You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by GitBox <gi...@apache.org> on 2021/12/18 13:55:46 UTC
[GitHub] [skywalking] kezhenxu94 opened a new pull request #8314: Bump up log4j2 to 2.17
kezhenxu94 opened a new pull request #8314:
URL: https://github.com/apache/skywalking/pull/8314
<!--
β οΈ Please make sure to read this template first, pull requests that don't accord with this template
maybe closed without notice.
Texts surrounded by `<` and `>` are meant to be replaced by you, e.g. <framework name>, <issue number>.
Put an `x` in the `[ ]` to mark the item as CHECKED. `[x]`
-->
<!-- ==== π Remove this line WHEN AND ONLY WHEN you're fixing a bug, follow the checklist π ====
### Fix <bug description or the bug issue number or bug issue link>
- [ ] Add a unit test to verify that the fix works.
- [ ] Explain briefly why the bug exists and how to fix it.
==== π Remove this line WHEN AND ONLY WHEN you're fixing a bug, follow the checklist π ==== -->
<!-- ==== π Remove this line WHEN AND ONLY WHEN you're improving the performance, follow the checklist π ====
### Improve the performance of <class or module or ...>
- [ ] Add a benchmark for the improvement, refer to [the existing ones](https://github.com/apache/skywalking/blob/master/apm-commons/apm-datacarrier/src/test/java/org/apache/skywalking/apm/commons/datacarrier/LinkedArrayBenchmark.java)
- [ ] The benchmark result.
```text
<Paste the benchmark results here>
```
- [ ] Links/URLs to the theory proof or discussion articles/blogs. <links/URLs here>
==== π Remove this line WHEN AND ONLY WHEN you're improving the performance, follow the checklist π ==== -->
<!-- ==== π Remove this line WHEN AND ONLY WHEN you're adding a new feature, follow the checklist π ====
### <Feature description>
- [ ] If this is non-trivial feature, paste the links/URLs to the design doc.
- [ ] Update the documentation to include this new feature.
- [ ] Tests(including UT, IT, E2E) are added to verify the new feature.
- [ ] If it's UI related, attach the screenshots below.
==== π Remove this line WHEN AND ONLY WHEN you're adding a new feature, follow the checklist π ==== -->
- [x] If this pull request closes/resolves/fixes an existing issue, replace the issue number. Closes #<issue number>.
- [x] Update the [`CHANGES` log](https://github.com/apache/skywalking/blob/master/CHANGES.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking] caopengan commented on pull request #8314: Bump up log4j2 to 2.17
Posted by GitBox <gi...@apache.org>.
caopengan commented on pull request #8314:
URL: https://github.com/apache/skywalking/pull/8314#issuecomment-1002365780
hi,When will 9.0 be released
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking] wu-sheng commented on pull request #8314: Bump up log4j2 to 2.17
Posted by GitBox <gi...@apache.org>.
wu-sheng commented on pull request #8314:
URL: https://github.com/apache/skywalking/pull/8314#issuecomment-1002370609
It is a CVE, we knew. There is another one, https://github.com/apache/skywalking/pull/8349.
CVEs of dependencies are common, we don't need to release every time. You could update dependencies if you think this is important to you.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking] caopengan commented on pull request #8314: Bump up log4j2 to 2.17
Posted by GitBox <gi...@apache.org>.
caopengan commented on pull request #8314:
URL: https://github.com/apache/skywalking/pull/8314#issuecomment-1002367452
> > hi,When will 9.0 be released
>
> Several months at least. This is not urgent to do an official release.
Low version Log4j2 has a serious bug, so I hope you can consider it,thanks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking] caopengan edited a comment on pull request #8314: Bump up log4j2 to 2.17
Posted by GitBox <gi...@apache.org>.
caopengan edited a comment on pull request #8314:
URL: https://github.com/apache/skywalking/pull/8314#issuecomment-1002414235
> It is a CVE, we knew. There is another one, #8349. CVEs of dependencies are common, we don't need to release every time. You could update dependencies if you think this is important to you.
got it οΌthanks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking] kezhenxu94 merged pull request #8314: Bump up log4j2 to 2.17
Posted by GitBox <gi...@apache.org>.
kezhenxu94 merged pull request #8314:
URL: https://github.com/apache/skywalking/pull/8314
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking] kezhenxu94 edited a comment on pull request #8314: Bump up log4j2 to 2.17
Posted by GitBox <gi...@apache.org>.
kezhenxu94 edited a comment on pull request #8314:
URL: https://github.com/apache/skywalking/pull/8314#issuecomment-997206126
Another CVE [CVE-2021-45105](https://logging.apache.org/log4j/2.x/security.html) not fully fixed by 2.16
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking] kezhenxu94 commented on pull request #8314: Bump up log4j2 to 2.17
Posted by GitBox <gi...@apache.org>.
kezhenxu94 commented on pull request #8314:
URL: https://github.com/apache/skywalking/pull/8314#issuecomment-997206126
Another CVE [CVE-2021-45105](https://logging.apache.org/log4j/2.x/security.html)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking] wu-sheng commented on pull request #8314: Bump up log4j2 to 2.17
Posted by GitBox <gi...@apache.org>.
wu-sheng commented on pull request #8314:
URL: https://github.com/apache/skywalking/pull/8314#issuecomment-1002366751
> hi,When will 9.0 be released
Several months at least. This is not urgent to do an official release.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking] caopengan commented on pull request #8314: Bump up log4j2 to 2.17
Posted by GitBox <gi...@apache.org>.
caopengan commented on pull request #8314:
URL: https://github.com/apache/skywalking/pull/8314#issuecomment-1002414235
> It is a CVE, we knew. There is another one, #8349. CVEs of dependencies are common, we don't need to release every time. You could update dependencies if you think this is important to you.
got it οΌthnaks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org