[Backport 2.19] Bump log4j from 2.21.0 to 2.25.3 (#20308)

CHANGELOG.md

@@ -9,6 +9,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 ### Dependencies
 
 ### Deprecated
+- Bump `log4j` from 2.21.0 to 2.25.3 ([#20308](https://github.com/opensearch-project/OpenSearch/pull/20308))
 
 ### Removed
 

gradle/libs.versions.toml

@@ -13,7 +13,8 @@ jackson_databind  = "2.18.2"
 snakeyaml         = "2.1"
 icu4j             = "75.1"
 supercsv          = "2.4.0"
-log4j             = "2.21.0"
+log4j             = "2.25.3"
+error_prone_annotations = "2.45.0"
 slf4j             = "1.7.36"
 asm               = "9.7"
 jettison          = "1.5.4"

libs/core/build.gradle

@@ -73,6 +73,7 @@ tasks.named("thirdPartyAudit").configure {
         'org.osgi.framework.SynchronousBundleListener',
         'org.osgi.framework.wiring.BundleWire',
         'org.osgi.framework.wiring.BundleWiring',
+        'org.osgi.framework.wiring.BundleRevision',
     ]  + (BuildParams.runtimeJavaVersion < JavaVersion.VERSION_20) ? [] : [
        'jdk.incubator.vector.ByteVector',
        'jdk.incubator.vector.FloatVector',

libs/core/licenses/log4j-api-2.25.3.jar.sha1

@@ -0,0 +1 @@
+fb385330d89c2d61058ef649403f214633569205

plugins/crypto-kms/licenses/log4j-1.2-api-2.25.3.jar.sha1

@@ -0,0 +1 @@
+a7e550e638a5e534fd944616c5ae665a67e9501e

plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.25.3.jar.sha1

@@ -0,0 +1 @@
+a7e550e638a5e534fd944616c5ae665a67e9501e

plugins/discovery-ec2/licenses/log4j-1.2-api-2.25.3.jar.sha1

@@ -0,0 +1 @@
+a7e550e638a5e534fd944616c5ae665a67e9501e

plugins/discovery-gce/licenses/log4j-1.2-api-2.25.3.jar.sha1

@@ -0,0 +1 @@
+a7e550e638a5e534fd944616c5ae665a67e9501e

plugins/ingest-attachment/src/main/java/org/opensearch/ingest/attachment/TikaImpl.java

@@ -198,7 +198,7 @@ static PermissionCollection getRestrictedPermissions() {
         Permissions perms = new Permissions();
         // property/env access needed for parsing
         perms.add(new PropertyPermission("*", "read"));
-        perms.add(new RuntimePermission("getenv.TIKA_CONFIG"));
+        perms.add(new RuntimePermission("getenv.*"));
 
         try {
             // add permissions for resource access:

plugins/repository-gcs/licenses/log4j-1.2-api-2.25.3.jar.sha1

@@ -0,0 +1 @@
+a7e550e638a5e534fd944616c5ae665a67e9501e

plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.25.3.jar.sha1

@@ -0,0 +1 @@
+4a173925524d8f6c3f39ae8954ee348e8244afd7

plugins/repository-s3/build.gradle

@@ -513,7 +513,6 @@ thirdPartyAudit {
     'org.jboss.marshalling.MarshallingConfiguration',
     'org.jboss.marshalling.Unmarshaller',
 
-    'org.slf4j.ext.EventData',
     'reactor.blockhound.BlockHound$Builder',
     'reactor.blockhound.integration.BlockHoundIntegration',
 

plugins/repository-s3/licenses/log4j-1.2-api-2.25.3.jar.sha1

@@ -0,0 +1 @@
+a7e550e638a5e534fd944616c5ae665a67e9501e

plugins/repository-s3/licenses/log4j-slf4j-impl-2.25.3.jar.sha1

@@ -0,0 +1 @@
+4a173925524d8f6c3f39ae8954ee348e8244afd7

plugins/transport-grpc/build.gradle

@@ -16,7 +16,7 @@ opensearchplugin {
 dependencies {
   compileOnly "com.google.code.findbugs:jsr305:3.0.2"
   runtimeOnly "com.google.guava:guava:${versions.guava}"
-  implementation "com.google.errorprone:error_prone_annotations:2.24.1"
+  compileOnly "com.google.errorprone:error_prone_annotations:${versions.error_prone_annotations}"
   implementation "com.google.guava:failureaccess:1.0.1"
   implementation "io.grpc:grpc-api:${versions.grpc}"
   implementation "io.grpc:grpc-core:${versions.grpc}"

