Sanikadze opened a new pull request, #121: URL: https://github.com/apache/cloudberry-pxf/pull/121
## Summary Bump log4j from 2.17.2 to 2.25.4. Closes CVE-2026-34480 (XmlLayout invalid XML output) and CVE-2026-34477 (SSL hostname verification bypass). ## Changes `server/build.gradle` - Add `ext['log4j2.version'] = '2.25.4'` so the version managed by the imported `spring-boot-dependencies` BOM (which pins log4j-bom 2.17.2) is overridden. A bomProperty override does not reach the nested log4j-bom, hence the explicit ext property. - Replace the `log4j-spring-boot:2.17.2` pin (and its junit excludes) with `log4j-spring-boot:2.25.4`. The excludes were a workaround for junit leaking into compileClasspath in 2.17.2; this was fixed upstream in 2.19.0, so at 2.25.4 they are dead code (the old comment said to remove them on upgrade). `server/pxf-service/build.gradle` - Add an explicit commons-logging dependency. log4j-spring-boot 2.25.4 no longer pulls it transitively, so without this it drops out of the jar. ## Verification - **Build and tests are green.** `./gradlew :pxf-api:test :pxf-service:test`on JDK 8 — BUILD SUCCESSFUL, 679 tests, 678 passed, 0 failed, 1 skipped.`api/core/jul/spring-boot`, with no junit leaked into the jar and commons-logging-1.1.3 present. - **Logging is healthy at runtime.** pxf-service.log is written with the expected Log4j2 layout, with zero `StatusLogger` init errors and no log4j config errors; -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
