chore: refresh dependency manifest for Log4j 2.25.5 - #763
Conversation
dosubot
Bot
added
size:XS
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dependabot/maven/hugegraph-spark-connector/org.apache.logging.log4j-log4j-api-2.25.5 #763 +/- ##
=======================================================================================================================
Coverage ? 45.90%
Complexity ? 4374
=======================================================================================================================
Files ? 602
Lines ? 29342
Branches ? 3427
=======================================================================================================================
Hits ? 13470
Misses ? 14552
Partials ? 1320 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
22ee390 to
45b858d
Compare
bitflicker64
left a comment
bitflicker64
left a comment
There was a problem hiding this comment.
Blocking: no. Summary: the four manifest lines are exactly right, but the PR is based on the Dependabot branch instead of master, so the fix does not reach the branch where the gate is failing. Evidence: the check-dependency-license job on #757 (run 31735150807, job 94564869017) fails and prints precisely this PR's four-line diff; #762 fails the same job; mvn dependency:tree at 45b858d on JDK 11 resolves log4j-api, log4j-core and log4j-slf4j-impl to 2.25.5 in every module with no 2.18.0 left, and log4j-slf4j-impl 2.25.5 declares slf4j-api 1.7.36 in its POM.
| log4j-api-2.18.0.jar | ||
| log4j-core-2.18.0.jar | ||
| log4j-slf4j-impl-2.18.0.jar | ||
| log4j-api-2.25.5.jar |
There was a problem hiding this comment.
dependabot/maven/org.apache.logging.log4j-log4j-api-2.25.5 (the head branch of #757) rather than master, so merging it lands the fix on a Dependabot branch and not where it is actually needed.
#757's own check-dependency-license job already fails (run 31735150807, job 94564869017), and the diff it prints is exactly the four lines this PR applies:
@@ -385,3 +385,3 @@
-log4j-api-2.18.0.jar
-log4j-core-2.18.0.jar
-log4j-slf4j-impl-2.18.0.jar
+log4j-api-2.25.5.jar
+log4j-core-2.25.5.jar
+log4j-slf4j-impl-2.25.5.jar
@@ -469,0 +470 @@
+slf4j-api-1.7.36.jar
#762 fails the same job. Both target master and change only the two poms, so merging either one alone leaves master with log4j2.version 2.25.5 and this manifest still listing the 2.18.0 jars.
Two further consequences of the base ref: GitHub closes a PR when its base branch is deleted, so this one closes the moment #757 is merged or closed, and a Dependabot rebase force-pushes that base branch, shifting the merge base under this PR.
Please retarget this PR to master. 45b858d already has bf72e64 in its ancestry, so the diff against master carries the two pom bumps together with this manifest refresh and turns that failing job green in one change.
| slf4j-api-1.7.25.jar | ||
| slf4j-api-1.7.28.jar | ||
| slf4j-api-1.7.30.jar | ||
| slf4j-api-1.7.36.jar |
There was a problem hiding this comment.
🧹 hugegraph-dist/release-docs/LICENSE is copied verbatim into the release tarball (hugegraph-dist/pom.xml, package phase: cp -r -v $root_path/hugegraph-dist/release-docs/* ${final.name}/), and at this head it still records org.apache.logging.log4j:log4j-api:2.18.0 (line 284), log4j-core:2.18.0 (285) and log4j-slf4j-impl:2.18.0 (287), with no org.slf4j:slf4j-api:1.7.36 entry at all (its SLF4J block stops at 1.7.30, lines 593 to 595).
To be fair, that drift is pre-existing and wider than these four entries: 27 group:artifact:version entries in that LICENSE have no matching jar in known-dependencies.txt, including log4j-jul:2.11.2, lombok:1.18.8 (manifest has 1.18.32) and curator-client:2.13.0 (manifest has 4.2.0). No CI job checks the file, and the version bump itself is in the parent commit rather than in this diff.
Still worth refreshing the four log4j and slf4j entries alongside the manifest here, or opening a follow-up to regenerate the file as a whole.
2 participants
Purpose of the PR
Completes #757 by refreshing the checked-in dependency allowlist after its Log4j 2.25.5 upgrade. #757 is the older canonical Dependabot proposal; #762 carries the same dependency change in a narrower path.
Main Changes
slf4j-api1.7.36 transitive dependency introduced by the upgraded graphVerifying these changes
mvn -ntp -pl hugegraph-hubble/hubble-be -am install -DskipTests=true— all five reactor modules passed, including Checkstyle and EditorConfig (94s)bash hugegraph-dist/scripts/dependency/regenerate_known_dependencies.sh current-dependencies.txt— passed twiceknown-dependencies.txt(SHA-25668bdf81caefe0d4c9fe49bfbbaa01b790fd002eb84fd35654bd04c4100ab57d2)bash hugegraph-dist/scripts/dependency/check_dependencies.sh current-dependencies.txt—All third dependencies is known!git diff --check— passedDoes this PR potentially affect the following parts?
Documentation Status
Doc - TODODoc - DoneDoc - No NeedAI assistance
Built and verified with JAIPilot.
jaipilot-maintainer-intent,jaipilot-fast-execution,jaipilot-remote-java, andjaipilot-review-diffgpt-5.6-solxhighfast; final verification ran locally because JAIPilot Remote was unavailable