server/build.gradle

@@ -94,6 +94,10 @@ dependencies {
   api libs.log4japi
   api libs.log4jjul
   api libs.log4jcore, optional
+
+  compileOnlyApi "org.jspecify:jspecify:1.0.0"
+  compileOnlyApi "com.google.errorprone:error_prone_annotations:${versions.error_prone_annotations}"
+
   annotationProcessor libs.log4jcore
   annotationProcessor project(':libs:opensearch-common')
 
@@ -229,6 +233,7 @@ tasks.named("thirdPartyAudit").configure {
         *[
             // from com.fasterxml.jackson.dataformat.yaml.YAMLMapper (jackson-dataformat-yaml)
             'com.fasterxml.jackson.databind.ObjectMapper',
+            'com.fasterxml.jackson.databind.util.ClassUtil',
 
             // from log4j
             'com.conversantmedia.util.concurrent.SpinPolicy',
@@ -255,6 +260,7 @@ tasks.named("thirdPartyAudit").configure {
             'org.fusesource.jansi.Ansi',
             'org.fusesource.jansi.AnsiRenderer$Code',
             'com.lmax.disruptor.EventFactory',
+            'com.lmax.disruptor.EventHandler',
             'com.lmax.disruptor.EventTranslator',
             'com.lmax.disruptor.EventTranslatorTwoArg',
             'com.lmax.disruptor.EventTranslatorVararg',
@@ -305,6 +311,7 @@ tasks.named("thirdPartyAudit").configure {
             'org.osgi.framework.ServiceReference',
             'org.osgi.framework.ServiceRegistration',
             'org.osgi.framework.SynchronousBundleListener',
+            'org.osgi.framework.wiring.BundleRevision',
             'org.osgi.framework.wiring.BundleWire',
             'org.osgi.framework.wiring.BundleWiring',
             'org.zeromq.SocketType',

server/licenses/log4j-api-2.25.3.jar.sha1

@@ -0,0 +1 @@
+fb385330d89c2d61058ef649403f214633569205

server/licenses/log4j-core-2.25.3.jar.sha1

@@ -0,0 +1 @@
+dd9c8ecba5c8dc5e1574804d0bfdc1ef155ad9ea

server/licenses/log4j-jul-2.25.3.jar.sha1

@@ -0,0 +1 @@
+08bba6d5a56f11931c218c016c96b740e238abbc

server/src/internalClusterTest/java/org/opensearch/search/suggest/CompletionSuggestSearchIT.java

@@ -1176,7 +1176,7 @@ public void testSkipDuplicates() throws Exception {
             int weight = randomIntBetween(0, 100);
             weights[id] = Math.max(weight, weights[id]);
             String suggestion = "suggestion-" + String.format(Locale.ENGLISH, "%03d", id);
-            logger.info("Creating {}, id {}, weight {}", suggestion, i, id, weight);
+            logger.info("Creating {}, i {}, id {}, weight {}", suggestion, i, id, weight);
             indexRequestBuilders.add(
                 client().prepareIndex(INDEX)
                     .setRefreshPolicy(WAIT_UNTIL)
@@ -1193,12 +1193,12 @@ public void testSkipDuplicates() throws Exception {
         indexRandom(true, indexRequestBuilders);
 
         Arrays.sort(termIds, Comparator.comparingInt(o -> weights[(int) o]).reversed().thenComparingInt(a -> (int) a));
-        logger.info("Expected terms id ordered {}", (Object[]) termIds);
+        logger.info("Expected terms id ordered {}", Arrays.toString(termIds));
         String[] expected = new String[numUnique];
         for (int i = 0; i < termIds.length; i++) {
             expected[i] = "suggestion-" + String.format(Locale.ENGLISH, "%03d", termIds[i]);
         }
-        logger.info("Expected suggestions field values {}", (Object[]) expected);
+        logger.info("Expected suggestions field values {}", Arrays.toString(expected));
         CompletionSuggestionBuilder completionSuggestionBuilder = SuggestBuilders.completionSuggestion(FIELD)
             .prefix("sugg")
             .skipDuplicates(true)