Upgrade Log4j to 2.25.3 (#3603)

Remove explicit dependencies on `osgi.annotation` and `biz.aQute.bnd.annotation`. Since Log4j 2.25.0, all artifacts publish Gradle Module Metadata that brings in these annotation libs as transitive compile-only dependencies, avoiding `-Xlint:classfile` warnings without needing to declare them directly.
Remove `spotbugs-annotations` pulled in via Apache POI as a transitive **compile-only** dependency. It is not required for the build but triggers license check failures because SpotBugs (including its annotations) is licensed under LGPL-2.1.

Author: ppkarwasz

changelog/unreleased/PR#3603-update-log4j.yml

@@ -0,0 +1,9 @@
+# See https://github.com/apache/solr/blob/main/dev-docs/changelog.adoc
+title: Upgrade Log4j to 2.25.3
+type: dependency_update
+authors:
+  - name: Piotr P. Karwasz
+    nick: ppkarwasz
+    url: https://home.apache.org/phonebook.html?uid=pkarwasz
+merge_requests:
+  - 3603

gradle/libs.versions.toml

@@ -36,7 +36,7 @@ apache-httpcomponents-httpclient = "4.5.14"
 apache-httpcomponents-httpcore = "4.4.16"
 apache-httpcomponents-httpmime = "4.5.14"
 apache-kafka = "3.9.1"
-apache-log4j = "2.21.0"
+apache-log4j = "2.25.3"
 apache-lucene = "10.3.2"
 apache-opennlp = "2.5.6"
 apache-rat = "0.15"
@@ -45,7 +45,6 @@ apache-tomcat = "6.0.53"
 apache-zookeeper = "3.9.4"
 # @keep for version alignment
 apiguardian = "1.1.2"
-aqute-bnd = "6.4.1"
 # @keep Asciidoctor mathjax version used in ref-guide
 asciidoctor-mathjax = "0.0.9"
 # @keep Asciidoctor tabs version used in ref-guide
@@ -304,7 +303,6 @@ apache-zookeeper-jute = { module = "org.apache.zookeeper:zookeeper-jute", versio
 apache-zookeeper-zookeeper = { module = "org.apache.zookeeper:zookeeper", version.ref = "apache-zookeeper" }
 # @keep transitive dependency for version alignment
 apiguardian-api = { module = "org.apiguardian:apiguardian-api", version.ref = "apiguardian" }
-aqute-bnd-annotation = { module = "biz.aQute.bnd:biz.aQute.bnd.annotation", version.ref = "aqute-bnd" }
 bc-jose4j = { module = "org.bitbucket.b_c:jose4j", version.ref = "bc-jose4j" }
 benmanes-caffeine = { module = "com.github.ben-manes.caffeine:caffeine", version.ref = "benmanes-caffeine" }
 bouncycastle-bcpkix = { module = "org.bouncycastle:bcpkix-jdk18on", version.ref = "bouncycastle" }
@@ -491,7 +489,6 @@ opentelemetry-sdk-extension-autoconfigure = { module = "io.opentelemetry:opentel
 opentelemetry-sdk-metrics = { module = "io.opentelemetry:opentelemetry-sdk-metrics", version.ref = "opentelemetry" }
 opentelemetry-sdk-testing = { module = "io.opentelemetry:opentelemetry-sdk-testing", version.ref = "opentelemetry" }
 opentelemetry-sdk-trace = { module = "io.opentelemetry:opentelemetry-sdk-trace", version.ref = "opentelemetry" }
-osgi-annotation = { module = "org.osgi:osgi.annotation", version.ref = "osgi-annotation" }
 oshai-logging = { module = "io.github.oshai:kotlin-logging", version.ref = "oshai-logging" }
 # @keep transitive dependency for version alignment
 ow2-asm-asm = { module = "org.ow2.asm:asm", version.ref = "ow2-asm" }

