Bump log4j2 from 2.21.0 to 2.25.1

CHANGELOG.md

@@ -85,6 +85,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `com.google.code.gson:gson` from 2.13.1 to 2.13.2 ([#19290](https://github.com/opensearch-project/OpenSearch/pull/19290)) ([#19293](https://github.com/opensearch-project/OpenSearch/pull/19293))
 - Bump `actions/stale` from 9 to 10 ([#19292](https://github.com/opensearch-project/OpenSearch/pull/19292))
 - Bump `com.nimbusds:oauth2-oidc-sdk` from 11.25 to 11.28 ([#19291](https://github.com/opensearch-project/OpenSearch/pull/19291))
+- Bump `log4j2` from 2.21.0 to 2.25.1 ([#19184](https://github.com/opensearch-project/OpenSearch/pull/19184))
 
 ### Deprecated
 

gradle/libs.versions.toml

@@ -13,7 +13,9 @@ jackson_databind  = "2.18.2"
 snakeyaml         = "2.1"
 icu4j             = "77.1"
 supercsv          = "2.4.0"
-log4j             = "2.21.0"
+log4j             = "2.25.1"
+error_prone_annotations = "2.41.0"
+spotbugs_annotations = "4.9.4"
 slf4j             = "2.0.17"
 asm               = "9.7"
 jettison          = "1.5.4"

libs/core/licenses/log4j-api-2.25.1.jar.sha1

@@ -0,0 +1 @@
+c7acbbd6f110cd1457c628da46245e355b1ee57a

modules/transport-grpc/build.gradle

@@ -24,8 +24,11 @@ dependencies {
   api project('spi')
   compileOnly "com.google.code.findbugs:jsr305:3.0.2"
   runtimeOnly "com.google.guava:guava:${versions.guava}"
-  implementation "com.google.errorprone:error_prone_annotations:2.24.1"
-  implementation "com.google.guava:failureaccess:1.0.2"
+
+  compileOnly "com.github.spotbugs:spotbugs-annotations:${versions.spotbugs_annotations}"
+  compileOnly "com.google.errorprone:error_prone_annotations:${versions.error_prone_annotations}"
+  compileOnly "com.google.guava:failureaccess:1.0.2"
+
   implementation "io.grpc:grpc-api:${versions.grpc}"
   implementation "io.grpc:grpc-core:${versions.grpc}"
   implementation "io.grpc:grpc-netty-shaded:${versions.grpc}"

plugins/arrow-flight-rpc/build.gradle

@@ -54,7 +54,8 @@ dependencies {
   runtimeOnly "io.grpc:grpc-core:${versions.grpc}"
   implementation "io.grpc:grpc-stub:${versions.grpc}"
   implementation "io.grpc:grpc-netty:${versions.grpc}"
-  implementation "com.google.errorprone:error_prone_annotations:2.31.0"
+
+  compileOnly "com.google.errorprone:error_prone_annotations:${versions.error_prone_annotations}"
 
   runtimeOnly group: 'com.google.code.findbugs', name: 'jsr305', version: '3.0.2'
   annotationProcessor 'org.immutables:value:2.10.1'