Re: [ofbiz-framework] branch release18.12 updated: Improved: Apache Log4j2 (OFBIZ-12449)

2021-12-16 Thread Michael Brohl 

+1

Thanks,

Michael

Am 16.12.21 um 17:58 schrieb Jacques Le Roux:

Hi Jacopo,

+1, with now also Solr and Lucene

Jacques

Le 16/12/2021 à 17:13, Jacopo Cappellato a écrit :
I think it would be a good idea to prepare a new release with this 
change. WDYT?


Jacopo

On Tue, Dec 14, 2021 at 12:30 PM  wrote:

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch release18.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release18.12 by 
this push:

  new e83559d  Improved: Apache Log4j2 (OFBIZ-12449)
e83559d is described below

commit e83559d1516f69b127552a58c1e7fb288030abf2
Author: Jacques Le Roux 
AuthorDate: Tue Dec 14 12:28:38 2021 +0100

 Improved: Apache Log4j2 (OFBIZ-12449)

 Updates log4j2 from 2.15.0 to 2.16.0 because of
https://lists.apache.org/thread/d6v4r6nosxysyq9rvnr779336yf0woz4

 It's not a security issue, I lazily use OFBIZ-12449 because it 
can improve

 security even if it's not necessary (dixit the announce)
---
  build.gradle | 12 ++--
  1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/build.gradle b/build.gradle
index f8efad1..b6772f9 100644
--- a/build.gradle
+++ b/build.gradle
@@ -190,7 +190,7 @@ dependencies {
  compile 
'org.apache.geronimo.components:geronimo-transaction:3.1.4'

  compile 'org.apache.geronimo.specs:geronimo-jms_1.1_spec:1.1.1'
  compile 'org.apache.httpcomponents:httpclient-cache:4.5.6'
-    compile 'org.apache.logging.log4j:log4j-api:2.15.0' // the API 
of log4j 2
+    compile 'org.apache.logging.log4j:log4j-api:2.16.0' // the API 
of log4j 2

  compile 'org.apache.poi:poi:3.17'
  compile 'org.apache.pdfbox:pdfbox:2.0.24'
  compile 'org.apache.shiro:shiro-core:1.4.0'
@@ -231,11 +231,11 @@ dependencies {
  runtime 'org.apache.axis2:axis2-transport-local:1.7.8'
  runtime 'org.apache.derby:derby:10.14.2.0'
  runtime 'org.apache.geronimo.specs:geronimo-jaxrpc_1.1_spec:1.1'
-    runtime 'org.apache.logging.log4j:log4j-1.2-api:2.15.0' // for 
external jars using the old log4j1.2: routes logging to log4j 2
-    runtime 'org.apache.logging.log4j:log4j-core:2.15.0' // the 
implementation of the log4j 2 API
-    runtime 'org.apache.logging.log4j:log4j-jul:2.15.0' // for 
external jars using the java.util.logging: routes logging to log4j 2
-    runtime 'org.apache.logging.log4j:log4j-slf4j-impl:2.15.0' // 
for external jars using slf4j: routes logging to log4j 2
-    runtime 'org.apache.logging.log4j:log4j-jcl:2.15.0' // need to 
constrain to version to avoid classpath conflict (ReflectionUtil)
+    runtime 'org.apache.logging.log4j:log4j-1.2-api:2.16.0' // for 
external jars using the old log4j1.2: routes logging to log4j 2
+    runtime 'org.apache.logging.log4j:log4j-core:2.16.0' // the 
implementation of the log4j 2 API
+    runtime 'org.apache.logging.log4j:log4j-jul:2.16.0' // for 
external jars using the java.util.logging: routes logging to log4j 2
+    runtime 'org.apache.logging.log4j:log4j-slf4j-impl:2.16.0' // 
for external jars using slf4j: routes logging to log4j 2
+    runtime 'org.apache.logging.log4j:log4j-jcl:2.16.0' // need to 
constrain to version to avoid classpath conflict (ReflectionUtil)
  runtime 
'org.codeartisans.thirdparties.swing:batik-all:1.8pre-r1084380'


  // plugin libs

Re: [ofbiz-framework] branch release18.12 updated: Improved: Apache Log4j2 (OFBIZ-12449)

2021-12-16 Thread Jacques Le Roux 

Hi Jacopo,

+1, with now also Solr and Lucene

Jacques

Le 16/12/2021 à 17:13, Jacopo Cappellato a écrit :

I think it would be a good idea to prepare a new release with this change. WDYT?

