Hello All, A change was raised and released in version 1.3.0 of Kedro: https://github.com/kedro-org/kedro/pull/5471 Even though this fixes a security vulnerability, this has now broken an existing feature for us. We are using custom filters in our logging.yml files.

filters:
  filter_1:
    (): "project_module.FilterClass1"
  filter_2:
    (): "project_module.FilterClass2"

The new changes disallow using "()" key in the configuration. However, if you check the underlying core Python logging library implementation, it has a special meaning for "()" key. It uses "()" to specifically identify a custom filter and allow its configuration. Any other key, is ignored. This change is therefore not allowing us to use our custom logging filters with Kedro. @Ankita Katiyar @Deepyaman Datta @Elena Khaustova @Rashida Kanchwala Do you have an alternative method for continuing to use custom filters?

Hi, You’re right... the

():

syntax was removed due to an RCE vulnerability, since it allowed arbitrary class instantiation from YAML config files. A safe alternative is to apply logging filters programmatically using Kedro Hooks. Here’s an example: 1. Create `src/project_module/hooks.py`:

import logging
from kedro.framework.hooks import hook_impl
from project_module import FilterClass1, FilterClass2


class ProjectHooks:
    @hook_impl
    def after_context_created(self, context) -> None:
        """Apply custom logging filters programmatically."""
        root_logger = logging.getLogger()

        for handler in root_logger.handlers:
            if handler.__class__.__name__ == "RichHandler":
                handler.addFilter(FilterClass1())
                handler.addFilter(FilterClass2())

2. Enable in `settings.py`:

from project_module.hooks import ProjectHooks

HOOKS = (ProjectHooks(),)

3. Remove

():

from

logging.yml

(filters are now applied safely via hooks).