You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by Julian Reschke <re...@apache.org> on 2026/02/10 17:58:17 UTC
[RESULT] [VOTE] Release Apache Sling XSS Protection API 2.4.10
Hi,
The vote has passed with the following result:
+1 (binding): Carsten Ziegeler, Robert Munteanu, Julian Reschke
I will copy this release to the Sling dist directory and
promote the artifacts to the central Maven repository.
Thanks for voting!
Re: [RESULT] [VOTE] Release Apache Sling XSS Protection API 2.4.10
Posted by Julian Reschke <re...@apache.org>.
Am 13.02.2026 um 12:55 schrieb Julian Reschke:
> Am 12.02.2026 um 08:07 schrieb Carsten Ziegeler:
>> It seems the problem is the embedded commons.logging, this patch
>> should fix it:
>>
>> diff --git a/pom.xml b/pom.xml
>> index 2aed779..c0cfc3c 100644
>> --- a/pom.xml
>> +++ b/pom.xml
>> @@ -98,6 +98,10 @@
>> <groupId>xml-apis</groupId>
>> <artifactId>xml-apis</artifactId>
>> </exclusion>
>> + <exclusion>
>> + <groupId>commons-logging</groupId>
>> + <artifactId>commons-logging</artifactId>
>> + </exclusion>
>> </exclusions>
>> </dependency>
>> <dependency>
>> @@ -110,6 +114,10 @@
>> <groupId>xml-apis</groupId>
>> <artifactId>xml-apis-ext</artifactId>
>> </exclusion>
>> + <exclusion>
>> + <groupId>commons-logging</groupId>
>> + <artifactId>commons-logging</artifactId>
>> + </exclusion>
>> </exclusions>
>> </dependency>
>> <dependency>
>>
>> Carsten
>> ...
>
> Yes.
>
> It *seems* that only the first exclusion is needed (for starter); should
> I do both?
>
> Best regards, Julian
-> https://github.com/apache/sling-org-apache-sling-xss/pull/62
Best regards, Julian
Re: [RESULT] [VOTE] Release Apache Sling XSS Protection API 2.4.10
Posted by Julian Reschke <re...@apache.org>.
Am 12.02.2026 um 08:07 schrieb Carsten Ziegeler:
> It seems the problem is the embedded commons.logging, this patch should
> fix it:
>
> diff --git a/pom.xml b/pom.xml
> index 2aed779..c0cfc3c 100644
> --- a/pom.xml
> +++ b/pom.xml
> @@ -98,6 +98,10 @@
> <groupId>xml-apis</groupId>
> <artifactId>xml-apis</artifactId>
> </exclusion>
> + <exclusion>
> + <groupId>commons-logging</groupId>
> + <artifactId>commons-logging</artifactId>
> + </exclusion>
> </exclusions>
> </dependency>
> <dependency>
> @@ -110,6 +114,10 @@
> <groupId>xml-apis</groupId>
> <artifactId>xml-apis-ext</artifactId>
> </exclusion>
> + <exclusion>
> + <groupId>commons-logging</groupId>
> + <artifactId>commons-logging</artifactId>
> + </exclusion>
> </exclusions>
> </dependency>
> <dependency>
>
> Carsten
> ...
Yes.
It *seems* that only the first exclusion is needed (for starter); should
I do both?
Best regards, Julian
Re: [RESULT] [VOTE] Release Apache Sling XSS Protection API 2.4.10
Posted by Carsten Ziegeler <cz...@apache.org>.
That's a good verification, yes.
Carsten
On 2/12/2026 10:49 AM, Julian Reschke wrote:
> Am 12.02.2026 um 08:07 schrieb Carsten Ziegeler:
>> It seems the problem is the embedded commons.logging, this patch
>> should fix it:
>> ...
>
> Asking for a friend... Is there something I should check before
> releases? Deploy in sling starter?
>
> Best regards, Julian
--
Carsten Ziegeler
Adobe
cziegeler@apache.org
Re: [RESULT] [VOTE] Release Apache Sling XSS Protection API 2.4.10
Posted by Julian Reschke <ju...@gmx.de>.
Am 12.02.2026 um 08:07 schrieb Carsten Ziegeler:
> It seems the problem is the embedded commons.logging, this patch should
> fix it:
> ...
Asking for a friend... Is there something I should check before
releases? Deploy in sling starter?
