upgrade log4j

[pjfanning]

Purpose of the pull request

Brief change log

Verify this pull request

This pull request is code cleanup without any test coverage.

(or)

This pull request is already covered by existing tests, such as (please describe tests).

(or)

This change added tests and can be verified as follows:

[codecov-commenter]

Codecov Report

Merging #10359 (dd54ef5) into dev (0bf4043) will decrease coverage by 0.00%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##                dev   #10359      +/-   ##
============================================
- Coverage     40.18%   40.18%   -0.01%     
+ Complexity     4727     4726       -1     
============================================
  Files           871      871              
  Lines         35375    35375              
  Branches       3943     3943              
============================================
- Hits          14215    14214       -1     
  Misses        19731    19731              
- Partials       1429     1430       +1     

Impacted Files	Coverage Δ
...er/master/dispatch/host/assign/RandomSelector.java	77.77% <0.00%> (-5.56%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0bf4043...dd54ef5. Read the comment docs.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[kezhenxu94]

Any update @pjfanning

[pjfanning]

@kezhenxu94 the change in this PR is the only place where dolphinscheduler explicitly uses an old version of log4j. There are quite a few old dependencies of dolphinscheduler that are bringing in old log4j dependencies though.

• hive-common
• spring-boot-starter
• zookeeper has a dependency on log4jv1

[kezhenxu94]

LGTM. This is just an E2E dependency and they won't be included in distribution package though