Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade org.apache.logging.log4j:log4j-core and log4j-api libraries #24507

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Upgrade org.apache.logging.log4j:log4j-core and log4j-api libraries #24507

wants to merge 1 commit into from

Conversation

Dilli-Babu-Godari
Copy link
Contributor

@Dilli-Babu-Godari Dilli-Babu-Godari commented Feb 6, 2025 •
edited
Loading

Description

Upgraded org.apache.logging.log4j:log4j-core from 2.17.1 to 2.24.3
Upgraded org.apache.logging.log4j:log4j-api from 2.17.1 to 2.24.3

Motivation and Context

Addresses below CVEs

Screenshot 2025-02-06 at 4 55 39 PM

Impact

Test Plan

Contributor checklist

  • Please make sure your submission complies with our co
    ntributing guide    , in particular code style and commit standards.
  • PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
  • Documented new properties (with its default value), SQL syntax, functions, or other functionality.
  • If release notes are required, they follow the release notes guidelines.
  • Adequate tests were added if applicable.
  • CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

General Changes
*  Upgraded org.apache.logging.log4j:log4j-core from 2.17.1 to 2.24.3 
*  Upgraded org.apache.logging.log4j:log4j-api from 2.17.1 to 2.24.3

@prestodb-ci prestodb-ci added the from:IBM PR from IBM label Feb 6, 2025
@Dilli-Babu-Godari Dilli-Babu-Godari marked this pull request as ready for review February 6, 2025 12:24
@Dilli-Babu-Godari Dilli-Babu-Godari requested a review from a team as a code owner February 6, 2025 12:24
imjalpreet
imjalpreet requested changes Feb 6, 2025
View reviewed changes
Copy link
Member

@imjalpreet imjalpreet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Dilli-Babu-Godari, I noticed that these libraries are also included with version 2.17.1 in presto-druid. Is there a specific reason we’re not upgrading them as well? Could you take a look?

@Dilli-Babu-Godari
Copy link
Contributor Author

Dilli-Babu-Godari commented Feb 7, 2025 •
edited
Loading

@Dilli-Babu-Godari, I noticed that these libraries are also included with version 2.17.1 in presto-druid. Is there a specific reason we’re not upgrading them as well? Could you take a look?

I have now added the presto-druid as well. Could you please review it again?

agrawalreetika
agrawalreetika requested changes Feb 7, 2025
View reviewed changes
Copy link
Member

@agrawalreetika agrawalreetika left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Dilli-Babu-Godari Please verify both the dependency by checking the dependency tree, I still see these 2 are coming from some more packages.

@Dilli-Babu-Godari
Upgrade org.apache.logging.log4j:log4j-core and log4j-api libraries i…
a0993dc 
…n presto

Upgraded org.apache.logging.log4j:log4j-core from 2.17.1 to 2.24.3
Upgraded org.apache.logging.log4j:log4j-api from 2.17.1 to 2.24.3

Fixes almost 25 CVEs.
@Dilli-Babu-Godari
Copy link
Contributor Author

@Dilli-Babu-Godari Please verify both the dependency by checking the dependency tree, I still see these 2 are coming from some more packages.

I have made changes, so the versions are now aligned.
Screenshot 2025-02-11 at 10 08 17 AM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@presto-oss presto-oss Awaiting requested review from presto-oss presto-oss is a code owner automatically assigned from prestodb/committers

@imjalpreet imjalpreet Awaiting requested review from imjalpreet

@agrawalreetika agrawalreetika Awaiting requested review from agrawalreetika

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
from:IBM PR from IBM
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@Dilli-Babu-Godari @imjalpreet @agrawalreetika @prestodb-ci