1996fanrui opened a new pull request, #29868: URL: https://github.com/apache/flink/pull/29868
## What is the purpose of the change Backport of #27512 to release-1.20. Bumps log4j from 2.24.3 to 2.25.3 to address CVE-2025-68161. ## Verifying this change - `./mvnw -pl flink-core,flink-test-utils-parent/flink-test-utils-junit -am -Pskip-webui-build -Dtest='MdcUtilsTest,TestLoggerResourceTest' -Dsurefire.failIfNoSpecifiedTests=false package` (JDK 11): `BUILD SUCCESS`; `Tests run: 8, Failures: 0, Errors: 0, Skipped: 0 -- in org.apache.flink.util.MdcUtilsTest`; `Tests run: 6, Failures: 0, Errors: 0, Skipped: 0 -- in org.apache.flink.testutils.logging.TestLoggerResourceTest` - `./mvnw -q -pl flink-core,flink-test-utils-parent/flink-test-utils-junit spotless:check checkstyle:check` (JDK 11): passed - `./mvnw -pl flink-core dependency:tree -Dincludes=org.apache.logging.log4j` (JDK 11): log4j-api, log4j-core, log4j-slf4j-impl and log4j-1.2-api all resolve to `2.25.3` - `git grep -n "2\.24\.3"` on the branch after the change: no remaining references ## Difference from the original | Original commit | Conflict | Byte-identical | Changes | | --- | --- | --- | --- | | 406568ee12e | No | No | Only context lines in `pom.xml` differ: release-1.20 has `flink.markBundledAsOptional` / `target.java.version` 1.8 around `log4j.version` instead of `source.java.version` 11 / `target.java.version` 17. The changed lines are identical. | ## Notes - The tests above exercise log4j-core directly; no tests were added or changed by the original PR, since it is a dependency version bump. ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code (Claude Opus 5.5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
