You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@texera.apache.org by gi...@apache.org on 2026/07/05 21:32:02 UTC
(texera) 01/01: fix(deps): replace EOL log4j 1.2 with log4j 2.26.1 bridges (#6199)
This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-6199-34c0f47737081b3021481b471935951b40afa0e9
in repository https://gitbox.apache.org/repos/asf/texera.git
commit 9a28397ae7bc0f6dbc545e00de3fa1fa04beac82
Author: Yicong Huang <17...@users.noreply.github.com>
AuthorDate: Sun Jul 5 14:31:42 2026 -0700
fix(deps): replace EOL log4j 1.2 with log4j 2.26.1 bridges (#6199)
### What changes were proposed in this PR?
`log4j:log4j` 1.2.17 is pulled in transitively by Hadoop/ZooKeeper
(declared in `common/workflow-core` and `amber`) and shipped in the
dists of amber, computing-unit-managing-service, file-service, and
workflow-compiling-service. log4j 1.x is EOL — none of its open CVEs
have a fixed 1.x release; the remediation is moving to log4j 2.x.
Since the 2.x line lives under a different Maven coordinate
(`org.apache.logging.log4j`), a plain version bump isn't possible. This
PR follows the Apache log4j migration path:
| Before | After |
| --- | --- |
| `log4j:log4j` 1.2.17 | excluded build-wide (`ThisBuild /
excludeDependencies`, root `build.sbt`) |
| — | `log4j-1.2-api` 2.26.1 + `log4j-to-slf4j` 2.26.1 in
`common/workflow-core` |
The bridges keep Hadoop/ZooKeeper's `org.apache.log4j` API calls
working, routing them through the log4j 2 API into slf4j and on to
logback (the existing Dropwizard logging backend). All affected services
inherit the bridges through `workflow-core`.
### Any related issues, documentation, discussions?
Resolves the six open Dependabot security alerts on `log4j:log4j`:
| Alert | CVE | Severity |
| --- | --- | --- |
| [#726](https://github.com/apache/texera/security/dependabot/726) |
CVE-2023-26464 | high |
| [#670](https://github.com/apache/texera/security/dependabot/670) |
CVE-2019-17571 | critical |
| [#663](https://github.com/apache/texera/security/dependabot/663) |
CVE-2022-23307 | critical |
| [#650](https://github.com/apache/texera/security/dependabot/650) |
CVE-2022-23305 | critical |
| [#649](https://github.com/apache/texera/security/dependabot/649) |
CVE-2022-23302 | high |
| [#648](https://github.com/apache/texera/security/dependabot/648) |
CVE-2021-4104 | high |
### How was this PR tested?
Dependency-only change; existing CI compile/test stacks cover it.
Verified resolution locally:
```
sbt --batch "show WorkflowCore/Runtime/externalDependencyClasspath" \
"show WorkflowExecutionService/Runtime/externalDependencyClasspath"
```
- `log4j-1.2.17.jar` no longer appears on any resolved classpath.
- `log4j-1.2-api-2.26.1.jar`, `log4j-api-2.26.1.jar`,
`log4j-to-slf4j-2.26.1.jar` are resolved.
Licensing files (LICENSE-binary / NOTICE-binary of the four affected
dists) were refreshed from locally rebuilt dists and verified with the
same commands CI runs:
```
./bin/licensing/generate_notice_binary.py <svc>/NOTICE-binary <dist>/lib # --extras amber/NOTICE-binary-python for amber
./bin/licensing/check_binary_deps.py --ignore-transitive-version jar --license-binary <svc>/LICENSE-binary <dist>/lib
```
Note: `log4j-to-slf4j` pulls `slf4j-api` 2.0.16 → 2.0.17 in the three
platform services (amber stays pinned at 1.7.26).
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Claude Fable 5)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Fable 5 <no...@anthropic.com>
---
amber/LICENSE-binary-java | 4 +-
amber/NOTICE-binary | 53 +++++++++++++++++++++-----
build.sbt | 6 +++
common/workflow-core/build.sbt | 7 ++++
computing-unit-managing-service/LICENSE-binary | 6 ++-
computing-unit-managing-service/NOTICE-binary | 43 ++++++++++++++++-----
file-service/LICENSE-binary | 6 ++-
file-service/NOTICE-binary | 43 ++++++++++++++++-----
workflow-compiling-service/LICENSE-binary | 6 ++-
workflow-compiling-service/NOTICE-binary | 43 ++++++++++++++++-----
10 files changed, 170 insertions(+), 47 deletions(-)
diff --git a/amber/LICENSE-binary-java b/amber/LICENSE-binary-java
index 0a18541bcd..ee000c544d 100644
--- a/amber/LICENSE-binary-java
+++ b/amber/LICENSE-binary-java
@@ -368,7 +368,6 @@ Scala/Java jars:
- javax.inject.javax.inject-1.jar
- javax.validation.validation-api-2.0.1.Final.jar
- joda-time.joda-time-2.11.0.jar
- - log4j.log4j-1.2.17.jar
- net.minidev.accessors-smart-2.4.7.jar
- net.minidev.json-smart-2.4.7.jar
- org.agrona.agrona-1.22.0.jar
@@ -430,6 +429,9 @@ Scala/Java jars:
- org.apache.kerby.kerby-util-1.0.1.jar
- org.apache.kerby.kerby-xdr-1.0.1.jar
- org.apache.kerby.token-provider-1.0.1.jar
+ - org.apache.logging.log4j.log4j-1.2-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-to-slf4j-2.26.1.jar
- org.apache.lucene.lucene-analyzers-common-8.11.4.jar
- org.apache.lucene.lucene-core-8.11.4.jar
- org.apache.lucene.lucene-memory-8.7.0.jar
diff --git a/amber/NOTICE-binary b/amber/NOTICE-binary
index 85b4edd3e6..980e3ab2ae 100644
--- a/amber/NOTICE-binary
+++ b/amber/NOTICE-binary
@@ -511,16 +511,6 @@ which can be obtained from
https://bitbucket.org/eunjeon/mecab-ko-dic/downloads/mecab-ko-dic-2.0.3-20170922.tar.gz
---------------------------------------------------------------------------------
-ch.qos.reload4j.reload4j
---------------------------------------------------------------------------------
-
-Apache log4j
-Copyright 2007 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
-
--------------------------------------------------------------------------------
org.apache.lucene
--------------------------------------------------------------------------------
@@ -911,6 +901,16 @@ Copyright 2014-2017 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
+--------------------------------------------------------------------------------
+ch.qos.reload4j.reload4j
+--------------------------------------------------------------------------------
+
+Apache log4j
+Copyright 2007 The Apache Software Foundation
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.jasypt.jasypt
--------------------------------------------------------------------------------
@@ -1306,6 +1306,17 @@ org.apache.httpcomponents.client5.httpclient5
Apache HttpClient
Copyright 1999-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-api
+--------------------------------------------------------------------------------
+
+Apache Log4j API
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -1766,6 +1777,17 @@ is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND
or implied. See the License for the specific language governing permissions and limitations under
the License.
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-to-slf4j
+--------------------------------------------------------------------------------
+
+Log4j API to SLF4J Adapter
+Copyright 1999-2026 The Apache Software Foundation
+
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.apache.kerby.kerb-server
--------------------------------------------------------------------------------
@@ -2253,6 +2275,17 @@ please check the country's laws, regulations and policies concerning the import,
possession, or use, and re-export of encryption software, to see if this is
permitted.
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-1.2-api
+--------------------------------------------------------------------------------
+
+Apache Log4j 1.x Compatibility API
+Copyright 1999-2026 The Apache Software Foundation
+
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.apache.kerby.kerb-common
--------------------------------------------------------------------------------
diff --git a/build.sbt b/build.sbt
index c11e638d75..44e177b6dc 100644
--- a/build.sbt
+++ b/build.sbt
@@ -68,6 +68,12 @@ lazy val commonModuleSettingsWithVendored = asfLicensingSettingsWithVendored ++
val jacksonVersion = "2.18.8"
+// Hadoop/ZooKeeper (declared in common/workflow-core and amber) pull in the
+// EOL log4j 1.2.17, which has open CVEs and no fixed 1.x release. Keep it out
+// of every module; the log4j 2.x bridges declared in common/workflow-core
+// keep the org.apache.log4j API available at runtime.
+ThisBuild / excludeDependencies += ExclusionRule("log4j", "log4j")
+
lazy val DAO = (project in file("common/dao")).settings(commonModuleSettings)
lazy val Config = (project in file("common/config")).settings(commonModuleSettings)
lazy val Resource = (project in file("common/resource")).settings(commonModuleSettings)
diff --git a/common/workflow-core/build.sbt b/common/workflow-core/build.sbt
index f9ce84337e..ddb3ed76bf 100644
--- a/common/workflow-core/build.sbt
+++ b/common/workflow-core/build.sbt
@@ -154,6 +154,7 @@ val excludeJsp = ExclusionRule(organization = "javax.servlet.jsp")
val excludeXmlBind = ExclusionRule(organization = "javax.xml.bind")
val excludeJackson = ExclusionRule(organization = "com.fasterxml.jackson.core")
val excludeJacksonModule = ExclusionRule(organization = "com.fasterxml.jackson.module")
+val log4jVersion = "2.26.1"
libraryDependencies ++= Seq(
"org.apache.iceberg" % "iceberg-api" % "1.7.1",
@@ -193,6 +194,12 @@ libraryDependencies ++= Seq(
excludeJackson,
excludeJacksonModule
),
+ // log4j:log4j is excluded build-wide (root build.sbt) because 1.x is EOL
+ // with open CVEs. These log4j 2.x bridges keep hadoop/zookeeper's
+ // org.apache.log4j calls working by routing them through the log4j 2 API
+ // into slf4j (and on to logback).
+ "org.apache.logging.log4j" % "log4j-1.2-api" % log4jVersion,
+ "org.apache.logging.log4j" % "log4j-to-slf4j" % log4jVersion,
"org.postgresql" % "postgresql" % "42.7.10"
)
diff --git a/computing-unit-managing-service/LICENSE-binary b/computing-unit-managing-service/LICENSE-binary
index 02b63d439c..28947dea82 100644
--- a/computing-unit-managing-service/LICENSE-binary
+++ b/computing-unit-managing-service/LICENSE-binary
@@ -376,7 +376,6 @@ Scala/Java jars:
- jakarta.validation.jakarta.validation-api-3.0.2.jar
- javax.inject.javax.inject-1.jar
- javax.validation.validation-api-2.0.1.Final.jar
- - log4j.log4j-1.2.17.jar
- net.minidev.accessors-smart-2.4.2.jar
- net.minidev.json-smart-2.4.2.jar
- org.apache.arrow.arrow-format-15.0.2.jar
@@ -435,6 +434,9 @@ Scala/Java jars:
- org.apache.kerby.kerby-util-1.0.1.jar
- org.apache.kerby.kerby-xdr-1.0.1.jar
- org.apache.kerby.token-provider-1.0.1.jar
+ - org.apache.logging.log4j.log4j-1.2-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-to-slf4j-2.26.1.jar
- org.apache.orc.orc-core-1.9.4-nohive.jar
- org.apache.orc.orc-shims-1.9.4.jar
- org.apache.parquet.parquet-avro-1.13.1.jar
@@ -546,7 +548,7 @@ Scala/Java jars:
- org.projectlombok.lombok-1.18.24.jar
- org.reactivestreams.reactive-streams-1.0.4.jar
- org.slf4j.jul-to-slf4j-2.0.12.jar
- - org.slf4j.slf4j-api-2.0.16.jar
+ - org.slf4j.slf4j-api-2.0.17.jar
--------------------------------------------------------------------------------
Dependencies under the BSD 3-Clause License
diff --git a/computing-unit-managing-service/NOTICE-binary b/computing-unit-managing-service/NOTICE-binary
index 54f8a8bf71..d34fbe478e 100644
--- a/computing-unit-managing-service/NOTICE-binary
+++ b/computing-unit-managing-service/NOTICE-binary
@@ -787,16 +787,6 @@ Copyright 2014-2017 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
---------------------------------------------------------------------------------
-log4j.log4j
---------------------------------------------------------------------------------
-
-Apache log4j
-Copyright 2007 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
-
--------------------------------------------------------------------------------
commons-codec.commons-codec
--------------------------------------------------------------------------------
@@ -1472,6 +1462,17 @@ org.apache.httpcomponents.client5.httpclient5
Apache HttpClient
Copyright 1999-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-api
+--------------------------------------------------------------------------------
+
+Apache Log4j API
