You are viewing a plain text version of this content. The canonical link for it is here.
Posted to robots@logging.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/17 14:35:02 UTC
[PR] Bump the maven-minor-updates group with 9 updates [logging-flume]
dependabot[bot] opened a new pull request, #507:
URL: https://github.com/apache/logging-flume/pull/507
Bumps the maven-minor-updates group with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [org.slf4j:slf4j-bom](https://github.com/qos-ch/slf4j) | `2.0.18` | `2.0.19` |
| [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) | `4.36.0` | `4.36.1` |
| org.eclipse.jetty.ee11:jetty-ee11-servlet | `12.1.12` | `12.1.13` |
| org.eclipse.jetty:jetty-security | `12.1.12` | `12.1.13` |
| org.eclipse.jetty:jetty-util | `12.1.12` | `12.1.13` |
| org.eclipse.jetty:jetty-server | `12.1.12` | `12.1.13` |
| org.eclipse.jetty:jetty-jmx | `12.1.12` | `12.1.13` |
| [io.netty:netty-all](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| org.apache.zookeeper:zookeeper | `3.9.5` | `3.9.6` |
Updates `org.slf4j:slf4j-bom` from 2.0.18 to 2.0.19
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/qos-ch/slf4j/releases">org.slf4j:slf4j-bom's releases</a>.</em></p>
<blockquote>
<h2>SLF4J 2.0.19</h2>
<h3>2026-09-04 - Release of SLF4J 2.0.19</h3>
<ul>
<li>
<p>When the fluent API was used with <code>XLogger</code>/<code>LoggerWrapper</code> in the <em>slf4j-ext</em> module, caller location was incorrectly reported. To correct this, <code>LoggerWrapper</code> now delegates <code>makeLoggingEventBuilder()</code> to the wrapped logger so that the application caller can be correctly extracted. This issue was reported in <a href="https://redirect.github.com/qos-ch/slf4j/issues/464">issues/464</a>.</p>
</li>
<li>
<p>In <code>slf4j-api/DefaultLoggingEventBuilder</code>, a failing <code>toString()</code> invocation on a key-value value, including <code>StackOverflowError</code>, no longer aborts logging. The builder now substitutes <code>[FAILED toString()]</code>, matching the existing behaviour of <code>MessageFormatter</code> for message arguments. This issue was reported in <a href="https://redirect.github.com/qos-ch/slf4j/issues/448">issues/448</a>.</p>
</li>
<li>
<p>The <code>isLoggable()</code> method in <code>SLF4JPlatformLogger</code> now maps <code>System.Logger.Level.ALL</code> and <code>Level.OFF</code> the same way as <code>log()</code>, that is ALL as TRACE and OFF as ERROR, instead of treating both as always loggable. This is a follow-up to the changes introduced in 2.0.17. See <a href="https://redirect.github.com/qos-ch/slf4j/issues/430">issues/430</a>.</p>
</li>
<li>
<p>Published JAR files now package each module's own <em>LICENSE.txt</em> under <em>META-INF/</em>. Previously the parent POM copied the repository-root MIT license into every module, so Apache-2.0 modules such as <em>jcl-over-slf4j</em> and <em>log4j-over-slf4j</em> shipped the wrong license text. This issue was reported in <a href="https://redirect.github.com/qos-ch/slf4j/issues/465">issues/465</a>.</p>
</li>
<li>
<p>A bit-wise identical binary of this version can be reproduced by building from source code at commit f0fc3e52a16d5053039495f4f3b64d191508204f associated with the tag v_2.0.19. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/qos-ch/slf4j/commit/f0fc3e52a16d5053039495f4f3b64d191508204f"><code>f0fc3e5</code></a> prepare release 2.0.19</li>
<li><a href="https://github.com/qos-ch/slf4j/commit/2288d0cab686d71a4f3600729feba14e53407f50"><code>2288d0c</code></a> fix issues/464. slf4j-ext/XLogger incorrect caller extraction when the fluent...</li>
<li><a href="https://github.com/qos-ch/slf4j/commit/6ff7f772591349cb3402be9c586f9eb50f0ab2c4"><code>6ff7f77</code></a> test: pin fluent API caller method name</li>
<li><a href="https://github.com/qos-ch/slf4j/commit/2b3f94bae0cd19eec3d4a2e4e3b61b6a6db0faa3"><code>2b3f94b</code></a> SLF4JPlatformLogger.isLoggable should handle Logger.ALL and Logger.OFF in a c...</li>
<li><a href="https://github.com/qos-ch/slf4j/commit/9221f77352ab0f35e3f641ed028ffce7f9fe1750"><code>9221f77</code></a> fix(api): guard addKeyValue value toString from fatal errors</li>
<li><a href="https://github.com/qos-ch/slf4j/commit/027c54338b383461bf051d01d79b9d20f8eee3e6"><code>027c543</code></a> fix(build): package each module's LICENSE.txt into JAR META-INF</li>
<li><a href="https://github.com/qos-ch/slf4j/commit/61400453cd366f227dbc36036d6ac128a36da59b"><code>6140045</code></a> start work on 2.0.19-SNAPSHOT</li>
<li>See full diff in <a href="https://github.com/qos-ch/slf4j/compare/v_2.0.18...v_2.0.19">compare view</a></li>
</ul>
</details>
<br />
Updates `com.google.protobuf:protobuf-java` from 4.36.0 to 4.36.1
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/protocolbuffers/protobuf/commits">compare view</a></li>
</ul>
</details>
<br />
Updates `org.eclipse.jetty.ee11:jetty-ee11-servlet` from 12.1.12 to 12.1.13
Updates `org.eclipse.jetty:jetty-security` from 12.1.12 to 12.1.13
Updates `org.eclipse.jetty:jetty-util` from 12.1.12 to 12.1.13
Updates `org.eclipse.jetty:jetty-server` from 12.1.12 to 12.1.13
Updates `org.eclipse.jetty:jetty-jmx` from 12.1.12 to 12.1.13
Updates `org.eclipse.jetty:jetty-security` from 12.1.12 to 12.1.13
Updates `org.eclipse.jetty:jetty-util` from 12.1.12 to 12.1.13
Updates `org.eclipse.jetty:jetty-server` from 12.1.12 to 12.1.13
Updates `org.eclipse.jetty:jetty-jmx` from 12.1.12 to 12.1.13