solr/api/gradle.lockfile

@@ -95,9 +95,9 @@ org.apache.curator:curator-test:5.9.0=jarValidation,testRuntimeClasspath
 org.apache.httpcomponents:httpclient:4.5.14=jarValidation,testRuntimeClasspath
 org.apache.httpcomponents:httpcore:4.4.16=jarValidation,testRuntimeClasspath
 org.apache.httpcomponents:httpmime:4.5.14=jarValidation,testRuntimeClasspath
-org.apache.logging.log4j:log4j-api:2.21.0=jarValidation,testRuntimeClasspath
-org.apache.logging.log4j:log4j-core:2.21.0=jarValidation,testRuntimeClasspath
-org.apache.logging.log4j:log4j-slf4j2-impl:2.21.0=jarValidation,testRuntimeClasspath
+org.apache.logging.log4j:log4j-api:2.25.3=jarValidation,testRuntimeClasspath
+org.apache.logging.log4j:log4j-core:2.25.3=jarValidation,testRuntimeClasspath
+org.apache.logging.log4j:log4j-slf4j2-impl:2.25.3=jarValidation,testRuntimeClasspath
 org.apache.lucene:lucene-analysis-common:10.3.2=jarValidation,testCompileClasspath,testRuntimeClasspath
 org.apache.lucene:lucene-analysis-kuromoji:10.3.2=jarValidation,testRuntimeClasspath
 org.apache.lucene:lucene-analysis-nori:10.3.2=jarValidation,testRuntimeClasspath

solr/benchmark/gradle.lockfile

@@ -86,9 +86,9 @@ org.apache.curator:curator-test:5.9.0=jarValidation,runtimeClasspath,testRuntime
 org.apache.httpcomponents:httpclient:4.5.14=jarValidation,runtimeClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpcore:4.4.16=jarValidation,runtimeClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpmime:4.5.14=jarValidation,runtimeClasspath,testRuntimeClasspath
-org.apache.logging.log4j:log4j-api:2.21.0=jarValidation,runtimeClasspath,testRuntimeClasspath
-org.apache.logging.log4j:log4j-core:2.21.0=jarValidation,runtimeClasspath,testRuntimeClasspath
-org.apache.logging.log4j:log4j-slf4j2-impl:2.21.0=jarValidation,runtimeClasspath,testRuntimeClasspath
+org.apache.logging.log4j:log4j-api:2.25.3=jarValidation,runtimeClasspath,testRuntimeClasspath
+org.apache.logging.log4j:log4j-core:2.25.3=jarValidation,runtimeClasspath,testRuntimeClasspath
+org.apache.logging.log4j:log4j-slf4j2-impl:2.25.3=jarValidation,runtimeClasspath,testRuntimeClasspath
 org.apache.lucene:lucene-analysis-common:10.3.2=compileClasspath,jarValidation,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.lucene:lucene-analysis-kuromoji:10.3.2=jarValidation,runtimeClasspath,testRuntimeClasspath
 org.apache.lucene:lucene-analysis-nori:10.3.2=jarValidation,runtimeClasspath,testRuntimeClasspath

solr/core/build.gradle

@@ -176,9 +176,6 @@ dependencies {
   // For faster XML processing than the JDK
   implementation libs.codehaus.woodstox.stax2api
   implementation libs.fasterxml.woodstox.core
-  // See https://issues.apache.org/jira/browse/LOG4J2-3609 due to needing these annotations
-  compileOnly libs.aqute.bnd.annotation
-  compileOnly libs.osgi.annotation
 
   compileOnly libs.stephenc.jcip.annotations
 

solr/core/gradle.lockfile

@@ -1,7 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-biz.aQute.bnd:biz.aQute.bnd.annotation:6.4.1=compileClasspath,compileOnlyHelper,jarValidation
+biz.aQute.bnd:biz.aQute.bnd.annotation:7.1.0=compileClasspath,testCompileClasspath
 com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.8.3=jarValidation,testCompileClasspath,testRuntimeClasspath
 com.carrotsearch:hppc:0.10.0=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-annotations:2.20=apiHelper,compileClasspath,jarValidation,permitUnusedDeclared,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
@@ -95,9 +95,9 @@ org.apache.curator:curator-test:5.9.0=jarValidation,testCompileClasspath,testRun
 org.apache.httpcomponents:httpclient:4.5.14=jarValidation,testCompileClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpcore:4.4.16=jarValidation,testCompileClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpmime:4.5.14=jarValidation,testRuntimeClasspath
-org.apache.logging.log4j:log4j-api:2.21.0=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
-org.apache.logging.log4j:log4j-core:2.21.0=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
-org.apache.logging.log4j:log4j-slf4j2-impl:2.21.0=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
+org.apache.logging.log4j:log4j-api:2.25.3=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
+org.apache.logging.log4j:log4j-core:2.25.3=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
+org.apache.logging.log4j:log4j-slf4j2-impl:2.25.3=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
 org.apache.lucene:lucene-analysis-common:10.3.2=apiHelper,compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,testCompileClasspath,testRuntimeClasspath
 org.apache.lucene:lucene-analysis-icu:10.3.2=jarValidation,testRuntimeClasspath
 org.apache.lucene:lucene-analysis-kuromoji:10.3.2=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
@@ -178,9 +178,10 @@ org.mockito:mockito-core:5.19.0=jarValidation,testCompileClasspath,testRuntimeCl
 org.mockito:mockito-subclass:5.19.0=jarValidation,testRuntimeClasspath
 org.objenesis:objenesis:3.3=jarValidation,testRuntimeClasspath
 org.opentest4j:opentest4j:1.2.0=jarValidation,testCompileClasspath,testRuntimeClasspath
-org.osgi:org.osgi.resource:1.0.0=compileClasspath,compileOnlyHelper,jarValidation
-org.osgi:org.osgi.service.serviceloader:1.0.0=compileClasspath,compileOnlyHelper,jarValidation
-org.osgi:osgi.annotation:8.1.0=compileClasspath,compileOnlyHelper,jarValidation
+org.osgi:org.osgi.annotation.bundle:2.0.0=compileClasspath,testCompileClasspath
+org.osgi:org.osgi.annotation.versioning:1.1.2=compileClasspath,testCompileClasspath
+org.osgi:org.osgi.resource:1.0.0=compileClasspath,testCompileClasspath
+org.osgi:org.osgi.service.serviceloader:1.0.0=compileClasspath,testCompileClasspath
 org.ow2.asm:asm-commons:9.8=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
 org.ow2.asm:asm-tree:9.8=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
 org.ow2.asm:asm:9.8=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath

solr/cross-dc-manager/gradle.lockfile

@@ -120,12 +120,12 @@ org.apache.kafka:kafka-streams:3.9.1=jarValidation,runtimeClasspath,runtimeLibs,
 org.apache.kafka:kafka-tools-api:3.9.1=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
 org.apache.kafka:kafka-transaction-coordinator:3.9.1=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
 org.apache.kafka:kafka_2.13:3.9.1=jarValidation,runtimeClasspath,runtimeLibs,testRuntimeClasspath
-org.apache.logging.log4j:log4j-1.2-api:2.21.0=solrPlatformLibs
-org.apache.logging.log4j:log4j-api:2.21.0=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
-org.apache.logging.log4j:log4j-core:2.21.0=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
-org.apache.logging.log4j:log4j-layout-template-json:2.21.0=solrPlatformLibs
-org.apache.logging.log4j:log4j-slf4j2-impl:2.21.0=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
-org.apache.logging.log4j:log4j-web:2.21.0=solrPlatformLibs
+org.apache.logging.log4j:log4j-1.2-api:2.25.3=solrPlatformLibs
+org.apache.logging.log4j:log4j-api:2.25.3=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
+org.apache.logging.log4j:log4j-core:2.25.3=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
+org.apache.logging.log4j:log4j-layout-template-json:2.25.3=solrPlatformLibs
+org.apache.logging.log4j:log4j-slf4j2-impl:2.25.3=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
+org.apache.logging.log4j:log4j-web:2.25.3=solrPlatformLibs
 org.apache.lucene:lucene-analysis-common:10.3.2=compileClasspath,jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testCompileClasspath,testRuntimeClasspath
 org.apache.lucene:lucene-analysis-kuromoji:10.3.2=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath
 org.apache.lucene:lucene-analysis-nori:10.3.2=jarValidation,runtimeClasspath,runtimeLibs,solrPlatformLibs,testRuntimeClasspath

solr/licenses/biz.aQute.bnd.annotation-6.4.1.jar.sha1

@@ -0,0 +1 @@
+2f2be18c936d08cf46ea6cfa0043f34afdf38705