Bump log4j to 2.17

[ps48]

Signed-off-by: Shenoy Pratik [email protected]

Description

Bumped up log4j to 2.17

Issues Resolved

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
opensearch-project/opensearch-build#1365

Check List

• New functionality includes testing.
  • All tests pass, including unit test, integration test and doctest
• New functionality has been documented.
  • New functionality has javadoc added
  • New functionality has user manual doc added
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[dblock]

Supposedly compatible with OpenSearch Dashboards 1.2.x, AFAIK we're not planning a Dashboards release.

[ps48]

Updated, thanks!

[dblock]

Build is failing ...

[ps48]

Build is failing ...

I see version conflict for log4j. Is the core artifact for 1.2.3 ready with log4j 2.17.0?

org.apache.logging.log4j:log4j-api between versions 2.17.0 and 2.16.0

[dblock]

Build is failing ...

I see version conflict for log4j. Is the core artifact for 1.2.3 ready with log4j 2.17.0?

org.apache.logging.log4j:log4j-api between versions 2.17.0 and 2.16.0

Yes, see opensearch-project/OpenSearch#1774

[dblock]

It's pretty clear from ./gradlew :plugin:dependencyInsight --configuration runtimeClasspath --dependency org.apache.logging.log4j:log4j-api that the problem is that the 1.2.3-SNAPSHOT build is bringing in the old log4j.

org.apache.logging.log4j:log4j-api:2.16.0 -> 2.17.0
\--- org.opensearch:opensearch:1.2.3-SNAPSHOT:20211218.163135-5
     +--- project :legacy
     |    \--- runtimeClasspath
     \--- project :opensearch
          +--- runtimeClasspath
          +--- project :legacy (*)
          \--- project :protocol
               +--- project :ppl
               |    \--- runtimeClasspath
               \--- project :sql
                    \--- project :legacy (*)

After building OpenSearch/1.2 into local maven the error in this PR goes away.

It looks like we were never able to get a 1.2.3-SNAPSHOT successfully built with that change because of the build failure in performance-analyzer. I PRed opensearch-project/opensearch-build#1387 removing it to see if that fixes it.

[codecov-commenter]

Codecov Report

Merging #345 (1f59355) into 1.2 (57ead85) will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##                1.2     #345   +/-   ##
=========================================
  Coverage     99.90%   99.90%           
  Complexity     2687     2687           
=========================================
  Files           256      256           
  Lines          6524     6524           
  Branches        420      420           
=========================================
  Hits           6518     6518           
  Misses            5        5           
  Partials          1        1           

Flag	Coverage Δ
sql-engine	99.90% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 57ead85...1f59355. Read the comment docs.

[dblock]

@ps48 please backport this to main, and bump main version to 1.3.0