You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@texera.apache.org by xu...@apache.org on 2026/07/06 17:15:25 UTC
(texera) branch release/v1.2 updated: fix(deps, v1.2): replace EOL log4j 1.2 with log4j 2.26.1 bridges (#6202)
This is an automated email from the ASF dual-hosted git repository.
xuang7 pushed a commit to branch release/v1.2
in repository https://gitbox.apache.org/repos/asf/texera.git
The following commit(s) were added to refs/heads/release/v1.2 by this push:
new 2c523f93be fix(deps, v1.2): replace EOL log4j 1.2 with log4j 2.26.1 bridges (#6202)
2c523f93be is described below
commit 2c523f93be74d4aa501ea53fe50e70214c6fcc2e
Author: Yicong Huang <17...@users.noreply.github.com>
AuthorDate: Mon Jul 6 10:15:19 2026 -0700
fix(deps, v1.2): replace EOL log4j 1.2 with log4j 2.26.1 bridges (#6202)
### What changes were proposed in this PR?
Backport of #6199 to `release/v1.2` (the automated backport hit a
`build.sbt` context conflict, so this is a manual port of the same
change):
- exclude `log4j:log4j` 1.2.17 build-wide (`ThisBuild /
excludeDependencies`, root `build.sbt`) — it arrives transitively via
Hadoop/ZooKeeper and log4j 1.x is EOL with open CVEs;
- add the `log4j-1.2-api` / `log4j-to-slf4j` 2.26.1 bridges in
`common/workflow-core`, keeping the `org.apache.log4j` API routed
through the log4j 2 API into slf4j/logback;
- update `LICENSE-binary` and regenerate `NOTICE-binary` for the four
dists that bundled log4j 1.2.17 (amber, computing-unit-managing-service,
file-service, workflow-compiling-service). `log4j-to-slf4j` bumps
`slf4j-api` 2.0.16 → 2.0.17 in the three platform services (amber stays
pinned at 1.7.26).
### Any related issues, documentation, discussions?
Backport of #6199. Resolves the six open `log4j:log4j` Dependabot alerts
for the v1.2 line: CVE-2019-17571, CVE-2022-23307, CVE-2022-23305
(critical); CVE-2023-26464, CVE-2022-23302, CVE-2021-4104 (high).
### How was this PR tested?
Dependency-only change; existing CI compile/test stacks cover it.
Verified locally on this branch:
- built the four dists and confirmed `log4j-1.2.17.jar` is gone and only
the three 2.26.1 jars remain;
- `./bin/licensing/check_binary_deps.py --ignore-transitive-version jar
--license-binary <svc>/LICENSE-binary <dist>/lib` passes for all four
dists;
- `NOTICE-binary` files regenerated with
`./bin/licensing/generate_notice_binary.py` from the rebuilt dists.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Claude Fable 5)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Fable 5 <no...@anthropic.com>
---
amber/LICENSE-binary-java | 4 +-
amber/NOTICE-binary | 53 +++++++++++++++++++++-----
build.sbt | 6 +++
common/workflow-core/build.sbt | 7 ++++
computing-unit-managing-service/LICENSE-binary | 6 ++-
computing-unit-managing-service/NOTICE-binary | 43 ++++++++++++++++-----
file-service/LICENSE-binary | 6 ++-
file-service/NOTICE-binary | 43 ++++++++++++++++-----
workflow-compiling-service/LICENSE-binary | 6 ++-
workflow-compiling-service/NOTICE-binary | 43 ++++++++++++++++-----
10 files changed, 170 insertions(+), 47 deletions(-)
diff --git a/amber/LICENSE-binary-java b/amber/LICENSE-binary-java
index bad388a0cb..4843d313c8 100644
--- a/amber/LICENSE-binary-java
+++ b/amber/LICENSE-binary-java
@@ -368,7 +368,6 @@ Scala/Java jars:
- javax.inject.javax.inject-1.jar
- javax.validation.validation-api-2.0.1.Final.jar
- joda-time.joda-time-2.11.0.jar
- - log4j.log4j-1.2.17.jar
- net.minidev.accessors-smart-2.4.7.jar
- net.minidev.json-smart-2.4.7.jar
- org.agrona.agrona-1.22.0.jar
@@ -430,6 +429,9 @@ Scala/Java jars:
- org.apache.kerby.kerby-util-1.0.1.jar
- org.apache.kerby.kerby-xdr-1.0.1.jar
- org.apache.kerby.token-provider-1.0.1.jar
+ - org.apache.logging.log4j.log4j-1.2-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-to-slf4j-2.26.1.jar
- org.apache.lucene.lucene-analyzers-common-8.11.4.jar
- org.apache.lucene.lucene-core-8.11.4.jar
- org.apache.lucene.lucene-memory-8.7.0.jar
diff --git a/amber/NOTICE-binary b/amber/NOTICE-binary
index 85b4edd3e6..980e3ab2ae 100644
--- a/amber/NOTICE-binary
+++ b/amber/NOTICE-binary
@@ -511,16 +511,6 @@ which can be obtained from
https://bitbucket.org/eunjeon/mecab-ko-dic/downloads/mecab-ko-dic-2.0.3-20170922.tar.gz
---------------------------------------------------------------------------------
-ch.qos.reload4j.reload4j
---------------------------------------------------------------------------------
-
-Apache log4j
-Copyright 2007 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
-
--------------------------------------------------------------------------------
org.apache.lucene
--------------------------------------------------------------------------------
@@ -911,6 +901,16 @@ Copyright 2014-2017 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
+--------------------------------------------------------------------------------
+ch.qos.reload4j.reload4j
+--------------------------------------------------------------------------------
+
+Apache log4j
+Copyright 2007 The Apache Software Foundation
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.jasypt.jasypt
--------------------------------------------------------------------------------
@@ -1306,6 +1306,17 @@ org.apache.httpcomponents.client5.httpclient5
Apache HttpClient
Copyright 1999-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-api
+--------------------------------------------------------------------------------
+
+Apache Log4j API
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -1766,6 +1777,17 @@ is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND
or implied. See the License for the specific language governing permissions and limitations under
the License.
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-to-slf4j
+--------------------------------------------------------------------------------
+
+Log4j API to SLF4J Adapter
+Copyright 1999-2026 The Apache Software Foundation
+
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.apache.kerby.kerb-server
--------------------------------------------------------------------------------
@@ -2253,6 +2275,17 @@ please check the country's laws, regulations and policies concerning the import,
possession, or use, and re-export of encryption software, to see if this is
permitted.
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-1.2-api
+--------------------------------------------------------------------------------
+
+Apache Log4j 1.x Compatibility API
+Copyright 1999-2026 The Apache Software Foundation
+
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.apache.kerby.kerb-common
--------------------------------------------------------------------------------
diff --git a/build.sbt b/build.sbt
index 2097448610..586da08cc9 100644
--- a/build.sbt
+++ b/build.sbt
@@ -62,6 +62,12 @@ lazy val asfLicensingSettingsWithVendored = AddMetaInfLicenseFiles.workflowOpera
val jacksonVersion = "2.18.8"
+// Hadoop/ZooKeeper (declared in common/workflow-core and amber) pull in the
+// EOL log4j 1.2.17, which has open CVEs and no fixed 1.x release. Keep it out
+// of every module; the log4j 2.x bridges declared in common/workflow-core
+// keep the org.apache.log4j API available at runtime.
+ThisBuild / excludeDependencies += ExclusionRule("log4j", "log4j")
+
lazy val DAO = (project in file("common/dao")).settings(asfLicensingSettings)
lazy val Config = (project in file("common/config")).settings(asfLicensingSettings)
lazy val Auth = (project in file("common/auth"))
diff --git a/common/workflow-core/build.sbt b/common/workflow-core/build.sbt
index f6ab9e1b60..6ebcf202fe 100644
--- a/common/workflow-core/build.sbt
+++ b/common/workflow-core/build.sbt
@@ -153,6 +153,7 @@ val excludeJsp = ExclusionRule(organization = "javax.servlet.jsp")
val excludeXmlBind = ExclusionRule(organization = "javax.xml.bind")
val excludeJackson = ExclusionRule(organization = "com.fasterxml.jackson.core")
val excludeJacksonModule = ExclusionRule(organization = "com.fasterxml.jackson.module")
+val log4jVersion = "2.26.1"
libraryDependencies ++= Seq(
"org.apache.iceberg" % "iceberg-api" % "1.7.1",
@@ -192,6 +193,12 @@ libraryDependencies ++= Seq(
excludeJackson,
excludeJacksonModule
),
+ // log4j:log4j is excluded build-wide (root build.sbt) because 1.x is EOL
+ // with open CVEs. These log4j 2.x bridges keep hadoop/zookeeper's
+ // org.apache.log4j calls working by routing them through the log4j 2 API
+ // into slf4j (and on to logback).
