Merge remote-tracking branch 'upstream/main' into fix_yaml

gaobinlong · gaobinlong · commit 8a0a4ad81cbf · 2025-09-23T15:40:47.000+08:00
diff --git a/.github/workflows/benchmark-pull-request.yml b/.github/workflows/benchmark-pull-request.yml
@@ -149,7 +149,7 @@ jobs:
         run: |
           ./gradlew :distribution:archives:linux-tar:assemble -Dbuild.snapshot=false
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ secrets.UPLOAD_ARCHIVE_ARTIFACT_ROLE }}
           role-session-name: publish-to-s3
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,71 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ main ]
+  schedule:
+    - cron: '42 20 * * 6'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'java' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
+        # Learn more:
+        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5
+    - name: Set up JDK 21
+      uses: actions/setup-java@v4
+      with:
+        java-version: 21
+        distribution: temurin
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v3
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/lucene-snapshots.yml b/.github/workflows/lucene-snapshots.yml
@@ -47,7 +47,7 @@ jobs:
         run: ./gradlew publishJarsPublicationToMavenLocal -Pversion.suffix=snapshot-${{ env.REVISION }}
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ secrets.LUCENE_SNAPSHOTS_SECRET_ROLE }}
           aws-region: us-east-1
@@ -60,7 +60,7 @@ jobs:
           echo "LUCENE_SNAPSHOTS_BUCKET=$lucene_snapshots_bucket" >> $GITHUB_OUTPUT
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ secrets.LUCENE_SNAPSHOTS_S3_ROLE }}
           aws-region: us-east-1
@@ -70,7 +70,7 @@ jobs:
           aws s3 cp ~/.m2/repository/org/apache/lucene/ s3://${{ steps.get_s3_bucket.outputs.LUCENE_SNAPSHOTS_BUCKET }}/snapshots/lucene/org/apache/lucene/  --recursive --no-progress
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ secrets.LUCENE_SNAPSHOTS_ROLE }}
           aws-region: us-west-2
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -96,6 +96,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `log4j2` from 2.21.0 to 2.25.1 ([#19184](https://github.com/opensearch-project/OpenSearch/pull/19184))
 - Bump Apache Lucene from 10.2.2 to 10.3.0 ([#19296](https://github.com/opensearch-project/OpenSearch/pull/19296))
 - Add com.google.code.gson:gson to the gradle version catalog ([#19328](https://github.com/opensearch-project/OpenSearch/pull/19328))
+- Bump `org.apache.logging.log4j:log4j-core` from 2.25.1 to 2.25.2 ([#19360](https://github.com/opensearch-project/OpenSearch/pull/19360))
+- Bump `aws-actions/configure-aws-credentials` from 4 to 5 ([#19363](https://github.com/opensearch-project/OpenSearch/pull/19363))
+- Bump `com.azure:azure-identity` from 1.14.2 to 1.18.0 ([#19361](https://github.com/opensearch-project/OpenSearch/pull/19361))
 
 ### Deprecated
 
diff --git a/build.gradle b/build.gradle
@@ -410,7 +410,8 @@ gradle.projectsEvaluated {
       if (task != null) {
         task.jvmArgs += [
             "--add-modules=jdk.incubator.vector",
-            "--add-exports=java.base/com.sun.crypto.provider=ALL-UNNAMED"
+            "--add-exports=java.base/com.sun.crypto.provider=ALL-UNNAMED",
+            "--enable-native-access=ALL-UNNAMED"
         ]
 
         // Add Java Agent for security sandboxing
diff --git a/buildSrc/src/testKit/thirdPartyAudit/sample_jars/build.gradle b/buildSrc/src/testKit/thirdPartyAudit/sample_jars/build.gradle
@@ -17,7 +17,7 @@ repositories {
 }
 
 dependencies {
-  implementation "org.apache.logging.log4j:log4j-core:2.25.1"
+  implementation "org.apache.logging.log4j:log4j-core:2.25.2"
 }
 
 ["0.0.1", "0.0.2"].forEach { v ->
diff --git a/plugins/repository-azure/build.gradle b/plugins/repository-azure/build.gradle
@@ -57,7 +57,7 @@ dependencies {
   api "io.netty:netty-transport-native-unix-common:${versions.netty}"
   implementation project(':modules:transport-netty4')
   api 'com.azure:azure-storage-blob:12.31.2'
-  api 'com.azure:azure-identity:1.14.2'
+  api 'com.azure:azure-identity:1.18.0'
   // Start of transitive dependencies for azure-identity
   api 'com.microsoft.azure:msal4j-persistence-extension:1.3.0'
   api "net.java.dev.jna:jna-platform:${versions.jna}"
diff --git a/plugins/repository-azure/licenses/azure-identity-1.14.2.jar.sha1 b/plugins/repository-azure/licenses/azure-identity-1.14.2.jar.sha1
diff --git a/plugins/repository-azure/licenses/azure-identity-1.18.0.jar.sha1 b/plugins/repository-azure/licenses/azure-identity-1.18.0.jar.sha1
@@ -0,0 +1 @@
+b10ea68d795e9cbbbb2e136f804e6ff6a8fa8821
diff --git a/qa/evil-tests/build.gradle b/qa/evil-tests/build.gradle
@@ -40,36 +40,12 @@ apply plugin: 'opensearch.testclusters'
 apply plugin: 'opensearch.standalone-test'
 
 dependencies {
-  testImplementation 'com.google.jimfs:jimfs:1.3.1'
   testImplementation(project(':distribution:tools:plugin-cli')) {
     exclude group: 'org.bouncycastle'
   }
   testCompileOnly "com.github.spotbugs:spotbugs-annotations:4.9.4"
 }
 
-// TODO: give each evil test its own fresh JVM for more isolation.
-
 test {
   systemProperty 'tests.security.manager', 'false'
 }
-
-thirdPartyAudit {
-  ignoreMissingClasses(
-    'com.ibm.icu.lang.UCharacter'
-  )
-
-  ignoreViolations(
-    // uses internal java api: sun.misc.Unsafe
-    'com.google.common.hash.LittleEndianByteArray$UnsafeByteArray',
-    'com.google.common.hash.LittleEndianByteArray$UnsafeByteArray$1',
-    'com.google.common.hash.LittleEndianByteArray$UnsafeByteArray$2',
-    'com.google.common.primitives.UnsignedBytes$LexicographicalComparatorHolder$UnsafeComparator',
-    'com.google.common.util.concurrent.AbstractFutureState$UnsafeAtomicHelper'
-  )
-}
-
-tasks.test {
-    if (BuildParams.runtimeJavaVersion > JavaVersion.VERSION_1_8) {
-        jvmArgs += ["--add-opens", "java.base/java.lang=ALL-UNNAMED"]
-    }
-}
diff --git a/qa/evil-tests/src/test/java/org/opensearch/bootstrap/EvilBootstrapChecksTests.java b/qa/evil-tests/src/test/java/org/opensearch/bootstrap/EvilBootstrapChecksTests.java
@@ -54,7 +54,7 @@
 
 public class EvilBootstrapChecksTests extends AbstractBootstrapCheckTestCase {
 
-    private String esEnforceBootstrapChecks = System.getProperty(OPENSEARCH_ENFORCE_BOOTSTRAP_CHECKS);
+    private final String enforceBootstrapChecks = System.getProperty(OPENSEARCH_ENFORCE_BOOTSTRAP_CHECKS);
 
     @Override
     @Before
@@ -65,12 +65,12 @@ public void setUp() throws Exception {
     @Override
     @After
     public void tearDown() throws Exception {
-        setEsEnforceBootstrapChecks(esEnforceBootstrapChecks);
+        setEnforceBootstrapChecks(enforceBootstrapChecks);
         super.tearDown();
     }
 
     public void testEnforceBootstrapChecks() throws NodeValidationException {
-        setEsEnforceBootstrapChecks("true");
+        setEnforceBootstrapChecks("true");
         final List<BootstrapCheck> checks = Collections.singletonList(context -> BootstrapCheck.BootstrapCheckResult.failure("error"));
 
         final Logger logger = mock(Logger.class);
@@ -86,7 +86,7 @@ public void testEnforceBootstrapChecks() throws NodeValidationException {
     }
 
     public void testNonEnforcedBootstrapChecks() throws NodeValidationException {
-        setEsEnforceBootstrapChecks(null);
+        setEnforceBootstrapChecks(null);
         final Logger logger = mock(Logger.class);
         // nothing should happen
         BootstrapChecks.check(emptyContext, false, emptyList(), logger);
@@ -95,7 +95,7 @@ public void testNonEnforcedBootstrapChecks() throws NodeValidationException {
 
     public void testInvalidValue() {
         final String value = randomAlphaOfLength(8);
-        setEsEnforceBootstrapChecks(value);
+        setEnforceBootstrapChecks(value);
         final boolean enforceLimits = randomBoolean();
         final IllegalArgumentException e = expectThrows(
                 IllegalArgumentException.class,
@@ -106,7 +106,7 @@ public void testInvalidValue() {
     }
 
     @SuppressForbidden(reason = "set or clear system property opensearch.enforce.bootstrap.checks")
-    public void setEsEnforceBootstrapChecks(final String value) {
+    public void setEnforceBootstrapChecks(final String value) {
         if (value == null) {
             System.clearProperty(OPENSEARCH_ENFORCE_BOOTSTRAP_CHECKS);
         } else {
diff --git a/qa/translog-policy/src/test/java/org/opensearch/upgrades/TranslogPolicyIT.java b/qa/translog-policy/src/test/java/org/opensearch/upgrades/TranslogPolicyIT.java

Original file line number	Diff line number	Diff line change
`@@ -410,7 +410,8 @@ gradle.projectsEvaluated {`
`410`	`410`	`if (task != null) {`
`411`	`411`	`task.jvmArgs += [`
`412`	`412`	`"--add-modules=jdk.incubator.vector",`
`413`		`- "--add-exports=java.base/com.sun.crypto.provider=ALL-UNNAMED"`
	`413`	`+ "--add-exports=java.base/com.sun.crypto.provider=ALL-UNNAMED",`
	`414`	`+ "--enable-native-access=ALL-UNNAMED"`
`414`	`415`	`]`
`415`	`416`
`416`	`417`	`// Add Java Agent for security sandboxing`
Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@ repositories {`
`17`	`17`	`}`
`18`	`18`
`19`	`19`	`dependencies {`
`20`		`- implementation "org.apache.logging.log4j:log4j-core:2.25.1"`
	`20`	`+ implementation "org.apache.logging.log4j:log4j-core:2.25.2"`
`21`	`21`	`}`
`22`	`22`
`23`	`23`	`["0.0.1", "0.0.2"].forEach { v ->`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+b10ea68d795e9cbbbb2e136f804e6ff6a8fa8821`