(jmeter) branch master updated: fix(deps): update org.apache.logging.log4j to v2.26.1

[mi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

milamberspace pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/jmeter.git


The following commit(s) were added to refs/heads/master by this push:
     new 98966a1d8c fix(deps): update org.apache.logging.log4j to v2.26.1
98966a1d8c is described below

commit 98966a1d8cbae5646d71528aceca81dde47b9378
Author: Milamber <mi...@apache.org>
AuthorDate: Wed Sep 30 22:48:45 2026 +0300

    fix(deps): update org.apache.logging.log4j to v2.26.1
    
    Bump log4j-1.2-api/api/core/slf4j2-impl from 2.26.0 to 2.26.1 together,
    so the Log4j modules stay aligned, and regenerate the expected release
    jar list.
    
    log4j-api 2.26.1 fixes CVE-2026-49844 (non-finite floating-point values
    in MapMessage JSON serialization). JMeter's default configuration only
    uses PatternLayout, so it is not affected by default.
    
    Supersedes #6745, which bumped log4j-api alone.
    
    Generated-by: Claude Code 2.1.286 (Claude Opus 5.5)
---
 src/bom-thirdparty/build.gradle.kts         | 8 ++++----
 src/dist/src/dist/expected_release_jars.csv | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/bom-thirdparty/build.gradle.kts b/src/bom-thirdparty/build.gradle.kts
index 0d5174e590..b0ed709924 100644
--- a/src/bom-thirdparty/build.gradle.kts
+++ b/src/bom-thirdparty/build.gradle.kts
@@ -112,10 +112,10 @@ dependencies {
         api("org.apache.httpcomponents:httpcore-nio:4.4.16")
         api("org.apache.httpcomponents:httpcore:4.4.16")
         api("org.apache.httpcomponents:httpmime:4.5.14")
-        api("org.apache.logging.log4j:log4j-1.2-api:2.26.0")
-        api("org.apache.logging.log4j:log4j-api:2.26.0")
-        api("org.apache.logging.log4j:log4j-core:2.26.0")
-        api("org.apache.logging.log4j:log4j-slf4j2-impl:2.26.0")
+        api("org.apache.logging.log4j:log4j-1.2-api:2.26.1")
+        api("org.apache.logging.log4j:log4j-api:2.26.1")
+        api("org.apache.logging.log4j:log4j-core:2.26.1")
+        api("org.apache.logging.log4j:log4j-slf4j2-impl:2.26.1")
         api("org.apache.rat:apache-rat:0.17")
         api("org.apache.tika:tika-core:4.0.0")
         api("org.apache.velocity:velocity:1.7")
diff --git a/src/dist/src/dist/expected_release_jars.csv b/src/dist/src/dist/expected_release_jars.csv
index 9cfa815b5a..8dbcaa6e9e 100644
--- a/src/dist/src/dist/expected_release_jars.csv
+++ b/src/dist/src/dist/expected_release_jars.csv
@@ -102,10 +102,10 @@
 675271,kotlinx-datetime-jvm-0.6.2.jar
 996,lets-plot-batik-4.8.0.jar
 996,lets-plot-common-4.8.0.jar
-359197,log4j-1.2-api-2.26.0.jar
-351126,log4j-api-2.26.0.jar
-2015101,log4j-core-2.26.0.jar
-30211,log4j-slf4j2-impl-2.26.0.jar
+359196,log4j-1.2-api-2.26.1.jar
+351428,log4j-api-2.26.1.jar
+2015459,log4j-core-2.26.1.jar
+30212,log4j-slf4j2-impl-2.26.1.jar
 519087,mail-1.5.0-b01.jar
 120556,miglayout-core-11.4.3.jar
 23361,miglayout-swing-11.4.3.jar