+ "org.apache.logging.log4j" % "log4j-1.2-api" % log4jVersion,
+ "org.apache.logging.log4j" % "log4j-to-slf4j" % log4jVersion,
"org.postgresql" % "postgresql" % "42.7.10"
)
diff --git a/computing-unit-managing-service/LICENSE-binary b/computing-unit-managing-service/LICENSE-binary
index 02b63d439c..28947dea82 100644
--- a/computing-unit-managing-service/LICENSE-binary
+++ b/computing-unit-managing-service/LICENSE-binary
@@ -376,7 +376,6 @@ Scala/Java jars:
- jakarta.validation.jakarta.validation-api-3.0.2.jar
- javax.inject.javax.inject-1.jar
- javax.validation.validation-api-2.0.1.Final.jar
- - log4j.log4j-1.2.17.jar
- net.minidev.accessors-smart-2.4.2.jar
- net.minidev.json-smart-2.4.2.jar
- org.apache.arrow.arrow-format-15.0.2.jar
@@ -435,6 +434,9 @@ Scala/Java jars:
- org.apache.kerby.kerby-util-1.0.1.jar
- org.apache.kerby.kerby-xdr-1.0.1.jar
- org.apache.kerby.token-provider-1.0.1.jar
+ - org.apache.logging.log4j.log4j-1.2-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-to-slf4j-2.26.1.jar
- org.apache.orc.orc-core-1.9.4-nohive.jar
- org.apache.orc.orc-shims-1.9.4.jar
- org.apache.parquet.parquet-avro-1.13.1.jar
@@ -546,7 +548,7 @@ Scala/Java jars:
- org.projectlombok.lombok-1.18.24.jar
- org.reactivestreams.reactive-streams-1.0.4.jar
- org.slf4j.jul-to-slf4j-2.0.12.jar
- - org.slf4j.slf4j-api-2.0.16.jar
+ - org.slf4j.slf4j-api-2.0.17.jar
--------------------------------------------------------------------------------
Dependencies under the BSD 3-Clause License
diff --git a/computing-unit-managing-service/NOTICE-binary b/computing-unit-managing-service/NOTICE-binary
index 54f8a8bf71..d34fbe478e 100644
--- a/computing-unit-managing-service/NOTICE-binary
+++ b/computing-unit-managing-service/NOTICE-binary
@@ -787,16 +787,6 @@ Copyright 2014-2017 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
---------------------------------------------------------------------------------
-log4j.log4j
---------------------------------------------------------------------------------
-
-Apache log4j
-Copyright 2007 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
-
--------------------------------------------------------------------------------
commons-codec.commons-codec
--------------------------------------------------------------------------------
@@ -1472,6 +1462,17 @@ org.apache.httpcomponents.client5.httpclient5
Apache HttpClient
Copyright 1999-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-api
+--------------------------------------------------------------------------------
+
+Apache Log4j API
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -1800,6 +1801,17 @@ org.apache.httpcomponents.core5.httpcore5-h2
Apache HttpComponents Core HTTP/2
Copyright 2005-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-to-slf4j
+--------------------------------------------------------------------------------
+
+Log4j API to SLF4J Adapter
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -2404,6 +2416,17 @@ W3.org documents
* License: W3C License
* Copyright: Copyright (c) 1994-2001 World Wide Web Consortium, (Massachusetts Institute of Technology, Institut National de Recherche en Informatique et en Automatique, Keio University). All Rights Reserved. http://www.w3.org/Consortium/Legal/
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-1.2-api
+--------------------------------------------------------------------------------
+
+Apache Log4j 1.x Compatibility API
+Copyright 1999-2026 The Apache Software Foundation
+
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.apache.kerby.kerb-common
--------------------------------------------------------------------------------
diff --git a/file-service/LICENSE-binary b/file-service/LICENSE-binary
index 82c3647e0f..b469dccda8 100644
--- a/file-service/LICENSE-binary
+++ b/file-service/LICENSE-binary
@@ -340,7 +340,6 @@ Scala/Java jars:
- jakarta.validation.jakarta.validation-api-3.0.2.jar
- javax.inject.javax.inject-1.jar
- javax.validation.validation-api-2.0.1.Final.jar
- - log4j.log4j-1.2.17.jar
- net.minidev.accessors-smart-2.4.2.jar
- net.minidev.json-smart-2.4.2.jar
- org.apache.arrow.arrow-format-15.0.2.jar
@@ -398,6 +397,9 @@ Scala/Java jars:
- org.apache.kerby.kerby-util-1.0.1.jar
- org.apache.kerby.kerby-xdr-1.0.1.jar
- org.apache.kerby.token-provider-1.0.1.jar
+ - org.apache.logging.log4j.log4j-1.2-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-to-slf4j-2.26.1.jar
- org.apache.orc.orc-core-1.9.4-nohive.jar
- org.apache.orc.orc-shims-1.9.4.jar
- org.apache.parquet.parquet-avro-1.13.1.jar
@@ -507,7 +509,7 @@ Scala/Java jars:
- org.projectlombok.lombok-1.18.24.jar
- org.reactivestreams.reactive-streams-1.0.4.jar
- org.slf4j.jul-to-slf4j-2.0.12.jar
- - org.slf4j.slf4j-api-2.0.16.jar
+ - org.slf4j.slf4j-api-2.0.17.jar
--------------------------------------------------------------------------------
Dependencies under the BSD 3-Clause License
diff --git a/file-service/NOTICE-binary b/file-service/NOTICE-binary
index a3a05da37f..94cc0fd829 100644
--- a/file-service/NOTICE-binary
+++ b/file-service/NOTICE-binary
@@ -787,16 +787,6 @@ Copyright 2014-2017 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
---------------------------------------------------------------------------------
-log4j.log4j
---------------------------------------------------------------------------------
-
-Apache log4j
-Copyright 2007 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
-
--------------------------------------------------------------------------------
commons-codec.commons-codec
--------------------------------------------------------------------------------
@@ -1472,6 +1462,17 @@ org.apache.httpcomponents.client5.httpclient5
Apache HttpClient
Copyright 1999-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-api
+--------------------------------------------------------------------------------
+
+Apache Log4j API
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -1790,6 +1791,17 @@ org.apache.httpcomponents.core5.httpcore5-h2
Apache HttpComponents Core HTTP/2
Copyright 2005-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-to-slf4j
+--------------------------------------------------------------------------------
+
+Log4j API to SLF4J Adapter
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -2390,6 +2402,17 @@ please check the country's laws, regulations and policies concerning the import,
possession, or use, and re-export of encryption software, to see if this is
permitted.