Jacopo

On Tue, Dec 14, 2021 at 12:30 PM  wrote:

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch release18.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release18.12 by this push:
  new e83559d  Improved: Apache Log4j2 (OFBIZ-12449)
e83559d is described below

commit e83559d1516f69b127552a58c1e7fb288030abf2
Author: Jacques Le Roux 
AuthorDate: Tue Dec 14 12:28:38 2021 +0100

 Improved: Apache Log4j2 (OFBIZ-12449)

 Updates log4j2 from 2.15.0 to 2.16.0 because of
 https://lists.apache.org/thread/d6v4r6nosxysyq9rvnr779336yf0woz4

 It's not a security issue, I lazily use OFBIZ-12449 because it can improve
 security even if it's not necessary (dixit the announce)
---
  build.gradle | 12 ++--
  1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/build.gradle b/build.gradle
index f8efad1..b6772f9 100644
--- a/build.gradle
+++ b/build.gradle
@@ -190,7 +190,7 @@ dependencies {
  compile 'org.apache.geronimo.components:geronimo-transaction:3.1.4'
  compile 'org.apache.geronimo.specs:geronimo-jms_1.1_spec:1.1.1'
  compile 'org.apache.httpcomponents:httpclient-cache:4.5.6'
-compile 'org.apache.logging.log4j:log4j-api:2.15.0' // the API of log4j 2
+compile 'org.apache.logging.log4j:log4j-api:2.16.0' // the API of log4j 2
  compile 'org.apache.poi:poi:3.17'
  compile 'org.apache.pdfbox:pdfbox:2.0.24'
  compile 'org.apache.shiro:shiro-core:1.4.0'
@@ -231,11 +231,11 @@ dependencies {
  runtime 'org.apache.axis2:axis2-transport-local:1.7.8'
  runtime 'org.apache.derby:derby:10.14.2.0'
  runtime 'org.apache.geronimo.specs:geronimo-jaxrpc_1.1_spec:1.1'
-runtime 'org.apache.logging.log4j:log4j-1.2-api:2.15.0' // for external 
jars using the old log4j1.2: routes logging to log4j 2
-runtime 'org.apache.logging.log4j:log4j-core:2.15.0' // the implementation 
of the log4j 2 API
-runtime 'org.apache.logging.log4j:log4j-jul:2.15.0' // for external jars 
using the java.util.logging: routes logging to log4j 2
-runtime 'org.apache.logging.log4j:log4j-slf4j-impl:2.15.0' // for external 
jars using slf4j: routes logging to log4j 2
-runtime 'org.apache.logging.log4j:log4j-jcl:2.15.0' // need to constrain 
to version to avoid classpath conflict (ReflectionUtil)
+runtime 'org.apache.logging.log4j:log4j-1.2-api:2.16.0' // for external 
jars using the old log4j1.2: routes logging to log4j 2
+runtime 'org.apache.logging.log4j:log4j-core:2.16.0' // the implementation 
of the log4j 2 API
+runtime 'org.apache.logging.log4j:log4j-jul:2.16.0' // for external jars 
using the java.util.logging: routes logging to log4j 2
+runtime 'org.apache.logging.log4j:log4j-slf4j-impl:2.16.0' // for external 
jars using slf4j: routes logging to log4j 2
+runtime 'org.apache.logging.log4j:log4j-jcl:2.16.0' // need to constrain 
to version to avoid classpath conflict (ReflectionUtil)
  runtime 'org.codeartisans.thirdparties.swing:batik-all:1.8pre-r1084380'

  // plugin libs

Re: [ofbiz-framework] branch release18.12 updated: Improved: Apache Log4j2 (OFBIZ-12449)

2021-12-16 Thread Jacopo Cappellato 
I think it would be a good idea to prepare a new release with this change. WDYT?

