This is an automated email from the ASF dual-hosted git repository.
SteNicholas pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/celeborn.git
The following commit(s) were added to refs/heads/main by this push:
new 180db931b [CELEBORN-2326] Bump log4j-core version up to 2.25.4
180db931b is described below
commit 180db931beb410bcfab80d9abb3be9de9aaf2553
Author: Yuriy Malygin <[email protected]>
AuthorDate: Tue May 26 09:58:05 2026 +0800
[CELEBORN-2326] Bump log4j-core version up to 2.25.4
### What changes were proposed in this pull request?
Bump Log4j2 version from 2.24.3 to 2.25.4
### Why are the changes needed?
Apache Celeborn currently depends on Apache Log4j Core versions affected by
CVE-2026-34480.
### Does this PR resolve a correctness bug?
No.
### Does this PR introduce any user-facing change?
No.
### How was this patch tested?
CI.
Closes #3684 from yuriymalygin/patch-1.
Authored-by: Yuriy Malygin <[email protected]>
Signed-off-by: SteNicholas <[email protected]>
---
dev/deps/dependencies-server | 8 ++++----
pom.xml | 2 +-
project/CelebornBuild.scala | 2 +-
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/dev/deps/dependencies-server b/dev/deps/dependencies-server
index d404cb1c3..7796756d3 100644
--- a/dev/deps/dependencies-server
+++ b/dev/deps/dependencies-server
@@ -75,10 +75,10 @@ jetty-util/9.4.58.v20250814//jetty-util-9.4.58.v20250814.jar
jsr305/1.3.9//jsr305-1.3.9.jar
jul-to-slf4j/1.7.36//jul-to-slf4j-1.7.36.jar
leveldbjni-all/1.8//leveldbjni-all-1.8.jar
-log4j-1.2-api/2.24.3//log4j-1.2-api-2.24.3.jar
-log4j-api/2.24.3//log4j-api-2.24.3.jar
-log4j-core/2.24.3//log4j-core-2.24.3.jar
-log4j-slf4j-impl/2.24.3//log4j-slf4j-impl-2.24.3.jar
+log4j-1.2-api/2.25.4//log4j-1.2-api-2.25.4.jar
+log4j-api/2.25.4//log4j-api-2.25.4.jar
+log4j-core/2.25.4//log4j-core-2.25.4.jar
+log4j-slf4j-impl/2.25.4//log4j-slf4j-impl-2.25.4.jar
lz4-java/1.10.4//lz4-java-1.10.4.jar
maven-jdk-tools-wrapper/0.1//maven-jdk-tools-wrapper-0.1.jar
metrics-core/4.2.25//metrics-core-4.2.25.jar
diff --git a/pom.xml b/pom.xml
index e09b912ed..04622055e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -89,7 +89,7 @@
<guava.version>33.1.0-jre</guava.version>
<junit.version>4.13.2</junit.version>
<leveldb.version>1.8</leveldb.version>
- <log4j2.version>2.24.3</log4j2.version>
+ <log4j2.version>2.25.4</log4j2.version>
<disruptor.version>3.4.4</disruptor.version>
<lz4-java.group>at.yawk.lz4</lz4-java.group>
<lz4-java.version>1.10.4</lz4-java.version>
diff --git a/project/CelebornBuild.scala b/project/CelebornBuild.scala
index 1d5d8654b..bcbd9d60a 100644
--- a/project/CelebornBuild.scala
+++ b/project/CelebornBuild.scala
@@ -58,7 +58,7 @@ object Dependencies {
// don't forget update `junitInterfaceVersion` when we upgrade junit
val junitVersion = "4.13.2"
val leveldbJniVersion = "1.8"
- val log4j2Version = "2.24.3"
+ val log4j2Version = "2.25.4"
val disruptorVersion = "3.4.4"
val jdkToolsVersion = "0.1"
val metricsVersion = "4.2.25"