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-1.2-api
+--------------------------------------------------------------------------------
+
+Apache Log4j 1.x Compatibility API
+Copyright 1999-2026 The Apache Software Foundation
+
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.apache.kerby.kerb-common
--------------------------------------------------------------------------------
diff --git a/workflow-compiling-service/LICENSE-binary b/workflow-compiling-service/LICENSE-binary
index 66209cb744..7d894cbb60 100644
--- a/workflow-compiling-service/LICENSE-binary
+++ b/workflow-compiling-service/LICENSE-binary
@@ -342,7 +342,6 @@ Scala/Java jars:
- jakarta.validation.jakarta.validation-api-3.0.2.jar
- javax.inject.javax.inject-1.jar
- javax.validation.validation-api-2.0.1.Final.jar
- - log4j.log4j-1.2.17.jar
- net.minidev.accessors-smart-2.4.2.jar
- net.minidev.json-smart-2.4.2.jar
- org.apache.arrow.arrow-format-15.0.2.jar
@@ -403,6 +402,9 @@ Scala/Java jars:
- org.apache.kerby.kerby-util-1.0.1.jar
- org.apache.kerby.kerby-xdr-1.0.1.jar
- org.apache.kerby.token-provider-1.0.1.jar
+ - org.apache.logging.log4j.log4j-1.2-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-to-slf4j-2.26.1.jar
- org.apache.lucene.lucene-analyzers-common-8.11.4.jar
- org.apache.lucene.lucene-core-8.11.4.jar
- org.apache.lucene.lucene-memory-8.7.0.jar
@@ -518,7 +520,7 @@ Scala/Java jars:
- org.projectlombok.lombok-1.18.24.jar
- org.reactivestreams.reactive-streams-1.0.4.jar
- org.slf4j.jul-to-slf4j-2.0.12.jar
- - org.slf4j.slf4j-api-2.0.16.jar
+ - org.slf4j.slf4j-api-2.0.17.jar
--------------------------------------------------------------------------------
Dependencies under the BSD 3-Clause License
diff --git a/workflow-compiling-service/NOTICE-binary b/workflow-compiling-service/NOTICE-binary
index edd49297b7..fc0479bf87 100644
--- a/workflow-compiling-service/NOTICE-binary
+++ b/workflow-compiling-service/NOTICE-binary
@@ -1225,16 +1225,6 @@ Copyright 2014-2017 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
---------------------------------------------------------------------------------
-log4j.log4j
---------------------------------------------------------------------------------
-
-Apache log4j
-Copyright 2007 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
-
--------------------------------------------------------------------------------
commons-codec.commons-codec
--------------------------------------------------------------------------------
@@ -1900,6 +1890,17 @@ org.apache.httpcomponents.client5.httpclient5
Apache HttpClient
Copyright 1999-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-api
+--------------------------------------------------------------------------------
+
+Apache Log4j API
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -2218,6 +2219,17 @@ org.apache.httpcomponents.core5.httpcore5-h2
Apache HttpComponents Core HTTP/2
Copyright 2005-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-to-slf4j
+--------------------------------------------------------------------------------
+
+Log4j API to SLF4J Adapter
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -2838,6 +2850,17 @@ please check the country's laws, regulations and policies concerning the import,
possession, or use, and re-export of encryption software, to see if this is
permitted.
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-1.2-api
+--------------------------------------------------------------------------------
+
+Apache Log4j 1.x Compatibility API
+Copyright 1999-2026 The Apache Software Foundation
+
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.apache.kerby.kerb-common
--------------------------------------------------------------------------------