dependabot[bot] opened a new pull request, #12579: URL: https://github.com/apache/maven/pull/12579
Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.2.13 to 1.6.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-classic's releases</a>.</em></p> <blockquote> <h2>Logback 1.6.1</h2> <p><strong>2026-07-28 Release of logback version 1.6.1</strong></p> <p>• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. <code>.gz</code>, <code>.zip</code>, <code>.xz</code>). Previously it used a nanotime-based <code>.tmp</code> suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)</p> <p>• On GZ, ZIP, or XZ compression failure, the original (uncompressed) log file is no longer deleted. Compression strategies now delete the source file only after successful compression and emit a warning that the original was left intact.</p> <p>• ConsoleAppender with <!-- raw HTML omitted --> now probes JLine's org.jline.jansi.AnsiConsole first and falls back to the legacy FuseSource org.fusesource.jansi.AnsiConsole class. This keeps ANSI coloring working after Jansi moved under the JLine project. The optional org.jline:jansi-core artifact is declared as a dependency alongside the existing FuseSource jansi dependency. A preferredJansiClassName property was added for tests. This issue was reported in <a href="https://redirect.github.com/qos-ch/logback/issues/1043";>issues/1043</a> by <a href="https://github.com/seonwooj0810";>seonwoo_jung</a> who also provided the relevant PR.</p> <p>• LayoutWrappingEncoder now reports an error at start() when no layout is set and guards encode() against a null layout. Previously, a missing layout (for example after an ignored <!-- raw HTML omitted -->/<!-- raw HTML omitted -->/<!-- raw HTML omitted --> branch) allowed the encoder to start and then fail with a NullPointerException on every event, resulting in silent log loss. This issue was reported in <a href="https://redirect.github.com/qos-ch/logback/issues/1046";>issues/1046</a> by <a href="https://github.com/seonwooj0810";>seonwoo_jung</a> who also provided the relevant PR.</p> <p>• FileCollisionAnalyser now detects file collisions involving nested appenders of SiftingAppender. When the nested file or fileNamePattern does not textually reference the discriminator key (e.g. ${userId}), a warning is issued at configuration time naming the appender, the key, and the shared target. This closes a gap where statically declared file appenders were checked but sifted nested appenders were not. This enhancement was contributed in [PR <a href="https://redirect.github.com/qos-ch/logback/issues/1041";>#1041</a>](<a href="https://redirect.github.com/qos-ch/logback/issues/1041";>qos-ch/logback#1041</a>) by <a href="https://github.com/seonwooj0810";>seonwoo_jung</a>.</p> <p>• More defensive handling in SyslogOutputStream and SyslogAppenderBase: the close() method now ensures that resources are closed, writes and flushes check that the underlying resources are in a valid state and fallback to no-op otherwise.</p> <p>• A bit-wise identical binary of this version can be reproduced by building from source code at commit 57759f433000a133088ef0441038963134437fbd associated with the tag v_1.6.1. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <p>• See <a href="https://logback.qos.ch/news.html#1.6.1";>https://logback.qos.ch/news.html#1.6.1</a> for the original text.</p> <h2>Logback 1.6.0</h2> <p><strong>2026-07-23 Release of logback version 1.6.0</strong></p> <p>• Removed certain deprecated variables, methods, and classes. For the list of removed members see <a href="https://logback.qos.ch/notes/release_1.6.0.txt";>release_1.6.0.txt.</a></p> <p>• In <code>AsyncAppenderBase</code>, the <code>put(ILoggingEvent)</code> method now has the protected modifier to allow access from derived classes. This change was requested by Thomas Skjølberg in <a href="https://redirect.github.com/qos-ch/logback/pull/1053";>pr#1053</a>.</p> <p>• Bump SLF4J dependency to version 2.0.18.</p> <p>• <strong>See also the overview of the <a href="https://logback.qos.ch/news.html#latest_stable";>1.6.x series</a>.