Jacopo

On Tue, Dec 14, 2021 at 12:30 PM  wrote:
>
> This is an automated email from the ASF dual-hosted git repository.
>
> jleroux pushed a commit to branch release18.12
> in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
>
>
> The following commit(s) were added to refs/heads/release18.12 by this push:
>  new e83559d  Improved: Apache Log4j2 (OFBIZ-12449)
> e83559d is described below
>
> commit e83559d1516f69b127552a58c1e7fb288030abf2
> Author: Jacques Le Roux 
> AuthorDate: Tue Dec 14 12:28:38 2021 +0100
>
> Improved: Apache Log4j2 (OFBIZ-12449)
>
> Updates log4j2 from 2.15.0 to 2.16.0 because of
> https://lists.apache.org/thread/d6v4r6nosxysyq9rvnr779336yf0woz4
>
> It's not a security issue, I lazily use OFBIZ-12449 because it can improve
> security even if it's not necessary (dixit the announce)
> ---
>  build.gradle | 12 ++--
>  1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/build.gradle b/build.gradle
> index f8efad1..b6772f9 100644
> --- a/build.gradle
> +++ b/build.gradle
> @@ -190,7 +190,7 @@ dependencies {
>  compile 'org.apache.geronimo.components:geronimo-transaction:3.1.4'
>  compile 'org.apache.geronimo.specs:geronimo-jms_1.1_spec:1.1.1'
>  compile 'org.apache.httpcomponents:httpclient-cache:4.5.6'
> -compile 'org.apache.logging.log4j:log4j-api:2.15.0' // the API of log4j 2
> +compile 'org.apache.logging.log4j:log4j-api:2.16.0' // the API of log4j 2
>  compile 'org.apache.poi:poi:3.17'
>  compile 'org.apache.pdfbox:pdfbox:2.0.24'
>  compile 'org.apache.shiro:shiro-core:1.4.0'
> @@ -231,11 +231,11 @@ dependencies {
>  runtime 'org.apache.axis2:axis2-transport-local:1.7.8'
>  runtime 'org.apache.derby:derby:10.14.2.0'
>  runtime 'org.apache.geronimo.specs:geronimo-jaxrpc_1.1_spec:1.1'
> -runtime 'org.apache.logging.log4j:log4j-1.2-api:2.15.0' // for external 
> jars using the old log4j1.2: routes logging to log4j 2
> -runtime 'org.apache.logging.log4j:log4j-core:2.15.0' // the 
> implementation of the log4j 2 API
> -runtime 'org.apache.logging.log4j:log4j-jul:2.15.0' // for external jars 
> using the java.util.logging: routes logging to log4j 2
> -runtime 'org.apache.logging.log4j:log4j-slf4j-impl:2.15.0' // for 
> external jars using slf4j: routes logging to log4j 2
> -runtime 'org.apache.logging.log4j:log4j-jcl:2.15.0' // need to constrain 
> to version to avoid classpath conflict (ReflectionUtil)
> +runtime 'org.apache.logging.log4j:log4j-1.2-api:2.16.0' // for external 
> jars using the old log4j1.2: routes logging to log4j 2
> +runtime 'org.apache.logging.log4j:log4j-core:2.16.0' // the 
> implementation of the log4j 2 API
> +runtime 'org.apache.logging.log4j:log4j-jul:2.16.0' // for external jars 
> using the java.util.logging: routes logging to log4j 2
> +runtime 'org.apache.logging.log4j:log4j-slf4j-impl:2.16.0' // for 
> external jars using slf4j: routes logging to log4j 2
> +runtime 'org.apache.logging.log4j:log4j-jcl:2.16.0' // need to constrain 
> to version to avoid classpath conflict (ReflectionUtil)
>  runtime 'org.codeartisans.thirdparties.swing:batik-all:1.8pre-r1084380'
>
>  // plugin libs