Bump log4j from 2.21.0 to 2.25.3#20308
Conversation
Signed-off-by: Craig Perkins <cwperx@amazon.com>
WalkthroughBumps Log4j artifacts from 2.21.0 to 2.25.3, centralizes an Changes
Sequence Diagram(s)(omitted — changes are dependency/license/test filtering and do not introduce a new multi-component control flow requiring a sequence diagram) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: defaults Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (20)
Comment |
Signed-off-by: Craig Perkins <cwperx@amazon.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (4)
plugins/repository-s3/licenses/log4j-1.2-api-2.25.3.jar.sha1 (1)
1-1: Checksum matches other modules.This checksum is identical to other log4j-1.2-api-2.25.3.jar.sha1 files across modules, which is correct. Verification requested in the discovery-gce file applies here as well.
plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.25.3.jar.sha1 (1)
1-1: Checksum matches other modules.This checksum is identical to the repository-s3 log4j-slf4j-impl-2.25.3.jar.sha1 file, which is correct. Verification requested in that file applies here as well.
plugins/discovery-ec2/licenses/log4j-1.2-api-2.25.3.jar.sha1 (1)
1-1: Checksum matches other modules.This checksum is identical to other log4j-1.2-api-2.25.3.jar.sha1 files, which is expected. Verification requested in the discovery-gce file applies here.
plugins/crypto-kms/licenses/log4j-1.2-api-2.25.3.jar.sha1 (1)
1-1: Checksum matches other modules.This checksum is identical to other log4j-1.2-api-2.25.3.jar.sha1 files across modules, which is correct. Verification requested in the discovery-gce file applies here.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (37)
CHANGELOG.mdgradle/libs.versions.tomllibs/core/build.gradlelibs/core/licenses/log4j-api-2.21.0.jar.sha1libs/core/licenses/log4j-api-2.25.3.jar.sha1modules/transport-grpc/build.gradlemodules/transport-grpc/licenses/error_prone_annotations-2.24.1.jar.sha1modules/transport-grpc/licenses/error_prone_annotations-LICENSE.txtmodules/transport-grpc/licenses/error_prone_annotations-NOTICE.txtplugins/arrow-flight-rpc/build.gradleplugins/arrow-flight-rpc/licenses/error_prone_annotations-2.31.0.jar.sha1plugins/arrow-flight-rpc/licenses/error_prone_annotations-LICENSE.txtplugins/arrow-flight-rpc/licenses/error_prone_annotations-NOTICE.txtplugins/crypto-kms/licenses/log4j-1.2-api-2.21.0.jar.sha1plugins/crypto-kms/licenses/log4j-1.2-api-2.25.3.jar.sha1plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.21.0.jar.sha1plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.25.3.jar.sha1plugins/discovery-ec2/licenses/log4j-1.2-api-2.21.0.jar.sha1plugins/discovery-ec2/licenses/log4j-1.2-api-2.25.3.jar.sha1plugins/discovery-gce/licenses/log4j-1.2-api-2.21.0.jar.sha1plugins/discovery-gce/licenses/log4j-1.2-api-2.25.3.jar.sha1plugins/repository-gcs/build.gradleplugins/repository-hdfs/licenses/log4j-slf4j-impl-2.21.0.jar.sha1plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.25.3.jar.sha1plugins/repository-s3/build.gradleplugins/repository-s3/licenses/log4j-1.2-api-2.21.0.jar.sha1plugins/repository-s3/licenses/log4j-1.2-api-2.25.3.jar.sha1plugins/repository-s3/licenses/log4j-slf4j-impl-2.21.0.jar.sha1plugins/repository-s3/licenses/log4j-slf4j-impl-2.25.3.jar.sha1server/build.gradleserver/licenses/log4j-api-2.21.0.jar.sha1server/licenses/log4j-api-2.25.3.jar.sha1server/licenses/log4j-core-2.21.0.jar.sha1server/licenses/log4j-core-2.25.3.jar.sha1server/licenses/log4j-jul-2.21.0.jar.sha1server/licenses/log4j-jul-2.25.3.jar.sha1test/logger-usage/build.gradle
💤 Files with no reviewable changes (19)
- plugins/repository-gcs/build.gradle
- plugins/crypto-kms/licenses/log4j-1.2-api-2.21.0.jar.sha1
- plugins/arrow-flight-rpc/build.gradle
- server/licenses/log4j-api-2.21.0.jar.sha1
- plugins/repository-s3/licenses/log4j-1.2-api-2.21.0.jar.sha1
- plugins/repository-s3/licenses/log4j-slf4j-impl-2.21.0.jar.sha1
- plugins/discovery-ec2/licenses/log4j-1.2-api-2.21.0.jar.sha1
- plugins/arrow-flight-rpc/licenses/error_prone_annotations-LICENSE.txt
- libs/core/licenses/log4j-api-2.21.0.jar.sha1
- plugins/repository-s3/build.gradle
- plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.21.0.jar.sha1
- modules/transport-grpc/licenses/error_prone_annotations-2.24.1.jar.sha1
- server/licenses/log4j-core-2.21.0.jar.sha1
- modules/transport-grpc/build.gradle
- server/licenses/log4j-jul-2.21.0.jar.sha1
- modules/transport-grpc/licenses/error_prone_annotations-LICENSE.txt
- plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.21.0.jar.sha1
- plugins/arrow-flight-rpc/licenses/error_prone_annotations-2.31.0.jar.sha1
- plugins/discovery-gce/licenses/log4j-1.2-api-2.21.0.jar.sha1
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (20)
- GitHub Check: gradle-check
- GitHub Check: precommit (25, macos-15)
- GitHub Check: precommit (21, ubuntu-24.04-arm)
- GitHub Check: precommit (25, ubuntu-latest)
- GitHub Check: precommit (21, windows-2025, true)
- GitHub Check: precommit (25, ubuntu-24.04-arm)
- GitHub Check: precommit (25, macos-15-intel)
- GitHub Check: precommit (21, ubuntu-latest)
- GitHub Check: precommit (21, macos-15)
- GitHub Check: precommit (21, windows-latest)
- GitHub Check: precommit (25, windows-latest)
- GitHub Check: precommit (21, macos-15-intel)
- GitHub Check: detect-breaking-change
- GitHub Check: assemble (21, ubuntu-latest)
- GitHub Check: assemble (21, ubuntu-24.04-arm)
- GitHub Check: assemble (25, ubuntu-24.04-arm)
- GitHub Check: assemble (25, ubuntu-latest)
- GitHub Check: assemble (25, windows-latest)
- GitHub Check: assemble (21, windows-latest)
- GitHub Check: Analyze (java)
🔇 Additional comments (13)
server/licenses/log4j-jul-2.25.3.jar.sha1 (1)
1-1: SHA-1 checksum verified against Maven Central.The SHA-1 hash
08bba6d5a56f11931c218c016c96b740e238abbcmatches the official log4j-jul-2.25.3.jar artifact from Maven Central.CHANGELOG.md (1)
35-35: Log4j 2.25.3 addresses SSL/TLS hostname verification issue.Log4j 2.25.3 resolves CVE-2025-68161, a medium-severity vulnerability affecting Socket Appender's TLS hostname verification in versions 2.0-beta9 through 2.25.2. No additional critical security advisories were identified for this version. However, verification of the specific bugs that triggered any previous revert requires review of the PR description, which is not available in this context.
plugins/repository-s3/licenses/log4j-slf4j-impl-2.25.3.jar.sha1 (1)
1-1: SHA-1 checksum verified against Maven Central.The stored SHA-1 hash
4a173925524d8f6c3f39ae8954ee348e8244afd7matches the official log4j-slf4j-impl-2.25.3.jar artifact from Maven Central Repository. Artifact integrity confirmed.plugins/discovery-gce/licenses/log4j-1.2-api-2.25.3.jar.sha1 (1)
1-1: Verify log4j-1.2-api-2.25.3 checksum against Maven Central.The checksum
a7e550e638a5e534fd944616c5ae665a67e9501eis consistently used across 5 plugins (crypto-kms, discovery-azure-classic, discovery-ec2, discovery-gce, and repository-s3). However, version 2.25.3 is not currently visible in Maven Central public repositories (latest documented version is 2.25.2). Confirm this version exists in your artifact repository and validate the checksum against the official source.server/licenses/log4j-api-2.25.3.jar.sha1 (1)
1-1: SHA1 checksum format is valid and consistent.The 40-character hex SHA1 hash matches the corresponding
libs/core/licenses/log4j-api-2.25.3.jar.sha1file, ensuring consistency across modules.server/licenses/log4j-core-2.25.3.jar.sha1 (1)
1-1: SHA1 checksum format is valid.The 40-character hex SHA1 hash for log4j-core-2.25.3.jar is correctly formatted.
libs/core/licenses/log4j-api-2.25.3.jar.sha1 (1)
1-1: SHA1 checksum is consistent with server module.The hash correctly matches
server/licenses/log4j-api-2.25.3.jar.sha1, confirming the same artifact is referenced.plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.25.3.jar.sha1 (1)
1-1: SHA1 checksum is valid and consistent across plugins.The 40-character hex hash for
log4j-1.2-api-2.25.3.jarmatches the checksums in other plugin directories (crypto-kms, discovery-ec2, discovery-gce), ensuring consistency.libs/core/build.gradle (1)
76-76: LGTM! OSGi optional dependency handling.The addition of
org.osgi.framework.wiring.BundleRevisionto the ignored classes is consistent with how other OSGi framework classes are already handled. Log4j uses OSGi classes optionally, and they're not available in the OpenSearch runtime environment.server/build.gradle (3)
245-245: LGTM! Standard handling of optional dependencies.The additions to
ignoreMissingClassesare appropriate:
com.fasterxml.jackson.databind.util.ClassUtil: Jackson databind utility, likely optionally used by log4j 2.25.3com.lmax.disruptor.EventHandler: LMAX Disruptor is used by log4j for async loggingorg.osgi.framework.wiring.BundleRevision: OSGi framework class, consistent with the change in libs/core/build.gradleThese are all optional dependencies that won't be present in the OpenSearch runtime environment.
Also applies to: 293-293, 344-344
98-100: Confirm log4j 2.25.3 addresses transitive dependency CVEs.Log4j 2.25.3 fully addresses CVE-2025-68161, which involves the SocketAppender failing to verify the TLS hostname on peer certificates. Before merging, verify that this CVE and any other transitive dependency vulnerabilities mentioned in the PR motivation are indeed resolved by this upgrade.
102-103: ThesecompileOnlyApidependencies are required by log4j 2.25.3 for Gradle compilation.Log4j 2.25.3 includes fixes for jspecify and error_prone_annotations dependency version resolution. These annotation libraries are made visible transitively at compile time for Gradle users through Gradle Module Metadata, so they must be explicitly declared in consuming projects like server. The version 1.0.0 for jspecify is the recommended standard.
test/logger-usage/build.gradle (1)
38-38: The error_prone_annotations dependency is correctly required for log4j 2.25.3 compatibility.The compileOnly declaration addresses an issue in log4j where the error_prone_annotations dependency version property was being erased during POM flattening, which was fixed in log4j 2.25.2+. This dependency must be explicitly declared at compile-time to avoid compilation issues when using log4j 2.25.3. The code in this module does not directly use error_prone annotations, but they are required transitively by log4j itself.
|
❌ Gradle check result for 66fa853: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
Signed-off-by: Craig Perkins <cwperx@amazon.com>
|
❌ Gradle check result for 587cd0b: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
Signed-off-by: Craig Perkins <cwperx@amazon.com>
cwperks
requested review from
Bukhtawar,
CEHENKLE,
Rishikesh1159,
anasalkouz,
andrross,
ashking94,
dbwiddis,
gbbafna,
jed326,
kotwanikunal,
mch2,
msfroh,
owaiskazi19,
reta,
sachinpkale,
saratvemulapalli,
shwetathareja and
sohami
as code owners
|
❌ Gradle check result for c0a6057: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #20308 +/- ##
============================================
+ Coverage 73.16% 73.24% +0.07%
- Complexity 71744 71807 +63
============================================
Files 5795 5795
Lines 328304 328304
Branches 47281 47281
============================================
+ Hits 240216 240464 +248
+ Misses 68822 68553 -269
- Partials 19266 19287 +21 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
The backport to To backport manually, run these commands in your terminal: # Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch/backport-2.19 2.19
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch/backport-2.19
# Create a new branch
git switch --create backport/backport-20308-to-2.19
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 e047211d6174d69e73e76a15fe57676ceb305781
# Push it to GitHub
git push --set-upstream origin backport/backport-20308-to-2.19
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch/backport-2.19Then, create a pull request where the |
|
I'll raise a manual backport for this. |
|
FYI, this bump introduced test failures in AD (at least) and maybe other plugins, (probably) due to apache/logging-log4j2#3929, which throws a NPE when rendering Mockito-generated exceptions (missing stack trace metadata). Testing a workaround until 2.26.x which we should update to when it comes out. |
* Bump log4j from 2.21.0 to 2.25.3 (#20308) * Bump log4j from 2.21.0 to 2.25.3 Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add CHANGELOG entry Signed-off-by: Craig Perkins <cwperx@amazon.com> * Filter out known messages Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix arg count Signed-off-by: Craig Perkins <cwperx@amazon.com> --------- Signed-off-by: Craig Perkins <cwperx@amazon.com> (cherry picked from commit e047211) * Update plugins/transport-grpc/build.gradle Co-authored-by: Andriy Redko <andriy.redko@aiven.io> Signed-off-by: Craig Perkins <craig5008@gmail.com> * Remove unused files Signed-off-by: Craig Perkins <cwperx@amazon.com> * Broaden perm Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix flaky test RemoteClusterStateServiceTests.testReadClusterStateInParallel_ExceptionDuringRead (#19437) Signed-off-by: Craig Perkins <cwperx@amazon.com> --------- Signed-off-by: Craig Perkins <cwperx@amazon.com> Signed-off-by: Craig Perkins <craig5008@gmail.com> Co-authored-by: Andriy Redko <andriy.redko@aiven.io>
* Bump log4j from 2.21.0 to 2.25.3 Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add CHANGELOG entry Signed-off-by: Craig Perkins <cwperx@amazon.com> * Filter out known messages Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix arg count Signed-off-by: Craig Perkins <cwperx@amazon.com> --------- Signed-off-by: Craig Perkins <cwperx@amazon.com>
* Bump log4j from 2.21.0 to 2.25.3 Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add CHANGELOG entry Signed-off-by: Craig Perkins <cwperx@amazon.com> * Filter out known messages Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix arg count Signed-off-by: Craig Perkins <cwperx@amazon.com> --------- Signed-off-by: Craig Perkins <cwperx@amazon.com>
2 participants
Description
We previously had to revert the log4j version bump due to some bugs in log4j that have since been resolved.
Log4j release notes: https://logging.apache.org/log4j/2.x/release-notes.html
Re-opening this as log4j is bringing in outdated dependencies with known CVEs so I think we should do the maintenance.
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.
Summary by CodeRabbit
Chores
Tests
✏️ Tip: You can customize this high-level summary in your review settings.