This is an automated email from the ASF dual-hosted git repository. tuhaihe pushed a commit to branch REL_2_STABLE in repository https://gitbox.apache.org/repos/asf/cloudberry-pxf.git
commit e87c7eb8557395e7f0432c71d6dd8b8dfc6ca15b Author: Sanikadze <[email protected]> AuthorDate: Wed Jul 1 11:51:31 2026 +0300 Bump log4j to 2.25.4 (#121) Bump log4j from 2.17.2 to 2.25.4. Closes CVE-2026-34480 Signed-off-by: Sanikadze <[email protected]> Co-authored-by: Sanikadze <[email protected]> --- server/build.gradle | 15 +++------------ server/pxf-service/build.gradle | 1 + 2 files changed, 4 insertions(+), 12 deletions(-) diff --git a/server/build.gradle b/server/build.gradle index 7dd37720..7131e7c7 100644 --- a/server/build.gradle +++ b/server/build.gradle @@ -67,6 +67,8 @@ configure(javaProjects) { sourceCompatibility = JavaVersion.VERSION_1_8 targetCompatibility = JavaVersion.VERSION_1_8 + ext['log4j2.version'] = '2.25.4' + dependencyManagement { imports { mavenBom("org.springframework.boot:spring-boot-dependencies:${springBootVersion}") @@ -230,18 +232,7 @@ configure(javaProjects) { entry("aws-java-sdk-s3") } - // currently imported BOM spring-boot-dependencies:2.5.12 includes log4j-bom:2.17.2 and - // importing a module log4j-spring-boot:2.17.2 results in its transitive Junit dependencies - // being put into compileClasspath so we have to exclude them here so they are not shipped with PXF - // this is fixed in log4j-spring-boot:2.19.0, which is used by spring-boot-dependencies:3.0.0+ - // so when we upgrade to Spring Boot version 3.0.0+ we should remove this fix - // alternatively we can bump log4j-spring-boot to 2.19.0 and not use excludes - // dependency("org.apache.logging.log4j:log4j-spring-boot:2.19.0") - dependency("org.apache.logging.log4j:log4j-spring-boot:2.17.2") { - exclude("org.junit.vintage:junit-vintage-engine") - exclude("org.junit.jupiter:junit-jupiter-engine") - exclude("org.junit.jupiter:junit-jupiter-api") - } + dependency("org.apache.logging.log4j:log4j-spring-boot:2.25.4") } } diff --git a/server/pxf-service/build.gradle b/server/pxf-service/build.gradle index 2528ad31..69101bd2 100644 --- a/server/pxf-service/build.gradle +++ b/server/pxf-service/build.gradle @@ -35,6 +35,7 @@ dependencies { implementation("commons-codec:commons-codec") implementation("commons-collections:commons-collections") implementation("commons-lang:commons-lang") + implementation("commons-logging:commons-logging") implementation("org.springframework.boot:spring-boot-starter-log4j2") implementation("org.apache.logging.log4j:log4j-spring-boot") implementation('org.springframework.boot:spring-boot-starter-actuator') --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
