You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@geode.apache.org by ji...@apache.org on 2026/08/06 15:44:44 UTC
(geode) branch develop updated: GEODE-10604 (#8030)
This is an automated email from the ASF dual-hosted git repository.
JinwooHwang pushed a commit to branch develop
in repository https://gitbox.apache.org/repos/asf/geode.git
The following commit(s) were added to refs/heads/develop by this push:
new 4e02b54ac2 GEODE-10604 (#8030)
4e02b54ac2 is described below
commit 4e02b54ac29fa050224c954538a0cb949dd462d6
Author: Jinwoo Hwang <92...@users.noreply.github.com>
AuthorDate: Thu Aug 6 11:44:38 2026 -0400
GEODE-10604 (#8030)
Remediation of SNYK-JAVA-ORGAPACHELOGGINGLOG4J-17954276
---
boms/geode-all-bom/src/test/resources/expected-pom.xml | 10 +++++-----
.../apache/geode/gradle/plugins/DependencyConstraints.groovy | 2 +-
.../resources/gradle-test-projects/management/build.gradle | 2 +-
.../src/integrationTest/resources/assembly_content.txt | 10 +++++-----
.../integrationTest/resources/gfsh_dependency_classpath.txt | 10 +++++-----
.../src/integrationTest/resources/dependency_classpath.txt | 10 +++++-----
6 files changed, 22 insertions(+), 22 deletions(-)
diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml
index 8c9f5fa249..12f59c1174 100644
--- a/boms/geode-all-bom/src/test/resources/expected-pom.xml
+++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml
@@ -530,27 +530,27 @@
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
- <version>2.25.4</version>
+ <version>2.25.5</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
- <version>2.25.4</version>
+ <version>2.25.5</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-jcl</artifactId>
- <version>2.25.4</version>
+ <version>2.25.5</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-jul</artifactId>
- <version>2.25.4</version>
+ <version>2.25.5</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-slf4j-impl</artifactId>
- <version>2.25.4</version>
+ <version>2.25.5</version>
</dependency>
<dependency>
<groupId>org.apache.lucene</groupId>
diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
index 02aa0e30ee..51bf553494 100644
--- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
+++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
@@ -46,7 +46,7 @@ class DependencyConstraints {
deps.put("jakarta.annotation.version", "2.1.1")
deps.put("jakarta.ejb.version", "4.0.1")
deps.put("jgroups.version", "3.6.20.Final")
- deps.put("log4j.version", "2.25.4")
+ deps.put("log4j.version", "2.25.5")
deps.put("log4j-slf4j2-impl.version", "2.23.1")
deps.put("micrometer.version", "1.15.12")
deps.put("shiro.version", "2.1.0")
diff --git a/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle b/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle
index a4e0645a45..7c0ca6a2a8 100644
--- a/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle
+++ b/geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle
@@ -25,7 +25,7 @@ repositories {
dependencies {
implementation("${project.group}:geode-core:${project.version}")
- runtimeOnly('org.apache.logging.log4j:log4j-slf4j-impl:2.25.4')
+ runtimeOnly('org.apache.logging.log4j:log4j-slf4j-impl:2.25.5')
}
application {
diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt
index eacc877be7..135630b4d1 100644
--- a/geode-assembly/src/integrationTest/resources/assembly_content.txt
+++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt
@@ -1013,11 +1013,11 @@ lib/jna-platform-5.11.0.jar
lib/joda-time-2.12.7.jar
lib/jopt-simple-5.0.4.jar
lib/jul-to-slf4j-2.0.17.jar
-lib/log4j-api-2.25.4.jar
-lib/log4j-core-2.25.4.jar
-lib/log4j-jcl-2.25.4.jar
-lib/log4j-jul-2.25.4.jar
-lib/log4j-slf4j-impl-2.25.4.jar
+lib/log4j-api-2.25.5.jar
+lib/log4j-core-2.25.5.jar
+lib/log4j-jcl-2.25.5.jar
+lib/log4j-jul-2.25.5.jar
+lib/log4j-slf4j-impl-2.25.5.jar
lib/lucene-analysis-common-9.12.3.jar
lib/lucene-analysis-phonetic-9.12.3.jar
lib/lucene-core-9.12.3.jar
diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
index 72435fcb71..3d44db8ce1 100644
--- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
+++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
@@ -32,11 +32,11 @@ jaxb-runtime-4.0.2.jar
jaxb-core-4.0.2.jar
jakarta.xml.bind-api-4.0.2.jar
jopt-simple-5.0.4.jar
-log4j-slf4j-impl-2.25.4.jar
-log4j-core-2.25.4.jar
-log4j-jcl-2.25.4.jar
-log4j-jul-2.25.4.jar
-log4j-api-2.25.4.jar
+log4j-slf4j-impl-2.25.5.jar
+log4j-core-2.25.5.jar
+log4j-jcl-2.25.5.jar
+log4j-jul-2.25.5.jar
+log4j-api-2.25.5.jar
spring-aop-6.1.21.jar
spring-shell-autoconfigure-3.3.3.jar
spring-shell-standard-commands-3.3.3.jar
diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
index 58a97aa2c7..6b9f2e54e7 100644
--- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
+++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
@@ -33,11 +33,11 @@ commons-lang3-3.18.0.jar
jaxb-runtime-4.0.2.jar
jaxb-core-4.0.2.jar
jakarta.xml.bind-api-4.0.2.jar
-log4j-slf4j-impl-2.25.4.jar
-log4j-core-2.25.4.jar
-log4j-jcl-2.25.4.jar
-log4j-jul-2.25.4.jar
-log4j-api-2.25.4.jar
+log4j-slf4j-impl-2.25.5.jar
+log4j-core-2.25.5.jar
+log4j-jcl-2.25.5.jar
+log4j-jul-2.25.5.jar
+log4j-api-2.25.5.jar
spring-shell-starter-3.3.3.jar
rmiio-2.1.2.jar
antlr-2.7.7.jar