Skip to content

Update logback dependencies to version 1.5.19#1996

Merged
riysaxen-amzn merged 1 commit intoopensearch-project:mainfrom
dbwiddis:patch-1
Dec 9, 2025
Merged

Update logback dependencies to version 1.5.19#1996
riysaxen-amzn merged 1 commit intoopensearch-project:mainfrom
dbwiddis:patch-1

Conversation

@dbwiddis
Copy link
Member

@dbwiddis dbwiddis commented Dec 3, 2025

Description

Resolves CVE-2025-11226.

Related Issues

See https://logback.qos.ch/news.html#1.5.19

Check List

  • Commits are signed per the DCO using --signoff.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Daniel Widdis <widdis@gmail.com>
@riysaxen-amzn
Copy link
Collaborator

why some of the CI's are failing?

@riysaxen-amzn riysaxen-amzn added the v3.4.0 Issues targeting release v3.4.0 label Dec 9, 2025
@dbwiddis
Copy link
Member Author

dbwiddis commented Dec 9, 2025

why some of the CI's are failing?

The tests pass, looks like something wrong with artifact uploading with duplicate name, not unique per matrix. Once jdk25 upload completes the jdk21 and jdk24 uploads fail.

Upload is only unique per OS, needs to also have a different name per JDK version.

name: alerting-plugin-${{ matrix.os }}

Fixed in:

@dbwiddis
Copy link
Member Author

dbwiddis commented Dec 9, 2025

@riysaxen-amzn can you please add a "backport 3.4" label and tag this PR with it?

@riysaxen-amzn
Copy link
Collaborator

@riysaxen-amzn can you please add a "backport 3.4" label and tag this PR with it?

backport failed

@dbwiddis
Copy link
Member Author

dbwiddis commented Dec 9, 2025

backport failed

Won't actually backport until this one is merged.

@riysaxen-amzn riysaxen-amzn merged commit 72f9fcf into opensearch-project:main Dec 9, 2025
14 of 20 checks passed
opensearch-trigger-bot bot pushed a commit that referenced this pull request Dec 9, 2025
Signed-off-by: Daniel Widdis <widdis@gmail.com>
(cherry picked from commit 72f9fcf)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@dbwiddis dbwiddis deleted the patch-1 branch December 9, 2025 23:35
riysaxen-amzn pushed a commit that referenced this pull request Dec 10, 2025
(cherry picked from commit 72f9fcf)

Signed-off-by: Daniel Widdis <widdis@gmail.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
AWSHurneyt pushed a commit to AWSHurneyt/OpenSearch-Alerting that referenced this pull request Feb 12, 2026
… (opensearch-project#2002)

(cherry picked from commit 72f9fcf)

Signed-off-by: Daniel Widdis <widdis@gmail.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Signed-off-by: Thomas Hurney <hurneyt@amazon.com>
AWSHurneyt added a commit that referenced this pull request Feb 16, 2026
* Update logback dependencies to version 1.5.19 (#1996) (#2002)

(cherry picked from commit 72f9fcf)

Signed-off-by: Daniel Widdis <widdis@gmail.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Signed-off-by: Thomas Hurney <hurneyt@amazon.com>

* Include alerting spi as part of the mavenlocal (#2003) (#2004)

(cherry picked from commit 4550b44)

Signed-off-by: Peter Zhu <zhujiaxi@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Signed-off-by: Thomas Hurney <hurneyt@amazon.com>

* Add release notes for 3.4.0 (#1999)

Signed-off-by: opensearch-ci <opensearch-infra@amazon.com>
Signed-off-by: Thomas Hurney <hurneyt@amazon.com>

* Publish snapshots to Staging (#2005) (#2006)

(cherry picked from commit 8a6bad3)

Signed-off-by: Divya Madala <divyaasm@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Signed-off-by: Thomas Hurney <hurneyt@amazon.com>

* Revert "PPL Alerting: Execute Monitor and Monitor Stats (#1960)"

This reverts commit 74aed08.

Signed-off-by: Thomas Hurney <hurneyt@amazon.com>

* Revert "PPL Alerting: Get Alerts and Alert Lifecycle (#1972)"

This reverts commit d9614ba

Signed-off-by: Thomas Hurney <hurneyt@amazon.com>

* Revert "PPL Alerting: Delete Monitor, More V1/V2 Separation (#1968)"

This reverts commit fd151de.

Signed-off-by: Thomas Hurney <hurneyt@amazon.com>

* Revert "PPL Alerting: Get and Search Monitors (#1966)"

This reverts commit 819599f.

Signed-off-by: Thomas Hurney <hurneyt@amazon.com>

* Revert "PPL Alerting: Create and Update Monitor V2 (#1961)"

This reverts commit c911cfa

Signed-off-by: Thomas Hurney <hurneyt@amazon.com>

* Revert "PPL Alerting: Models (#1955)"

This reverts commit 497dea8.

Signed-off-by: Thomas Hurney <hurneyt@amazon.com>

---------

Signed-off-by: Daniel Widdis <widdis@gmail.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Signed-off-by: Thomas Hurney <hurneyt@amazon.com>
Signed-off-by: Peter Zhu <zhujiaxi@amazon.com>
Signed-off-by: opensearch-ci <opensearch-infra@amazon.com>
Signed-off-by: Divya Madala <divyaasm@amazon.com>
Co-authored-by: opensearch-trigger-bot[bot] <98922864+opensearch-trigger-bot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: opensearch-ci <83309141+opensearch-ci-bot@users.noreply.github.com>
@opensearch-trigger-bot
Copy link
Contributor

The backport to 2.19 failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/alerting/backport-2.19 2.19
# Navigate to the new working tree
pushd ../.worktrees/alerting/backport-2.19
# Create a new branch
git switch --create backport-1996-to-2.19
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 72f9fcf6aa4b094fa4e3277be2ecc84ef00ac99c
# Push it to GitHub
git push --set-upstream origin backport-1996-to-2.19
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/alerting/backport-2.19

Then, create a pull request where the base branch is 2.19 and the compare/head branch is backport-1996-to-2.19.

@opensearch-trigger-bot
Copy link
Contributor

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/alerting/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/alerting/backport-2.x
# Create a new branch
git switch --create backport-1996-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 72f9fcf6aa4b094fa4e3277be2ecc84ef00ac99c
# Push it to GitHub
git push --set-upstream origin backport-1996-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/alerting/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport-1996-to-2.x.

AWSHurneyt pushed a commit to AWSHurneyt/OpenSearch-Alerting that referenced this pull request Mar 3, 2026
AWSHurneyt added a commit that referenced this pull request Mar 3, 2026
Signed-off-by: Daniel Widdis <widdis@gmail.com>
Co-authored-by: Daniel Widdis <widdis@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants