any near-term plans to update the log4j version included in the hudson war to at least 1.2.12 (currently 1.2.16), for the change log see:
http://logging.apache.org/log4j/1.2/changes-report.html

What needs to be changed in order to move to the latest 1.2.x version? I'm willing to submit a patch if someone can point me to the right pom file(s).

We've just upgraded log4j to 1.2.16 (simply replacing .jar file) in jenkins 1.503. So far we didn't notice any problems.

What's the problem with upgrade in jenkins ditribution? Did we miss something important before jar replacement?

Cheers,

R.

this would also be benefical for other plugins. e.g. see:
https://github.com/xhaggi/deploy-plugin

To use JBoss 7.x and WildFly 8.x support you have to manually upgrade the log4j library in your jenkins.war. This is required because jboss-logging depends on a newer version of log4j.

Same problem as Roman. Update would be great.

I had some similar issues with Hibernate 4, which uses jboss-logging, which also depends on a newer version of log4j.
So I opened a PR for this - https://github.com/jenkinsci/jenkins/pull/1734

The old version of log4j was pulled in by
<groupId>org.acegisecurity</groupId>
<artifactId>acegi-security</artifactId>
as a runtime dependency, so I just added an explicit compile dependency to the latest log4j version (1.2.17).

Thoughts on this?

Code changed in jenkins
User: Michael Prankl
Path:
core/pom.xml
http://jenkins-ci.org/commit/jenkins/b6cdc39343a63ac457f9a47588f8674b48166a44
Log:
JENKINS-4433 Upgrade log4j to 1.2.17

Code changed in jenkins
User: Michael Prankl
Path:
core/pom.xml
pom.xml
http://jenkins-ci.org/commit/jenkins/8886b04ab5cbdb591f64704d0bba896d0d61d3ff
Log:
JENKINS-4433 Add log4j to dependency management section, exclude it for acegi-security dependency.

Code changed in jenkins
User: Ulli Hafner
Path:
core/pom.xml
pom.xml
http://jenkins-ci.org/commit/jenkins/bc744f989204fa21c1569b1c21ed046997da043a
Log:
Merge pull request #1734 from eidottermihi/master

[FIXED JENKINS-4433] Explicitly set log4j version to 1.2.17.

Compare: https://github.com/jenkinsci/jenkins/compare/5d002924628a...bc744f989204

Integrated in jenkins_main_trunk #4196
JENKINS-4433 Upgrade log4j to 1.2.17 (Revision b6cdc39343a63ac457f9a47588f8674b48166a44)
JENKINS-4433 Add log4j to dependency management section, exclude it for acegi-security dependency. (Revision 8886b04ab5cbdb591f64704d0bba896d0d61d3ff)

Result = UNSTABLE
eidottermihi : b6cdc39343a63ac457f9a47588f8674b48166a44
Files :

• core/pom.xml

eidottermihi : 8886b04ab5cbdb591f64704d0bba896d0d61d3ff
Files :

• core/pom.xml
• pom.xml