Skip to content

Upgrade Log4j to 2.25.2 #3603

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Upgrade Log4j to 2.25.2 #3603

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
898d71b
Update apache.log4j to v2.25.1
solrbot Sep 2, 2025
0515c99
fix: drop redundant annotation libraries
ppkarwasz Sep 2, 2025
ef873f3
fix: exclude SpotBugs annotations from transitive deps
ppkarwasz Sep 2, 2025
4affade
fix: upgrade to Log4j `2.25.2`
ppkarwasz Sep 23, 2025
22f42e5
Merge remote-tracking branch 'apache/main' into chore/upgrade-log4j
ppkarwasz Sep 23, 2025
ff2e69b
fix: document exclusion of `spotbugs-annotations`
ppkarwasz Sep 23, 2025
df7cd63
fix: update Log4j checksums
ppkarwasz Sep 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions gradle/libs.versions.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ apache-httpcomponents-httpclient = "4.5.14"
apache-httpcomponents-httpcore = "4.4.16"
apache-httpcomponents-httpmime = "4.5.14"
apache-kafka = "3.9.0"
apache-log4j = "2.21.0"
apache-log4j = "2.25.1"
apache-lucene = "10.2.1"
apache-opennlp = "2.5.3"
apache-poi = "5.2.2"
Expand All @@ -46,7 +46,6 @@ apache-tomcat = "6.0.53"
apache-zookeeper = "3.9.4"
# @keep for version alignment
apiguardian = "1.1.2"
aqute-bnd = "6.4.1"
# @keep Asciidoctor mathjax version used in ref-guide
asciidoctor-mathjax = "0.0.9"
# @keep Asciidoctor tabs version used in ref-guide
Expand Down Expand Up @@ -174,7 +173,6 @@ nodejs = "22.18.0"
openapi = "7.14.0"
openjdk-jmh = "1.37"
opentelemetry = "1.53.0"
osgi-annotation = "8.1.0"
oshai-logging = "7.0.13"
# @keep for version alignment
ow2-asm = "9.8"
Expand Down Expand Up @@ -296,7 +294,6 @@ apache-zookeeper-jute = { module = "org.apache.zookeeper:zookeeper-jute", versio
apache-zookeeper-zookeeper = { module = "org.apache.zookeeper:zookeeper", version.ref = "apache-zookeeper" }
# @keep transitive dependency for version alignment
apiguardian-api = { module = "org.apiguardian:apiguardian-api", version.ref = "apiguardian" }
aqute-bnd-annotation = { module = "biz.aQute.bnd:biz.aQute.bnd.annotation", version.ref = "aqute-bnd" }
bc-jose4j = { module = "org.bitbucket.b_c:jose4j", version.ref = "bc-jose4j" }
benmanes-caffeine = { module = "com.github.ben-manes.caffeine:caffeine", version.ref = "benmanes-caffeine" }
bouncycastle-bcpkix = { module = "org.bouncycastle:bcpkix-jdk18on", version.ref = "bouncycastle" }
Expand Down Expand Up @@ -483,7 +480,6 @@ opentelemetry-sdk = { module = "io.opentelemetry:opentelemetry-sdk", version.ref
opentelemetry-sdkextension-autoconfigure = { module = "io.opentelemetry:opentelemetry-sdk-extension-autoconfigure", version.ref = "opentelemetry" }
opentelemetry-sdktesting = { module = "io.opentelemetry:opentelemetry-sdk-testing", version.ref = "opentelemetry" }
opentelemetry-sdktrace = { module = "io.opentelemetry:opentelemetry-sdk-trace", version.ref = "opentelemetry" }
osgi-annotation = { module = "org.osgi:osgi.annotation", version.ref = "osgi-annotation" }
oshai-logging = { module = "io.github.oshai:kotlin-logging", version.ref = "oshai-logging" }
# @keep transitive dependency for version alignment
ow2-asm-asm = { module = "org.ow2.asm:asm", version.ref = "ow2-asm" }
Expand Down
6 changes: 3 additions & 3 deletions solr/api/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,9 +108,9 @@ org.apache.curator:curator-test:5.9.0=jarValidation,testRuntimeClasspath
org.apache.httpcomponents:httpclient:4.5.14=jarValidation,testCompileClasspath,testRuntimeClasspath
org.apache.httpcomponents:httpcore:4.4.16=jarValidation,testCompileClasspath,testRuntimeClasspath
org.apache.httpcomponents:httpmime:4.5.14=jarValidation,testCompileClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-api:2.21.0=jarValidation,testRuntimeClasspath
org.apache.logging.log4j:log4j-core:2.21.0=jarValidation,testRuntimeClasspath
org.apache.logging.log4j:log4j-slf4j2-impl:2.21.0=jarValidation,testRuntimeClasspath
org.apache.logging.log4j:log4j-api:2.25.1=jarValidation,testRuntimeClasspath
org.apache.logging.log4j:log4j-core:2.25.1=jarValidation,testRuntimeClasspath
org.apache.logging.log4j:log4j-slf4j2-impl:2.25.1=jarValidation,testRuntimeClasspath
org.apache.lucene:lucene-analysis-common:10.2.1=jarValidation,testCompileClasspath,testRuntimeClasspath
org.apache.lucene:lucene-analysis-kuromoji:10.2.1=jarValidation,testRuntimeClasspath
org.apache.lucene:lucene-analysis-nori:10.2.1=jarValidation,testRuntimeClasspath
Expand Down
6 changes: 3 additions & 3 deletions solr/benchmark/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,9 @@ org.apache.curator:curator-test:5.9.0=jarValidation,runtimeClasspath,testRuntime
org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,jarValidation,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.httpcomponents:httpcore:4.4.16=compileClasspath,jarValidation,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.httpcomponents:httpmime:4.5.14=compileClasspath,jarValidation,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-api:2.21.0=jarValidation,runtimeClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-core:2.21.0=jarValidation,runtimeClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-slf4j2-impl:2.21.0=jarValidation,runtimeClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-api:2.25.1=jarValidation,runtimeClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-core:2.25.1=jarValidation,runtimeClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-slf4j2-impl:2.25.1=jarValidation,runtimeClasspath,testRuntimeClasspath
org.apache.lucene:lucene-analysis-common:10.2.1=compileClasspath,jarValidation,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.lucene:lucene-analysis-kuromoji:10.2.1=jarValidation,runtimeClasspath,testRuntimeClasspath
org.apache.lucene:lucene-analysis-nori:10.2.1=jarValidation,runtimeClasspath,testRuntimeClasspath
Expand Down
3 changes: 0 additions & 3 deletions solr/core/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,9 +175,6 @@ dependencies {
// For faster XML processing than the JDK
implementation libs.codehaus.woodstox.stax2api
implementation libs.fasterxml.woodstox.core
// See https://issues.apache.org/jira/browse/LOG4J2-3609 due to needing these annotations
compileOnly libs.aqute.bnd.annotation
compileOnly libs.osgi.annotation

compileOnly libs.stephenc.jcip.annotations

Expand Down
20 changes: 11 additions & 9 deletions solr/core/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# This is a Gradle generated file for dependency locking.
# Manual edits can break the build and are not advised.
# This file is expected to be part of source control.
biz.aQute.bnd:biz.aQute.bnd.annotation:6.4.1=compileClasspath,compileOnlyHelper,jarValidation
biz.aQute.bnd:biz.aQute.bnd.annotation:7.1.0=compileClasspath,testCompileClasspath
com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.8.3=jarValidation,testCompileClasspath,testRuntimeClasspath
com.carrotsearch:hppc:0.10.0=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
com.fasterxml.jackson.core:jackson-annotations:2.18.0=permitUnusedDeclared
Expand All @@ -26,7 +26,8 @@ com.google.auto.value:auto-value-annotations:1.10.4=annotationProcessor,errorpro
com.google.auto:auto-common:1.2.2=annotationProcessor,errorprone,testAnnotationProcessor
com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,errorprone,permitUnusedDeclared,testAnnotationProcessor
com.google.errorprone:error_prone_annotation:2.31.0=annotationProcessor,errorprone,testAnnotationProcessor
com.google.errorprone:error_prone_annotations:2.31.0=annotationProcessor,apiHelper,compileClasspath,errorprone,jarValidation,runtimeClasspath,runtimeLibs,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
com.google.errorprone:error_prone_annotations:2.31.0=annotationProcessor,apiHelper,errorprone,jarValidation,runtimeClasspath,runtimeLibs,testAnnotationProcessor,testRuntimeClasspath
com.google.errorprone:error_prone_annotations:2.38.0=compileClasspath,testCompileClasspath
com.google.errorprone:error_prone_check_api:2.31.0=annotationProcessor,errorprone,testAnnotationProcessor
com.google.errorprone:error_prone_core:2.31.0=annotationProcessor,errorprone,testAnnotationProcessor
com.google.errorprone:error_prone_type_annotations:2.31.0=annotationProcessor,errorprone,testAnnotationProcessor
Expand Down Expand Up @@ -91,9 +92,9 @@ org.apache.curator:curator-test:5.9.0=jarValidation,testCompileClasspath,testRun
org.apache.httpcomponents:httpclient:4.5.14=apiHelper,compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
org.apache.httpcomponents:httpcore:4.4.16=apiHelper,compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
org.apache.httpcomponents:httpmime:4.5.14=apiHelper,compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-api:2.21.0=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-core:2.21.0=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-slf4j2-impl:2.21.0=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
org.apache.logging.log4j:log4j-api:2.25.1=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-core:2.25.1=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-slf4j2-impl:2.25.1=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
org.apache.lucene:lucene-analysis-common:10.2.1=apiHelper,compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
org.apache.lucene:lucene-analysis-icu:10.2.1=jarValidation,testRuntimeClasspath
org.apache.lucene:lucene-analysis-kuromoji:10.2.1=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
Expand Down Expand Up @@ -175,7 +176,7 @@ org.glassfish.jersey.inject:jersey-hk2:3.1.11=compileClasspath,jarValidation,per
org.glassfish.jersey.media:jersey-media-json-jackson:3.1.11=compileClasspath,jarValidation,permitUnusedDeclared,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
org.hamcrest:hamcrest:3.0=jarValidation,testCompileClasspath,testRuntimeClasspath
org.javassist:javassist:3.30.2-GA=compileClasspath,jarValidation,permitUnusedDeclared,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