Best regards, Julian
Re: [RESULT] [VOTE] Release Apache Sling XSS Protection API 2.4.10
Posted by Carsten Ziegeler <cz...@apache.org>.
It seems the problem is the embedded commons.logging, this patch should
fix it:
diff --git a/pom.xml b/pom.xml
index 2aed779..c0cfc3c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,6 +98,10 @@
<groupId>xml-apis</groupId>
<artifactId>xml-apis</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>commons-logging</groupId>
+ <artifactId>commons-logging</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
@@ -110,6 +114,10 @@
<groupId>xml-apis</groupId>
<artifactId>xml-apis-ext</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>commons-logging</groupId>
+ <artifactId>commons-logging</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
Carsten
On 2/12/2026 7:49 AM, Carsten Ziegeler wrote:
> I think the logging.log4j ones are expected as that is the switch from
> the old log4j 1 to log4j 2.
> Projects using commons.logging usually need to overwrite the package
> import to use 1.2 as the base - as that is what slf4j exports.
> On top I see org.slf4j.spi and org.apache.log4j (1.x) in the package
> imports. The latter should have been fixed by the switch to 2.x. The
> former shouldnt be there either.
>
>
> @Julian Can you please look into these?
>
> Regards
> Carsten
>
> On 2/12/2026 6:18 AM, Eric Norman wrote:
>> Just noticed that there appears to also be a new unresolved dependency
>> related to commons-logging as well (minimum 1.3 vs 1.2 provided by sling
>> commons log):
>>
>> [ERROR] [bundle-packages] org.apache.sling:org.apache.sling.xss:2.4.10:
>> Bundle is importing package org.apache.commons.logging;version=[1.3,2)
>> with
>> start order 20 but no bundle is exporting these for that start order
>> in the
>> required version range.
>>
>> Regards,
>> Eric
>>
>>
>> On Wed, Feb 11, 2026 at 8:48 PM Eric Norman <er...@gmail.com>
>> wrote:
>>
>>> Sorry, I missed this vote.
>>>
>>> I do see when I try to update to this release it fails with unresolved
>>> dependencies related to log4j. Was that expected?
>>>
>>> [ERROR] [bundle-packages] org.apache.sling:org.apache.sling.xss:2.4.10:
>>> Bundle is importing packages [org.apache.logging.log4j,
>>> org.apache.logging.log4j.spi, org.apache.logging.log4j.util] with start
>>> order 20 but no bundle is exporting these for that start order.
>>>
>>> Regards,
>>> Eric
>>>
>>> On Tue, Feb 10, 2026 at 9:58 AM Julian Reschke <re...@apache.org>
>>> wrote:
>>>
>>>> Hi,
>>>>
>>>> The vote has passed with the following result:
>>>>
>>>> +1 (binding): Carsten Ziegeler, Robert Munteanu, Julian Reschke
>>>>
>>>> I will copy this release to the Sling dist directory and
>>>> promote the artifacts to the central Maven repository.
>>>>
>>>> Thanks for voting!
>>>>
>>>>
>>
>
--
Carsten Ziegeler
Adobe
cziegeler@apache.org
Re: [RESULT] [VOTE] Release Apache Sling XSS Protection API 2.4.10
Posted by Carsten Ziegeler <cz...@apache.org>.
I think the logging.log4j ones are expected as that is the switch from
the old log4j 1 to log4j 2.
Projects using commons.logging usually need to overwrite the package
import to use 1.2 as the base - as that is what slf4j exports.
On top I see org.slf4j.spi and org.apache.log4j (1.x) in the package
imports. The latter should have been fixed by the switch to 2.x. The
former shouldnt be there either.
@Julian Can you please look into these?
Regards
Carsten
On 2/12/2026 6:18 AM, Eric Norman wrote:
> Just noticed that there appears to also be a new unresolved dependency
> related to commons-logging as well (minimum 1.3 vs 1.2 provided by sling
> commons log):
>
> [ERROR] [bundle-packages] org.apache.sling:org.apache.sling.xss:2.4.10:
> Bundle is importing package org.apache.commons.logging;version=[1.3,2) with
> start order 20 but no bundle is exporting these for that start order in the
> required version range.
>
> Regards,
> Eric
>
>
> On Wed, Feb 11, 2026 at 8:48 PM Eric Norman <er...@gmail.com> wrote:
>
>> Sorry, I missed this vote.
>>
>> I do see when I try to update to this release it fails with unresolved
>> dependencies related to log4j. Was that expected?