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -1800,6 +1801,17 @@ org.apache.httpcomponents.core5.httpcore5-h2
Apache HttpComponents Core HTTP/2
Copyright 2005-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-to-slf4j
+--------------------------------------------------------------------------------
+
+Log4j API to SLF4J Adapter
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -2404,6 +2416,17 @@ W3.org documents
* License: W3C License
* Copyright: Copyright (c) 1994-2001 World Wide Web Consortium, (Massachusetts Institute of Technology, Institut National de Recherche en Informatique et en Automatique, Keio University). All Rights Reserved. http://www.w3.org/Consortium/Legal/
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-1.2-api
+--------------------------------------------------------------------------------
+
+Apache Log4j 1.x Compatibility API
+Copyright 1999-2026 The Apache Software Foundation
+
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.apache.kerby.kerb-common
--------------------------------------------------------------------------------
diff --git a/file-service/LICENSE-binary b/file-service/LICENSE-binary
index 82c3647e0f..b469dccda8 100644
--- a/file-service/LICENSE-binary
+++ b/file-service/LICENSE-binary
@@ -340,7 +340,6 @@ Scala/Java jars:
- jakarta.validation.jakarta.validation-api-3.0.2.jar
- javax.inject.javax.inject-1.jar
- javax.validation.validation-api-2.0.1.Final.jar
- - log4j.log4j-1.2.17.jar
- net.minidev.accessors-smart-2.4.2.jar
- net.minidev.json-smart-2.4.2.jar
- org.apache.arrow.arrow-format-15.0.2.jar
@@ -398,6 +397,9 @@ Scala/Java jars:
- org.apache.kerby.kerby-util-1.0.1.jar
- org.apache.kerby.kerby-xdr-1.0.1.jar
- org.apache.kerby.token-provider-1.0.1.jar
+ - org.apache.logging.log4j.log4j-1.2-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-to-slf4j-2.26.1.jar
- org.apache.orc.orc-core-1.9.4-nohive.jar
- org.apache.orc.orc-shims-1.9.4.jar
- org.apache.parquet.parquet-avro-1.13.1.jar
@@ -507,7 +509,7 @@ Scala/Java jars:
- org.projectlombok.lombok-1.18.24.jar
- org.reactivestreams.reactive-streams-1.0.4.jar
- org.slf4j.jul-to-slf4j-2.0.12.jar
- - org.slf4j.slf4j-api-2.0.16.jar
+ - org.slf4j.slf4j-api-2.0.17.jar
--------------------------------------------------------------------------------
Dependencies under the BSD 3-Clause License
diff --git a/file-service/NOTICE-binary b/file-service/NOTICE-binary
index a3a05da37f..94cc0fd829 100644
--- a/file-service/NOTICE-binary
+++ b/file-service/NOTICE-binary
@@ -787,16 +787,6 @@ Copyright 2014-2017 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
---------------------------------------------------------------------------------
-log4j.log4j
---------------------------------------------------------------------------------
-
-Apache log4j
-Copyright 2007 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
-
--------------------------------------------------------------------------------
commons-codec.commons-codec
--------------------------------------------------------------------------------
@@ -1472,6 +1462,17 @@ org.apache.httpcomponents.client5.httpclient5
Apache HttpClient
Copyright 1999-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-api
+--------------------------------------------------------------------------------
+
+Apache Log4j API
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -1790,6 +1791,17 @@ org.apache.httpcomponents.core5.httpcore5-h2
Apache HttpComponents Core HTTP/2
Copyright 2005-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-to-slf4j
+--------------------------------------------------------------------------------
+
+Log4j API to SLF4J Adapter
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -2390,6 +2402,17 @@ please check the country's laws, regulations and policies concerning the import,
possession, or use, and re-export of encryption software, to see if this is
permitted.