org.jspecify:jspecify:1.0.0=annotationProcessor,apiHelper,errorprone,jarValidation,runtimeClasspath,runtimeLibs,testAnnotationProcessor,testRuntimeClasspath
org.jspecify:jspecify:1.0.0=annotationProcessor,apiHelper,compileClasspath,errorprone,jarValidation,runtimeClasspath,runtimeLibs,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
org.junit.jupiter:junit-jupiter-api:5.6.2=jarValidation,testCompileClasspath,testRuntimeClasspath
org.junit.platform:junit-platform-commons:1.6.2=jarValidation,testCompileClasspath,testRuntimeClasspath
org.junit:junit-bom:5.6.2=jarValidation,testCompileClasspath,testRuntimeClasspath
Expand All @@ -184,9 +185,10 @@ org.mockito:mockito-core:5.19.0=jarValidation,testCompileClasspath,testRuntimeCl
org.mockito:mockito-subclass:5.19.0=jarValidation,testRuntimeClasspath
org.objenesis:objenesis:3.3=jarValidation,testRuntimeClasspath
org.opentest4j:opentest4j:1.2.0=jarValidation,testCompileClasspath,testRuntimeClasspath
org.osgi:org.osgi.resource:1.0.0=compileClasspath,compileOnlyHelper,jarValidation
org.osgi:org.osgi.service.serviceloader:1.0.0=compileClasspath,compileOnlyHelper,jarValidation
org.osgi:osgi.annotation:8.1.0=compileClasspath,compileOnlyHelper,jarValidation
org.osgi:org.osgi.annotation.bundle:2.0.0=compileClasspath,testCompileClasspath
org.osgi:org.osgi.annotation.versioning:1.1.2=compileClasspath,testCompileClasspath
org.osgi:org.osgi.resource:1.0.0=compileClasspath,testCompileClasspath
org.osgi:org.osgi.service.serviceloader:1.0.0=compileClasspath,testCompileClasspath
org.ow2.asm:asm-commons:9.8=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
org.ow2.asm:asm-tree:9.8=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
org.ow2.asm:asm:9.8=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
Expand Down
12 changes: 6 additions & 6 deletions solr/cross-dc-manager/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,12 +113,12 @@ org.apache.kafka:kafka-streams:3.9.0=jarValidation,runtimeClasspath,runtimeLibs,
org.apache.kafka:kafka-tools-api:3.9.0=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
org.apache.kafka:kafka-transaction-coordinator:3.9.0=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
org.apache.kafka:kafka_2.13:3.9.0=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
org.apache.logging.log4j:log4j-1.2-api:2.21.0=solrPlatformLibs
org.apache.logging.log4j:log4j-api:2.21.0=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
org.apache.logging.log4j:log4j-core:2.21.0=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
org.apache.logging.log4j:log4j-layout-template-json:2.21.0=solrPlatformLibs
org.apache.logging.log4j:log4j-slf4j2-impl:2.21.0=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
org.apache.logging.log4j:log4j-web:2.21.0=solrPlatformLibs
org.apache.logging.log4j:log4j-1.2-api:2.25.1=solrPlatformLibs
org.apache.logging.log4j:log4j-api:2.25.1=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
org.apache.logging.log4j:log4j-core:2.25.1=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
org.apache.logging.log4j:log4j-layout-template-json:2.25.1=solrPlatformLibs
org.apache.logging.log4j:log4j-slf4j2-impl:2.25.1=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
org.apache.logging.log4j:log4j-web:2.25.1=solrPlatformLibs
org.apache.lucene:lucene-analysis-common:10.2.1=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testCompileClasspath,testRuntimeClasspath
org.apache.lucene:lucene-analysis-kuromoji:10.2.1=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
org.apache.lucene:lucene-analysis-nori:10.2.1=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
Expand Down
1 change: 0 additions & 1 deletion solr/licenses/biz.aQute.bnd.annotation-6.4.1.jar.sha1
View file
Open in desktop

