You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@logging.apache.org by pk...@apache.org on 2026/03/25 09:32:01 UTC
[VOTE] Release Log4j 2.25.4
This is a vote to release version 2.25.4 of Apache Log4j:
Website: https://logging.staged.apache.org/log4j/2.25.4/index.html
GitHub: https://github.com/apache/logging-log4j2
Commit: 0628e53b25a33e496b509c40a39f2d7c64f2aa6c
Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j/2.25.4
Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1324
Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
Review kit: https://logging.apache.org/logging-parent/release-review-instructions.html
This vote is being conducted using an Alpha version of the Apache Trusted Releases (ATR) platform.
Please report any bugs or issues to the ASF Tooling team.
The ATR release candidate page, including downloads, can be found at:
https://release-test.apache.org/vote/logging-log4j/2.25.4
The release artifacts are signed with an OpenPGP key from:
https://release-test.apache.org/downloads/logging/KEYS
Please review the release candidate and vote accordingly.
[ ] +1 Release this package
[ ] +0 Abstain
[ ] -1 Do not release this package (please provide specific comments)
You can vote on ATR at the URL above, or manually by replying to this email.
This vote is open for 72 hours and will pass unless getting a
net negative vote count. All votes are welcome and we encourage
everyone to test the release, but only the Logging Services PMC
votes are officially counted. At least 3 +1 votes and more
positive than negative votes are required.
== Reviewing Notes
To reproduce the artifacts you need:
* Use Linux or MacOSX.
* Set the environment variable `CI=true`.
The CI build was reproduced using:
CI=true ./mvnw verify \
-Prelease artifact:compare \
-Dreference.repo=https://repository.apache.org/content/repositories/orgapachelogging-1324
JDK version:
openjdk 17.0.18 2026-01-20
OpenJDK Runtime Environment Temurin-17.0.18+8 (build 17.0.18+8)
OpenJDK 64-Bit Server VM Temurin-17.0.18+8 (build 17.0.18+8, mixed mode, sharing)
Due to some breaking changes in the Docker API, I wasn't able to run Docker tests locally (I have version Docker version 29.3.0, build 5927d80) and I had to add `!docker` to the Maven profiles. The CI didn't have any problems.
== Release Notes
This patch release delivers fixes for configuration inconsistencies and formatting issues across several layouts.
* Restores alignment between documented and actual configuration attributes.
* Fixes formatting and sanitization issues in XML and RFC5424 layouts.
* Improves handling of invalid characters and non-standard values.
The authoritative list of recognized configuration attributes is available in the
Plugin Reference <https://logging.apache.org/log4j/2.x/plugin-reference.html>.
[#release-notes-2-25-4-fixed]
=== Fixed
* Prevent ParameterFormatter issuing a warning in case there is an extra null argument. Needed to support cases with Throwable parameter that may be null. (#3975, #4014)
* Restore support for documented `Rfc5424Layout` parameter names. (#4022, #4074)
* Take `Throwable#toString()` into account while rendering stack traces in Pattern Layout. (#3623, #4033)
* Added debug level logs for successful resource loading in `Loader` class. (#4058, #4060)
* Align `SslConfiguration` factory method usage with Log4j 2.12+ API. The `verifyHostname` attribute is not correctly recognized. (#4061, #4075)
* Fix sanitization of structured data parameter names in RFC5424 layout. (#4073)
* Replace invalid characters in XmlLayout output with the Unicode replacement character (U+FFFD). (#4077)
* Replace invalid characters in Log4j1XmlLayout output with the Unicode replacement character (U+FFFD). (#4078)
* Replace invalid characters in MapMessage.asXml() output with the Unicode replacement character (U+FFFD). (#4079)
* Write non-finite floating-point numbers as strings in `JsonWriter`. (#4080)
Thanks,
Piotr Karwasz (pkarwasz)
This email was sent by pkarwasz@apache.org on the Apache Trusted Releases platform
Re: [VOTE] Release Log4j 2.25.4
Posted by pk...@apache.org.
+1 (binding) (pkarwasz) Piotr Karwasz
I reproduced the artifacts locally using the procedure I gave in the vote e-mail.
--
Piotr Karwasz (pkarwasz)
This email was sent by pkarwasz@apache.org on the Apache Trusted Releases platform
Re: [VOTE] Release Log4j 2.25.4
Posted by "Piotr P. Karwasz" <pi...@mailing.copernik.eu>.
Hi Gary,
On 25.03.2026 12:50, Gary Gregory wrote:
> Does that mean all the RAT check failures about missing license headers are
> incorrect?
I haven't checked all of them, but we have our own RAT check that uses
the *same* tool and it didn't find any problems. Our `pom.xml` file have
a list of exclusions, which the ATR check ignores.
Among the problems found by ATR:
- We intentionally exclude changelog entries: these are very short
files. Adding 17 lines of ASF license causes a lot of merge conflicts,
because for Git all the entries become similar enough. Reducing merge
conflicts was exactly the purpose of splitting changelog entries into
separate files.
- It marks a couple of `*.json` files, which by their nature can not
contain comments.
- It marks a couple of `*.log` files used in tests, which need to be
excluded.
Piotr
Re: [VOTE] Release Log4j 2.25.4
Posted by Gary Gregory <ga...@gmail.com>.
On Wed, Mar 25, 2026, 05:50 Piotr P. Karwasz <pi...@mailing.copernik.eu>
wrote:
> Hi all,
>
> On 25.03.2026 10:32, pkarwasz@apache.org wrote:
> > The ATR release candidate page, including downloads, can be found at:
> >
> > https://release-test.apache.org/vote/logging-log4j/2.25.4
>
>
> You'll find a lot of failed checks on this page. The main reason for
> that, is that the content of our source and binary archive is not
> wrapped in a directory.
>
Hi Piotr,
Thank you for preparing the RC.
Does that mean all the RAT check failures about missing license headers are
incorrect?
Gary
> We'll fix that in future releases, since I plan to:
>
> - Use `git archive` to generate the source archive.
> - Drop the binary archive completely: less than 1 user in 10,000
> downloads JARs from our website.
> - We'll consider a SLSA Provenance attestation to prove the authenticity
> of the artifacts in Central instead.
>
> Piotr
>
Re: [VOTE] Release Log4j 2.25.4
Posted by "Piotr P. Karwasz" <pi...@mailing.copernik.eu>.
Hi all,
On 25.03.2026 10:32, pkarwasz@apache.org wrote:
> The ATR release candidate page, including downloads, can be found at:
>
> https://release-test.apache.org/vote/logging-log4j/2.25.4
You'll find a lot of failed checks on this page. The main reason for
that, is that the content of our source and binary archive is not
wrapped in a directory.
We'll fix that in future releases, since I plan to:
- Use `git archive` to generate the source archive.
- Drop the binary archive completely: less than 1 user in 10,000
downloads JARs from our website.
- We'll consider a SLSA Provenance attestation to prove the authenticity
of the artifacts in Central instead.
Piotr
Re: [VOTE] Release Log4j 2.25.4
Posted by Adam Monsen <me...@apache.org>.
+1 (meonkeys) Adam Monsen
Re: [VOTE] Release Log4j 2.25.4
Posted by fr...@apache.org.
+1 (binding) (freeandnil) Jan Friedrich
Confirmed the release on my Linux system by following the steps provided in the review kit.
openjdk 17.0.18 2026-01-20
OpenJDK Runtime Environment (build 17.0.18+8-Ubuntu-124.04.1)
OpenJDK 64-Bit Server VM (build 17.0.18+8-Ubuntu-124.04.1, mixed mode, sharing)
--
Jan Friedrich (freeandnil)
This email was sent by freeandnil@apache.org on the Apache Trusted Releases platform
Re: [VOTE] Release Log4j 2.25.4
Posted by Gary Gregory <ga...@gmail.com>.
+1
SHA and ASC OK
mvn clean verify OK
mvn apache-rat:check OK
mvn javadoc:javadoc doesn't work because of some dependency issue so
I'll assume producing the site does the right thing.
Apache Maven 3.9.14 (996c630dbc656c76214ce58821dcc58be960875b)
Maven home: /opt/homebrew/Cellar/maven/3.9.14/libexec
Java version: 17.0.18, vendor: Homebrew, runtime:
/opt/homebrew/Cellar/openjdk@17/17.0.18/libexec/openjdk.jdk/Contents/Home
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "26.4", arch: "aarch64", family: "mac"
Gary
On Wed, Mar 25, 2026 at 5:32 AM <pk...@apache.org> wrote:
>
> This is a vote to release version 2.25.4 of Apache Log4j:
>
> Website: https://logging.staged.apache.org/log4j/2.25.4/index.html
> GitHub: https://github.com/apache/logging-log4j2
> Commit: 0628e53b25a33e496b509c40a39f2d7c64f2aa6c
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j/2.25.4
> Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1324
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> Review kit: https://logging.apache.org/logging-parent/release-review-instructions.html
>
> This vote is being conducted using an Alpha version of the Apache Trusted Releases (ATR) platform.