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-1.2-api
+--------------------------------------------------------------------------------
+
+Apache Log4j 1.x Compatibility API
+Copyright 1999-2026 The Apache Software Foundation
+
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.apache.kerby.kerb-common
--------------------------------------------------------------------------------
diff --git a/workflow-compiling-service/LICENSE-binary b/workflow-compiling-service/LICENSE-binary
index 66209cb744..7d894cbb60 100644
--- a/workflow-compiling-service/LICENSE-binary
+++ b/workflow-compiling-service/LICENSE-binary
@@ -342,7 +342,6 @@ Scala/Java jars:
- jakarta.validation.jakarta.validation-api-3.0.2.jar
- javax.inject.javax.inject-1.jar
- javax.validation.validation-api-2.0.1.Final.jar
- - log4j.log4j-1.2.17.jar
- net.minidev.accessors-smart-2.4.2.jar
- net.minidev.json-smart-2.4.2.jar
- org.apache.arrow.arrow-format-15.0.2.jar
@@ -403,6 +402,9 @@ Scala/Java jars:
- org.apache.kerby.kerby-util-1.0.1.jar
- org.apache.kerby.kerby-xdr-1.0.1.jar
- org.apache.kerby.token-provider-1.0.1.jar
+ - org.apache.logging.log4j.log4j-1.2-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-api-2.26.1.jar
+ - org.apache.logging.log4j.log4j-to-slf4j-2.26.1.jar
- org.apache.lucene.lucene-analyzers-common-8.11.4.jar
- org.apache.lucene.lucene-core-8.11.4.jar
- org.apache.lucene.lucene-memory-8.7.0.jar
@@ -518,7 +520,7 @@ Scala/Java jars:
- org.projectlombok.lombok-1.18.24.jar
- org.reactivestreams.reactive-streams-1.0.4.jar
- org.slf4j.jul-to-slf4j-2.0.12.jar
- - org.slf4j.slf4j-api-2.0.16.jar
+ - org.slf4j.slf4j-api-2.0.17.jar
--------------------------------------------------------------------------------
Dependencies under the BSD 3-Clause License
diff --git a/workflow-compiling-service/NOTICE-binary b/workflow-compiling-service/NOTICE-binary
index edd49297b7..fc0479bf87 100644
--- a/workflow-compiling-service/NOTICE-binary
+++ b/workflow-compiling-service/NOTICE-binary
@@ -1225,16 +1225,6 @@ Copyright 2014-2017 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
---------------------------------------------------------------------------------
-log4j.log4j
---------------------------------------------------------------------------------
-
-Apache log4j
-Copyright 2007 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
-
--------------------------------------------------------------------------------
commons-codec.commons-codec
--------------------------------------------------------------------------------
@@ -1900,6 +1890,17 @@ org.apache.httpcomponents.client5.httpclient5
Apache HttpClient
Copyright 1999-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-api
+--------------------------------------------------------------------------------
+
+Apache Log4j API
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -2218,6 +2219,17 @@ org.apache.httpcomponents.core5.httpcore5-h2
Apache HttpComponents Core HTTP/2
Copyright 2005-2021 The Apache Software Foundation
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-to-slf4j
+--------------------------------------------------------------------------------
+
+Log4j API to SLF4J Adapter
+Copyright 1999-2026 The Apache Software Foundation
+
+
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
@@ -2838,6 +2850,17 @@ please check the country's laws, regulations and policies concerning the import,
possession, or use, and re-export of encryption software, to see if this is
permitted.
+--------------------------------------------------------------------------------
+org.apache.logging.log4j.log4j-1.2-api
+--------------------------------------------------------------------------------
+
+Apache Log4j 1.x Compatibility API
+Copyright 1999-2026 The Apache Software Foundation
+
+
+This product includes software developed at
+The Apache Software Foundation (http://www.apache.org/).
+
--------------------------------------------------------------------------------
org.apache.kerby.kerb-common
--------------------------------------------------------------------------------