Skip to content

Update to the latest log4j and spotbugs versions - #6486

Open
ddanielr wants to merge 10 commits into
apache:2.1from
ddanielr:deps/update-log4j-spotbugs
Open

Update to the latest log4j and spotbugs versions#6486
ddanielr wants to merge 10 commits into
apache:2.1from
ddanielr:deps/update-log4j-spotbugs

Conversation

@ddanielr

Copy link
Copy Markdown
Contributor

Bumps versions and fixes deprecated builder pattern

Bumps versions and fixes deprecated builder pattern
@ddanielr ddanielr added this to the 2.1.7 milestone Jul 21, 2026

@ctubbsii ctubbsii left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The build is still failing. I think it's probably okay to suppress these in 2.1, but in main, we should work to remove the problems spotbugs found, because we do a lot less static stuff in the main branch now, and we can probably do better with regards to these checks there.

ddanielr added 8 commits July 22, 2026 03:46
Added private locks for methods that were synchronized to fix spotbugs
findings
Runnable requires a public run() method so these can't be fixed
Fixed these spotbug findings
The intent of this code is not clear.
This may not be the correct way to do this but will review it at the PR
stage.

@dlmarion dlmarion left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm a little confused why we are making so many changes if we are also excluding these spotbugs issues.

ThreadPools.watchCriticalScheduledTask(context.getScheduledExecutor().scheduleWithFixedDelay(
new CompactionWatcher(context.getConfiguration()), 10000, 10000, TimeUnit.MILLISECONDS));
watching = true;
public static void startWatching(ServerContext context) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the exclusion not cover this case? Just curious why we are fixing some of these but also have the exclusion.

// remove old settings from zookeeper first, if any
ZooReaderWriter zoo = context.getZooReaderWriter();
synchronized (zooCache) {
synchronized (zooCacheLock) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did this have to change?

@ctubbsii ctubbsii left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These suppressions are fine for the 2.1 branch, but I think working through these in the main branch so we can move towards a better concurrency model that's easier for QA tooling to verify would be a great goal.

I think the DistributedWorkQueue logic is broken, and some of the annotated inline suppressions need a justification parameter.

}

@Override
@SuppressFBWarnings("USO_UNSAFE_OBJECT_SYNCHRONIZATION")

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Annotated spotbugs suppressions should include a justification

import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;

@SuppressFBWarnings(value = "NP_NULL_PARAM_DEREF_NONVIRTUAL",
justification = "Test code is testing that a NPE is thrown")

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This false positive for assertThrows is probably something that spotbugs should just ignore automatically. Could open a bug report upstream to indicate that these are false positives.

Comment on lines +281 to +283
private final Object condVar = new Object();

final Object condVar = new Object();
public void waitUntilDone(Set<String> workIDs) throws KeeperException, InterruptedException {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this is correct. This would create a global lock object for all calls to waitUntilDone with different IDs. However, this appears to require a separate one for each call to this method.

I'm not sure the notify/wait logic is correct either (potential preexisting problem), since it looks like the synchronization prevents the object from being notified while it is waiting. It looks like it can only notify once the 10 second wait is done... which defeats the point, because it doesn't need to be notified at that point, since it's already back to iterating in the loop.

A proper fix might remove the NN_NAKED_NOTIFY warning suppression as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants