Skip to content

chore: refresh dependency manifest for Log4j 2.25.5 - #763

Open
skrcode wants to merge 1 commit into
apache:dependabot/maven/org.apache.logging.log4j-log4j-api-2.25.5from
skrcode:jaipilot/log4j-2.25.5-dependency-manifest
Open

chore: refresh dependency manifest for Log4j 2.25.5#763
skrcode wants to merge 1 commit into
apache:dependabot/maven/org.apache.logging.log4j-log4j-api-2.25.5from
skrcode:jaipilot/log4j-2.25.5-dependency-manifest

Conversation

@skrcode

@skrcode skrcode commented Aug 30, 2026

Copy link
Copy Markdown

Purpose of the PR

Completes #757 by refreshing the checked-in dependency allowlist after its Log4j 2.25.5 upgrade. #757 is the older canonical Dependabot proposal; #762 carries the same dependency change in a narrower path.

Main Changes

  • replace the three Log4j 2.18.0 artifacts with 2.25.5 in the generated allowlist
  • add the slf4j-api 1.7.36 transitive dependency introduced by the upgraded graph
  • leave build and runtime dependency declarations unchanged beyond the source upgrade

Verifying these changes

  • Already covered by the repository dependency-manifest gate.
  • JDK 17 / Maven 3.9.16: mvn -ntp -pl hugegraph-hubble/hubble-be -am install -DskipTests=true — all five reactor modules passed, including Checkstyle and EditorConfig (94s)
  • bash hugegraph-dist/scripts/dependency/regenerate_known_dependencies.sh current-dependencies.txt — passed twice
  • both generated manifests were byte-identical to each other and to known-dependencies.txt (SHA-256 68bdf81caefe0d4c9fe49bfbbaa01b790fd002eb84fd35654bd04c4100ab57d2)
  • bash hugegraph-dist/scripts/dependency/check_dependencies.sh current-dependencies.txtAll third dependencies is known!
  • git diff --check — passed

Does this PR potentially affect the following parts?

  • Nope
  • Dependencies (add/update license info)
  • Modify configurations
  • The public API
  • Other affects

Documentation Status

  • Doc - TODO
  • Doc - Done
  • Doc - No Need

AI assistance

Built and verified with JAIPilot.

  • Skills: jaipilot-maintainer-intent, jaipilot-fast-execution, jaipilot-remote-java, and jaipilot-review-diff
  • Model: gpt-5.6-sol
  • Reasoning: xhigh
  • Service mode: fast; final verification ran locally because JAIPilot Remote was unavailable

@dosubot dosubot Bot added size:XS This PR changes 0-9 lines, ignoring generated files. dependencies Pull requests that update a dependency file labels Aug 30, 2026
@codecov

codecov Bot commented Aug 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (dependabot/maven/hugegraph-spark-connector/org.apache.logging.log4j-log4j-api-2.25.5@305d727). Learn more about missing BASE report.

Additional details and impacted files
@@                                                   Coverage Diff                                                   @@
##             dependabot/maven/hugegraph-spark-connector/org.apache.logging.log4j-log4j-api-2.25.5     #763   +/-   ##
=======================================================================================================================
  Coverage                                                                                        ?   45.90%           
  Complexity                                                                                      ?     4374           
=======================================================================================================================
  Files                                                                                           ?      602           
  Lines                                                                                           ?    29342           
  Branches                                                                                        ?     3427           
=======================================================================================================================
  Hits                                                                                            ?    13470           
  Misses                                                                                          ?    14552           
  Partials                                                                                        ?     1320           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@skrcode
skrcode force-pushed the jaipilot/log4j-2.25.5-dependency-manifest branch from 22ee390 to 45b858d Compare August 31, 2026 04:06
@skrcode
skrcode changed the base branch from dependabot/maven/hugegraph-spark-connector/org.apache.logging.log4j-log4j-api-2.25.5 to dependabot/maven/org.apache.logging.log4j-log4j-api-2.25.5 August 31, 2026 04:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant