This is an automated email from the ASF dual-hosted git repository.
MisterRaindrop pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudberry-pxf.git
The following commit(s) were added to refs/heads/main by this push:
new 75cf1f61 Bump log4j to 2.25.4 (#121)
75cf1f61 is described below
commit 75cf1f61795bacf58f2f1e36eb97e57f8f935324
Author: Sanikadze <[email protected]>
AuthorDate: Wed Jul 1 11:51:31 2026 +0300
Bump log4j to 2.25.4 (#121)
Bump log4j from 2.17.2 to 2.25.4. Closes CVE-2026-34480
Signed-off-by: Sanikadze <[email protected]>
Co-authored-by: Sanikadze <[email protected]>
---
server/build.gradle | 15 +++------------
server/pxf-service/build.gradle | 1 +
2 files changed, 4 insertions(+), 12 deletions(-)
diff --git a/server/build.gradle b/server/build.gradle
index 7dd37720..7131e7c7 100644
--- a/server/build.gradle
+++ b/server/build.gradle
@@ -67,6 +67,8 @@ configure(javaProjects) {
sourceCompatibility = JavaVersion.VERSION_1_8
targetCompatibility = JavaVersion.VERSION_1_8
+ ext['log4j2.version'] = '2.25.4'
+
dependencyManagement {
imports {
mavenBom("org.springframework.boot:spring-boot-dependencies:${springBootVersion}")
@@ -230,18 +232,7 @@ configure(javaProjects) {
entry("aws-java-sdk-s3")
}
- // currently imported BOM spring-boot-dependencies:2.5.12 includes
log4j-bom:2.17.2 and
- // importing a module log4j-spring-boot:2.17.2 results in its
transitive Junit dependencies
- // being put into compileClasspath so we have to exclude them here
so they are not shipped with PXF
- // this is fixed in log4j-spring-boot:2.19.0, which is used by
spring-boot-dependencies:3.0.0+
- // so when we upgrade to Spring Boot version 3.0.0+ we should
remove this fix
- // alternatively we can bump log4j-spring-boot to 2.19.0 and not
use excludes
- // dependency("org.apache.logging.log4j:log4j-spring-boot:2.19.0")
- dependency("org.apache.logging.log4j:log4j-spring-boot:2.17.2") {
- exclude("org.junit.vintage:junit-vintage-engine")
- exclude("org.junit.jupiter:junit-jupiter-engine")
- exclude("org.junit.jupiter:junit-jupiter-api")
- }
+ dependency("org.apache.logging.log4j:log4j-spring-boot:2.25.4")
}
}
diff --git a/server/pxf-service/build.gradle b/server/pxf-service/build.gradle
index 2528ad31..69101bd2 100644
--- a/server/pxf-service/build.gradle
+++ b/server/pxf-service/build.gradle
@@ -35,6 +35,7 @@ dependencies {
implementation("commons-codec:commons-codec")
implementation("commons-collections:commons-collections")
implementation("commons-lang:commons-lang")
+ implementation("commons-logging:commons-logging")
implementation("org.springframework.boot:spring-boot-starter-log4j2")
implementation("org.apache.logging.log4j:log4j-spring-boot")
implementation('org.springframework.boot:spring-boot-starter-actuator')
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