>>
>> [ERROR] [bundle-packages] org.apache.sling:org.apache.sling.xss:2.4.10:
>> Bundle is importing packages [org.apache.logging.log4j,
>> org.apache.logging.log4j.spi, org.apache.logging.log4j.util] with start
>> order 20 but no bundle is exporting these for that start order.
>>
>> Regards,
>> Eric
>>
>> On Tue, Feb 10, 2026 at 9:58 AM Julian Reschke <re...@apache.org> wrote:
>>
>>> Hi,
>>>
>>> The vote has passed with the following result:
>>>
>>> +1 (binding): Carsten Ziegeler, Robert Munteanu, Julian Reschke
>>>
>>> I will copy this release to the Sling dist directory and
>>> promote the artifacts to the central Maven repository.
>>>
>>> Thanks for voting!
>>>
>>>
>
--
Carsten Ziegeler
Adobe
cziegeler@apache.org
Re: [RESULT] [VOTE] Release Apache Sling XSS Protection API 2.4.10
Posted by Julian Reschke <re...@apache.org>.
Am 12.02.2026 um 06:18 schrieb Eric Norman:
> Just noticed that there appears to also be a new unresolved dependency
> related to commons-logging as well (minimum 1.3 vs 1.2 provided by sling
> commons log):
>
> [ERROR] [bundle-packages] org.apache.sling:org.apache.sling.xss:2.4.10:
> Bundle is importing package org.apache.commons.logging;version=[1.3,2)
> with start order 20 but no bundle is exporting these for that start
> order in the required version range.
>
> Regards,
> Eric
Well, we had three dependency updates; the latest one removed a
transitive dependency to log4j.
So that part (I believe) is understood.
Not sure about the version range. Carsten, Robert: is that expected?
Best regards, Julian
Re: [RESULT] [VOTE] Release Apache Sling XSS Protection API 2.4.10
Posted by Eric Norman <er...@gmail.com>.
Just noticed that there appears to also be a new unresolved dependency
related to commons-logging as well (minimum 1.3 vs 1.2 provided by sling
commons log):
[ERROR] [bundle-packages] org.apache.sling:org.apache.sling.xss:2.4.10:
Bundle is importing package org.apache.commons.logging;version=[1.3,2) with
start order 20 but no bundle is exporting these for that start order in the
required version range.
Regards,
Eric
On Wed, Feb 11, 2026 at 8:48 PM Eric Norman <er...@gmail.com> wrote:
> Sorry, I missed this vote.
>
> I do see when I try to update to this release it fails with unresolved
> dependencies related to log4j. Was that expected?
>
> [ERROR] [bundle-packages] org.apache.sling:org.apache.sling.xss:2.4.10:
> Bundle is importing packages [org.apache.logging.log4j,
> org.apache.logging.log4j.spi, org.apache.logging.log4j.util] with start
> order 20 but no bundle is exporting these for that start order.
>
> Regards,
> Eric
>
> On Tue, Feb 10, 2026 at 9:58 AM Julian Reschke <re...@apache.org> wrote:
>
>> Hi,
>>
>> The vote has passed with the following result:
>>
>> +1 (binding): Carsten Ziegeler, Robert Munteanu, Julian Reschke
>>
>> I will copy this release to the Sling dist directory and
>> promote the artifacts to the central Maven repository.
>>
>> Thanks for voting!
>>
>>
Re: [RESULT] [VOTE] Release Apache Sling XSS Protection API 2.4.10
Posted by Eric Norman <er...@gmail.com>.
Sorry, I missed this vote.
I do see when I try to update to this release it fails with unresolved
dependencies related to log4j. Was that expected?
[ERROR] [bundle-packages] org.apache.sling:org.apache.sling.xss:2.4.10:
Bundle is importing packages [org.apache.logging.log4j,
org.apache.logging.log4j.spi, org.apache.logging.log4j.util] with start
order 20 but no bundle is exporting these for that start order.
Regards,
Eric
On Tue, Feb 10, 2026 at 9:58 AM Julian Reschke <re...@apache.org> wrote:
> Hi,
>
> The vote has passed with the following result:
>
> +1 (binding): Carsten Ziegeler, Robert Munteanu, Julian Reschke
>
> I will copy this release to the Sling dist directory and
> promote the artifacts to the central Maven repository.
>
> Thanks for voting!
>
>