Skip to content

HIVE-29439: Upgrade SLF4J to 2.0.13 and realign logging bridges#6303

Draft
humashankar26 wants to merge 3 commits intoapache:masterfrom
humashankar26:slf4j-upgrade
Draft

HIVE-29439: Upgrade SLF4J to 2.0.13 and realign logging bridges#6303
humashankar26 wants to merge 3 commits intoapache:masterfrom
humashankar26:slf4j-upgrade

Conversation

@humashankar26
Copy link

What changes were proposed in this pull request?
I've upgraded the logging infrastructure from SLF4J 1.7.x to 2.0.13.

Since SLF4J 2.x moves from static binding to a ServiceLoader architecture, I realigned the bridges to prevent "silent" logging failures. Key changes include:

Updating slf4j-api, slf4j-reload4j, and jcl-over-slf4j to 2.0.13 across the root, standalone-metastore, and storage-api.

Switching the Log4j2 bridge to log4j-slf4j2-impl (2.24.3) to ensure Hive's internal metrics and timing systems can communicate with the new API.

Why are the changes needed?
Security: Resolves several CVEs associated with the older 1.7.x line.

Stability: Modernizes the logging backend and fixes "NOP" (No-Operation) logger errors that were causing metrics and audit logs to be dropped silently.

Does this PR introduce any user-facing change?
No. This is a backend dependency and architectural alignment.

How was this patch tested?
Dependency Audit: Verified via mvn dependency:tree that all modules have converged on 2.0.13 with no legacy 1.7.x bindings remaining.

Unit Tests: Confirmed that logging-dependent tests (e.g., TestAtlasLoadTask, TestHiveRemote, and TestOperationLogManager) are passing, specifically verifying that metrics and API timing strings are correctly captured.

Build Integrity: Passed a clean local build to ensure no compilation regressions in ql or service modules.

@sonarqubecloud
Copy link

sonarqubecloud bot commented Feb 5, 2026

Drop legacy SLF4J providers/bridges and add explicit exclusions to prevent
log4j-slf4j-impl and slf4j-simple/reload4j from reappearing transitively.
Switch to MarkerFactory for query-complete markers so LLAP builds cleanly
with SLF4J 2.x provider-only bindings.

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants