | 1,054,559 us | -1.5% | -9.1% |
</details>
<details><summary>Raw CSV</summary>
```csv
config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,498.60,200,128000,401,0.245,23223.84,44227.12,44227.12
1,100,10,64,20,2137.31,2000,1280000,936,0.571,104616.38,127231.99,127231.99
2,1000,10,64,20,18432.51,20000,12800000,1085,0.662,916222.14,958658.69,958658.69
```
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(deps): replace EOL log4j 1.2 with log4j 2.26.1 bridges [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang merged PR #6199:
URL: https://github.com/apache/texera/pull/6199
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org