bitflicker64 commented on code in PR #763:
URL:
https://github.com/apache/hugegraph-toolchain/pull/763#discussion_r3910148209
##########
hugegraph-dist/scripts/dependency/known-dependencies.txt:
##########
@@ -382,9 +382,9 @@
listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
log4j-1.2-api-2.11.2.jar
log4j-1.2-api-2.17.1.jar
log4j-1.2.17.jar
-log4j-api-2.18.0.jar
-log4j-core-2.18.0.jar
-log4j-slf4j-impl-2.18.0.jar
+log4j-api-2.25.5.jar
Review Comment:
⚠️ This PR is based on
`dependabot/maven/org.apache.logging.log4j-log4j-api-2.25.5` (the head branch
of #757) rather than `master`, so merging it lands the fix on a Dependabot
branch and not where it is actually needed.
#757's own `check-dependency-license` job already fails (run 31735150807,
job 94564869017), and the diff it prints is exactly the four lines this PR
applies:
```
@@ -385,3 +385,3 @@
-log4j-api-2.18.0.jar
-log4j-core-2.18.0.jar
-log4j-slf4j-impl-2.18.0.jar
+log4j-api-2.25.5.jar
+log4j-core-2.25.5.jar
+log4j-slf4j-impl-2.25.5.jar
@@ -469,0 +470 @@
+slf4j-api-1.7.36.jar
```
#762 fails the same job. Both target `master` and change only the two poms,
so merging either one alone leaves master with `log4j2.version` 2.25.5 and this
manifest still listing the 2.18.0 jars.
Two further consequences of the base ref: GitHub closes a PR when its base
branch is deleted, so this one closes the moment #757 is merged or closed, and
a Dependabot rebase force-pushes that base branch, shifting the merge base
under this PR.
Please retarget this PR to `master`. 45b858d1 already has bf72e645 in its
ancestry, so the diff against master carries the two pom bumps together with
this manifest refresh and turns that failing job green in one change.
##########
hugegraph-dist/scripts/dependency/known-dependencies.txt:
##########
@@ -467,6 +467,7 @@ sketches-core-0.9.0.jar
slf4j-api-1.7.25.jar
slf4j-api-1.7.28.jar
slf4j-api-1.7.30.jar
+slf4j-api-1.7.36.jar
Review Comment:
🧹 `hugegraph-dist/release-docs/LICENSE` is copied verbatim into the release
tarball (`hugegraph-dist/pom.xml`, package phase: `cp -r -v
$root_path/hugegraph-dist/release-docs/* ${final.name}/`), and at this head it
still records `org.apache.logging.log4j:log4j-api:2.18.0` (line 284),
`log4j-core:2.18.0` (285) and `log4j-slf4j-impl:2.18.0` (287), with no
`org.slf4j:slf4j-api:1.7.36` entry at all (its SLF4J block stops at 1.7.30,
lines 593 to 595).
To be fair, that drift is pre-existing and wider than these four entries: 27
`group:artifact:version` entries in that LICENSE have no matching jar in
`known-dependencies.txt`, including `log4j-jul:2.11.2`, `lombok:1.18.8`
(manifest has 1.18.32) and `curator-client:2.13.0` (manifest has 4.2.0). No CI
job checks the file, and the version bump itself is in the parent commit rather
than in this diff.
Still worth refreshing the four log4j and slf4j entries alongside the
manifest here, or opening a follow-up to regenerate the file as a whole.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