Updates `io.netty:netty-all` from 4.2.17.Final to 4.2.18.Final
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/netty/netty/releases">io.netty:netty-all's releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.18.Final</h2>
<h2>Security fixes</h2>
<ul>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (SPDY)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8352-h356-c9qh">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jj3c-mwvr-9g52">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hmf3-49g9-g7qq">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-wxrh-4rgq-pjcg">CVE-2026-XXXXX</a> : parser desync/response smuggling in <code>io.netty:netty-codec-memcache</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pq4x-537v-r54q">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-haproxy</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (RTSP)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code> and in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387">CVE-2026-XXXXX</a> : improper hostname verification in <code>io.netty:netty-codec-classes-quic</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-redis</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc">CVE-2026-XXXXX</a> : request smuggling vector in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jqf3-r9ww-c5x8">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-mqtt</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p">CVE-2026-XXXXX</a> : improper CRLF neutralization in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jhjp-5q4f-8wr2">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
</ul>
<h2>Compatibility Notes</h2>
<p>A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.</p>
<p>Two specific changes are worth calling out:</p>
<p><strong>QUIC now explicitly requires <code>X509ExtendedTrustManager</code> when hostname verification is enabled.</strong>
Previously, when configuring QUIC with an endpoint identification algorithm and an <code>X509TrustManager</code>, hostname verification would be silently skipped.
This is now considered a misconfiguration and an exception will be thrown.</p>
<p><strong>HTTP/2 header <em>value</em> validation is now enabled by default.</strong>
HTTP/2 header <em>name</em> validation has always been enabled by default, with an option to disable it, but HTTP/2 header <em>value</em> validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.</p>
<h2>What's Changed</h2>
<ul>
<li>Use X509ExtendedTrustManager in SSLErrorTest by <a href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17221">netty/netty#17221</a></li>
<li>Update setup-testlens to v1.9.4 by <a href="https://github.com/marcphilipp"><code>@​marcphilipp</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17223">netty/netty#17223</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/netty/netty/commit/2521f494432e27415a567d3a81a9eb907abf20b3"><code>2521f49</code></a> [maven-release-plugin] prepare release netty-4.2.18.Final</li>
<li><a href="https://github.com/netty/netty/commit/6fd53272cbce5c461b8b4e15101687fedce30fd7"><code>6fd5327</code></a> HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...</li>
<li><a href="https://github.com/netty/netty/commit/c44a052228bc4e5aa816686a6628410f037dad7c"><code>c44a052</code></a> SPDY: SpdySessionHandler must limit the concurrent streams</li>
<li><a href="https://github.com/netty/netty/commit/374d965d6f7f63318adcddbb474c0d5198bfaa53"><code>374d965</code></a> HTTP: Limit the maximum number of concurrent pipelined requests</li>
<li><a href="https://github.com/netty/netty/commit/7e8b325cd2d5dc04eaa5a0c13ebfec173b9bedf7"><code>7e8b325</code></a> HTTP/2: Limit HPACK encoding table size</li>
<li><a href="https://github.com/netty/netty/commit/e3ebf70348918febe7cda9bfa1c0ee040a157c07"><code>e3ebf70</code></a> OCSP: Correctly handle that <code>nextUpdate</code> is optional</li>
<li><a href="https://github.com/netty/netty/commit/5388535e1d0c285b6081f53c054bee0e6536a610"><code>5388535</code></a> STOMP: Correctly release partial content on handler removal</li>
<li><a href="https://github.com/netty/netty/commit/3a80f5a3b1f3fdc14e5269c27aac0d67075db245"><code>3a80f5a</code></a> WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...</li>
<li><a href="https://github.com/netty/netty/commit/1b6ea48c89a32f36edbc717861580bc563389b63"><code>1b6ea48</code></a> HTTP3: Correctly handle ":authority" and "host" headers</li>
<li><a href="https://github.com/netty/netty/commit/3630659c817e848e4cc4f11703dc36adc80d537a"><code>3630659</code></a> STOMP codec content-length long-to-int truncation causes infinite decode loop...</li>
<li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.17.Final...netty-4.2.18.Final">compare view</a></li>
</ul>
</details>
<br />
Updates `org.apache.zookeeper:zookeeper` from 3.9.5 to 3.9.6
<details>
<summary>Most Recent Ignore Conditions Applied to This Pull Request</summary>
| Dependency Name | Ignore Conditions |
| --- | --- |
| com.google.protobuf:protobuf-java | [>= 3.a, < 4] |
</details>
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: robots-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump the maven-minor-updates group with 9 updates [logging-flume]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] merged PR #507:
URL: https://github.com/apache/logging-flume/pull/507
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org