This file was deleted.

1 change: 1 addition & 0 deletions solr/licenses/biz.aQute.bnd.annotation-7.1.0.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
2f2be18c936d08cf46ea6cfa0043f34afdf38705
1 change: 0 additions & 1 deletion solr/licenses/log4j-1.2-api-2.21.0.jar.sha1
View file
Open in desktop

This file was deleted.

1 change: 1 addition & 0 deletions solr/licenses/log4j-1.2-api-2.25.1.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
08b3667ec8ee781429169b612b7ca6d6a30682b9
1 change: 0 additions & 1 deletion solr/licenses/log4j-api-2.21.0.jar.sha1
View file
Open in desktop

This file was deleted.

1 change: 1 addition & 0 deletions solr/licenses/log4j-api-2.25.1.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
c7acbbd6f110cd1457c628da46245e355b1ee57a
1 change: 0 additions & 1 deletion solr/licenses/log4j-core-2.21.0.jar.sha1
View file
Open in desktop

This file was deleted.

1 change: 1 addition & 0 deletions solr/licenses/log4j-core-2.25.1.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
32b3a228d5a30a4528b6c7354fe6cff9524d89e7
1 change: 0 additions & 1 deletion solr/licenses/log4j-layout-template-json-2.21.0.jar.sha1
View file
Open in desktop

This file was deleted.

1 change: 1 addition & 0 deletions solr/licenses/log4j-layout-template-json-2.25.1.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
263c54fd8f2bb69b4f4cd34667a1b95353c5d95b
1 change: 0 additions & 1 deletion solr/licenses/log4j-slf4j2-impl-2.21.0.jar.sha1
View file
Open in desktop

This file was deleted.

1 change: 1 addition & 0 deletions solr/licenses/log4j-slf4j2-impl-2.25.1.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
a5ed4c3e2effa2575a4dde13f9101bfe23ccfb1a
1 change: 0 additions & 1 deletion solr/licenses/log4j-web-2.21.0.jar.sha1
View file
Open in desktop

This file was deleted.

1 change: 1 addition & 0 deletions solr/licenses/log4j-web-2.25.1.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
dce89bd45afd0259f56dfc825c41a26c4d1f9c5c
1 change: 1 addition & 0 deletions solr/licenses/org.osgi.annotation.bundle-2.0.0.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
f5c2cd6e670c3c5d440d3003efd5ef2ead5c68eb
Loading