</strong></p> <p>• A bit-wise identical binary of this version can be reproduced by building from source code at commit b07adf36019b51a10f824fdd94009985c587b1d3 associated with the tag v_1.6.0. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <h2>Logback 1.5.38</h2> <p><strong>2026-07-09 Release of logback version 1.5.38</strong></p> <p>• In <code>HardenedObjectInputStream</code>, fixed a typo preventing <code>Throwable</code> objects from being white-filtered. This issue was reported in [PR <a href="https://redirect.github.com/qos-ch/logback/issues/1045";>#1045</a>](<a href="https://redirect.github.com/qos-ch/logback/pull/1045";>qos-ch/logback#1045</a>) by <a href="https://github.com/t0rchwo0d";>t0rchwo0d</a>.</p> <p>• A bitwise identical binary of this version can be reproduced by building from source code at commit d04984a41fce42977466f45a2f076f0ee5cc4207 associated with the tag v_1.5.38. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <h2>Logback 1.5.37</h2> <p><strong>2026-06-26 Release of logback version 1.5.37</strong></p> <ol> <li>• Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed. Users are offered the an <a href="https://logback.qos.ch/translator/services/conditionalConfigMigrator.html";>online migration service</a> or the <code><condition></code> element introduced in version 1.5.20. See the <a href="https://logback.qos.ch/manual/configuration.html#conditional";>relevant documentation</a> for more details.</li> </ol> <p>• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <h2>Logback 1.5.36</h2> <p><strong>2026-06-25 Release of logback version 1.5.36</strong></p> <p>• The 'condition' attribute in <code><if></code> elements now reject certain references that are associated with ACE attacks. This issue was reported by "yulate" (<a href="mailto:[email protected]";>[email protected]</a>) and registered as <a href="https://www.cve.org/cverecord?id=CVE-2026-13006";>CVE-2026-13006</a>. <strong>Please note that version 1.5.37 provides the full fix to this vulnerability.</strong></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/qos-ch/logback/commit/57759f433000a133088ef0441038963134437fbd";><code>57759f4</code></a> prepare release 1.6.1</li> <li><a href="https://github.com/qos-ch/logback/commit/175f99f2093ae07f4c8d44f93b800f65b03a6e19";><code>175f99f</code></a> fix imports</li> <li><a href="https://github.com/qos-ch/logback/commit/4b8773ed127fdc62b85a7c7ddaef10f25830788c";><code>4b8773e</code></a> add compressionFailureLeavesOriginalFileIntact test for XZ compression</li> <li><a href="https://github.com/qos-ch/logback/commit/cafaf1115fd20be19b2f7a4a09184446e8bbc04d";><code>cafaf11</code></a> do not delete original file if compression fails</li> <li><a href="https://github.com/qos-ch/logback/commit/ee50125b293f5a731543de9f9f5fb72756a43464";><code>ee50125</code></a> let the temporary file before compression be target file without the .gz or ....</li> <li><a href="https://github.com/qos-ch/logback/commit/5626acc301f4039537a6c668f0f2d51989472785";><code>5626acc</code></a> minor refactoring</li> <li><a href="https://github.com/qos-ch/logback/commit/d97da4fbc0de00ca901ef78d91b9fc1850ae803f";><code>d97da4f</code></a> minor refactoring</li> <li><a href="https://github.com/qos-ch/logback/commit/159c045d8f045ccf8b382775d81d83919c228cca";><code>159c045</code></a> more defensive coding in SyslogOutputStream and in SyslogAppenderBase</li> <li><a href="https://github.com/qos-ch/logback/commit/9427d6b23d5a692c8a76a994c076ef68ded7835c";><code>9427d6b</code></a> slight refactoring for clarity</li> <li><a href="https://github.com/qos-ch/logback/commit/79c4179c0b440a9dcf35bc9bda1ead2b2f90966c";><code>79c4179</code></a> slight refactoring</li> <li>Additional commits viewable in <a href="https://github.com/qos-ch/logback/compare/v_1.2.13...v_1.6.1";>compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | ch.qos.logback:logback-classic | [>= 1.5.a0, < 1.6] | </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