> Please report any bugs or issues to the ASF Tooling team.
>
> The ATR release candidate page, including downloads, can be found at:
>
> https://release-test.apache.org/vote/logging-log4j/2.25.4
>
> The release artifacts are signed with an OpenPGP key from:
>
> https://release-test.apache.org/downloads/logging/KEYS
>
> Please review the release candidate and vote accordingly.
>
> [ ] +1 Release this package
> [ ] +0 Abstain
> [ ] -1 Do not release this package (please provide specific comments)
>
> You can vote on ATR at the URL above, or manually by replying to this email.
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted. At least 3 +1 votes and more
> positive than negative votes are required.
>
> == Reviewing Notes
>
> To reproduce the artifacts you need:
>
> * Use Linux or MacOSX.
> * Set the environment variable `CI=true`.
>
> The CI build was reproduced using:
>
> CI=true ./mvnw verify \
> -Prelease artifact:compare \
> -Dreference.repo=https://repository.apache.org/content/repositories/orgapachelogging-1324
>
> JDK version:
> openjdk 17.0.18 2026-01-20
> OpenJDK Runtime Environment Temurin-17.0.18+8 (build 17.0.18+8)
> OpenJDK 64-Bit Server VM Temurin-17.0.18+8 (build 17.0.18+8, mixed mode, sharing)
>
> Due to some breaking changes in the Docker API, I wasn't able to run Docker tests locally (I have version Docker version 29.3.0, build 5927d80) and I had to add `!docker` to the Maven profiles. The CI didn't have any problems.
>
> == Release Notes
>
> This patch release delivers fixes for configuration inconsistencies and formatting issues across several layouts.
>
> * Restores alignment between documented and actual configuration attributes.
> * Fixes formatting and sanitization issues in XML and RFC5424 layouts.
> * Improves handling of invalid characters and non-standard values.
>
> The authoritative list of recognized configuration attributes is available in the
> Plugin Reference <https://logging.apache.org/log4j/2.x/plugin-reference.html>.
>
>
> [#release-notes-2-25-4-fixed]
> === Fixed
>
> * Prevent ParameterFormatter issuing a warning in case there is an extra null argument. Needed to support cases with Throwable parameter that may be null. (#3975, #4014)
> * Restore support for documented `Rfc5424Layout` parameter names. (#4022, #4074)
> * Take `Throwable#toString()` into account while rendering stack traces in Pattern Layout. (#3623, #4033)
> * Added debug level logs for successful resource loading in `Loader` class. (#4058, #4060)
> * Align `SslConfiguration` factory method usage with Log4j 2.12+ API. The `verifyHostname` attribute is not correctly recognized. (#4061, #4075)
> * Fix sanitization of structured data parameter names in RFC5424 layout. (#4073)
> * Replace invalid characters in XmlLayout output with the Unicode replacement character (U+FFFD). (#4077)
> * Replace invalid characters in Log4j1XmlLayout output with the Unicode replacement character (U+FFFD). (#4078)
> * Replace invalid characters in MapMessage.asXml() output with the Unicode replacement character (U+FFFD). (#4079)
> * Write non-finite floating-point numbers as strings in `JsonWriter`. (#4080)
>
> Thanks,
> Piotr Karwasz (pkarwasz)
>
> This email was sent by pkarwasz@apache.org on the Apache Trusted Releases platform
[VOTE] [RESULT] Release Log4j 2.25.4 PASSED
Posted by pk...@apache.org.
Dear Logging Services participants,
The vote on logging-log4j 2.25.4 passed.
The vote thread is archived at the following URL:
https://lists.apache.org/thread/fpzfgo42ovhrx0vyts238c905cpw4pd4
The binding votes were cast as follows:
+1 pkarwasz (binding, updated)
+1 ggregory (binding)
+1 freeandnil (binding)
There were 3 binding votes.
Of these binding votes, 3 were +1, 0 were -1, and 0 were 0.
The unknown and contributor votes were cast as follows:
+1 meonkeys (contributor)
Thank you for your participation.
Sincerely,
Piotr Karwasz (pkarwasz)
This email was sent by pkarwasz@apache.org on the Apache Trusted Releases platform