The GitHub Actions job "Required Checks" on texera.git/main has failed. Run started by GitHub user github-merge-queue[bot] (triggered by github-merge-queue[bot]).
Head commit for run: 5b9799494f16106211b7624fe7152dbb3980c29c / Yicong Huang <[email protected]> fix(deps): replace EOL log4j 1.2 with log4j 2.26.1 bridges (#6199) ### What changes were proposed in this PR? `log4j:log4j` 1.2.17 is pulled in transitively by Hadoop/ZooKeeper (declared in `common/workflow-core` and `amber`) and shipped in the dists of amber, computing-unit-managing-service, file-service, and workflow-compiling-service. log4j 1.x is EOL — none of its open CVEs have a fixed 1.x release; the remediation is moving to log4j 2.x. Since the 2.x line lives under a different Maven coordinate (`org.apache.logging.log4j`), a plain version bump isn't possible. This PR follows the Apache log4j migration path: | Before | After | | --- | --- | | `log4j:log4j` 1.2.17 | excluded build-wide (`ThisBuild / excludeDependencies`, root `build.sbt`) | | — | `log4j-1.2-api` 2.26.1 + `log4j-to-slf4j` 2.26.1 in `common/workflow-core` | The bridges keep Hadoop/ZooKeeper's `org.apache.log4j` API calls working, routing them through the log4j 2 API into slf4j and on to logback (the existing Dropwizard logging backend). All affected services inherit the bridges through `workflow-core`. ### Any related issues, documentation, discussions? Resolves the six open Dependabot security alerts on `log4j:log4j`: | Alert | CVE | Severity | | --- | --- | --- | | [#726](https://github.com/apache/texera/security/dependabot/726) | CVE-2023-26464 | high | | [#670](https://github.com/apache/texera/security/dependabot/670) | CVE-2019-17571 | critical | | [#663](https://github.com/apache/texera/security/dependabot/663) | CVE-2022-23307 | critical | | [#650](https://github.com/apache/texera/security/dependabot/650) | CVE-2022-23305 | critical | | [#649](https://github.com/apache/texera/security/dependabot/649) | CVE-2022-23302 | high | | [#648](https://github.com/apache/texera/security/dependabot/648) | CVE-2021-4104 | high | ### How was this PR tested? Dependency-only change; existing CI compile/test stacks cover it. Verified resolution locally: ``` sbt --batch "show WorkflowCore/Runtime/externalDependencyClasspath" \ "show WorkflowExecutionService/Runtime/externalDependencyClasspath" ``` - `log4j-1.2.17.jar` no longer appears on any resolved classpath. - `log4j-1.2-api-2.26.1.jar`, `log4j-api-2.26.1.jar`, `log4j-to-slf4j-2.26.1.jar` are resolved. Licensing files (LICENSE-binary / NOTICE-binary of the four affected dists) were refreshed from locally rebuilt dists and verified with the same commands CI runs: ``` ./bin/licensing/generate_notice_binary.py <svc>/NOTICE-binary <dist>/lib # --extras amber/NOTICE-binary-python for amber ./bin/licensing/check_binary_deps.py --ignore-transitive-version jar --license-binary <svc>/LICENSE-binary <dist>/lib ``` Note: `log4j-to-slf4j` pulls `slf4j-api` 2.0.16 → 2.0.17 in the three platform services (amber stays pinned at 1.7.26). ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Claude Fable 5) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <[email protected]> Report URL: https://github.com/apache/texera/actions/runs/28757048498 With regards, GitHub Actions via GitBox
