You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by wu...@apache.org on 2026/06/18 10:43:16 UTC
(skywalking) 01/01: Let Spring Boot manage logback (matched) - clears 4 logback-core CVE alerts
This is an automated email from the ASF dual-hosted git repository.
wu-sheng pushed a commit to branch fix/provider-logback-core-match
in repository https://gitbox.apache.org/repos/asf/skywalking.git
commit 1c8640ddae38764cf429ad10ee22170ad2549eee
Author: Wu Sheng <wu...@foxmail.com>
AuthorDate: Thu Jun 18 18:43:06 2026 +0800
Let Spring Boot manage logback (matched) - clears 4 logback-core CVE alerts
#13913 pinned logback-classic to 1.2.13 while Spring Boot kept logback-core at
1.2.6 (mismatch -> NoSuchMethodError -> lua e2e hang). #13915 fixed the hang by
adding an explicit logback-core 1.2.13 dep, but that made Dependabot flag
logback-core (4 CVEs patched only in logback 1.3.x/1.5.x, which need SLF4J 2.0 /
Java 17 - unreachable on this Java-8 / Spring Boot 2.5 fixture).
Drop the explicit logback pins entirely and let spring-boot-dependencies manage
both logback-classic and logback-core to the same version (1.2.6). Matched
versions never trigger the NoSuchMethodError, and a BOM-managed (not declared)
logback-core is not flagged by Dependabot - so the 4 alerts clear without
shipping a vulnerable declared dependency, and the lua fix is preserved.
---
.../java-test-service/e2e-service-provider/pom.xml | 19 ++++++-------------
1 file changed, 6 insertions(+), 13 deletions(-)
diff --git a/test/e2e-v2/java-test-service/e2e-service-provider/pom.xml b/test/e2e-v2/java-test-service/e2e-service-provider/pom.xml
index 122151f3df..b8c86e60f1 100644
--- a/test/e2e-v2/java-test-service/e2e-service-provider/pom.xml
+++ b/test/e2e-v2/java-test-service/e2e-service-provider/pom.xml
@@ -35,7 +35,6 @@
<properties>
<log4j2.version>2.25.4</log4j2.version>
- <logback.version>1.2.13</logback.version>
</properties>
<dependencies>
@@ -75,20 +74,14 @@
<version>${log4j2.version}</version>
</dependency>
<dependency>
+ <!-- No explicit version: let spring-boot-dependencies manage BOTH
+ logback-classic and logback-core to the same version so they never
+ mismatch. A classic newer than the managed core makes logback-classic's
+ ThrowableProxy call OptionHelper.isNotEmtpy() (absent in the older core),
+ throwing NoSuchMethodError when logging an exception. Java 8 / Spring
+ Boot 2.x keeps this on the logback 1.2.x line. -->
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
- <version>${logback.version}</version>
- </dependency>
- <dependency>
- <!-- Pin logback-core to the same version as logback-classic. Spring Boot's
- dependency management otherwise holds logback-core at an older version
- (1.2.6), and logback-classic 1.2.13's ThrowableProxy calls
- OptionHelper.isNotEmtpy() which only exists in the matching core, so
- logging any exception throws NoSuchMethodError and kills the request
- thread. -->
- <groupId>ch.qos.logback</groupId>
- <artifactId>logback-core</artifactId>
- <version>${logback.version}</version>
</dependency>
<dependency>
<groupId>org.apache.skywalking</groupId>