search

ops4j / org.ops4j.pax.logging

The OSGi Logging framework implementation. Supports SLF4J,LOG4J,JCL etc.
https://ops4j1.jira.com/wiki/spaces/paxlogging/overview
Apache License 2.0
46 stars 79 forks source link

[2.1.x] Upgrade to Log4j2 2.18.0 (was: 2.17.3) #484

Closed grgrzybek closed 2 years ago

grgrzybek commented 2 years ago

https://www.mail-archive.com/announce@apache.org/msg07133.html

grgrzybek commented 2 years ago

Held because of https://issues.apache.org/jira/browse/LOG4J2-3424

grgrzybek commented 2 years ago

Waiting for 2.17.3

grgrzybek commented 2 years ago

Waiting for 2.18.0 (fix version changed in https://issues.apache.org/jira/browse/LOG4J2-3424)

ecki commented 2 years ago

Is the “was 2.17.3” in title correct? The current version is 2.17.2. The .3 was I guess the expected fixed version, but maybe that part of the evolution of this bug is not very clear to outsiders?

btw, anybody know about security issues with 2.17.1, Apache logging does not mention any?

grgrzybek commented 2 years ago

Is the “was 2.17.3” in title correct?

Yes, it is :) Because I created this issue to not forget the upgrade when 2.17.3 is released. And I waited for 2.17.3 because of https://issues.apache.org/jira/browse/LOG4J2-3424 which was initially targetted to be fixed in 2.17.3

The current version is 2.17.2. The .3 was I guess the expected fixed version, but maybe that part of the evolution of this bug is not very clear to outsiders?

Yeah - it may be a bit confusing, but I hope the confusion is gone once it's fixed.

btw, anybody know about security issues with 2.17.1, Apache logging does not mention any?

I don't recall any. See https://www.mail-archive.com/announce@apache.org/msg07133.html for details.

ecki commented 2 years ago

Agreed, looks only like “hardening” (turning off script handler and remote loading)

grgrzybek commented 2 years ago

Log4j2 2.18.0 is released: https://www.mail-archive.com/announce@apache.org/msg07416.html I'll update Pax Logging tomorrow.

grgrzybek commented 2 years ago

Due to https://issues.apache.org/jira/browse/LOG4J2-3427, org.apache.logging.log4j.util.PaxPropertySource is not loaded, breaking many Log4j2 integration tests...

grgrzybek commented 2 years ago

Due to https://issues.apache.org/jira/browse/LOG4J2-3366, I had to add property names to org.apache.logging.log4j.util.PaxPropertySource and reimplement it a bit.