)]}'
{
  "commit": "04471f4f8900e0a91efe0d6ae717c3211aa5efbd",
  "tree": "5ff551150a268a53420de6799a8bcbc7ad6d9f5a",
  "parents": [
    "bd8cd52fc8426b485a8b3e64997fb178c84c9de2"
  ],
  "author": {
    "name": "dependabot[bot]",
    "email": "49699333+dependabot[bot]@users.noreply.github.com",
    "time": "Thu Jul 02 08:11:17 2026 +0200"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Thu Jul 02 08:11:17 2026 +0200"
  },
  "message": "MINOR: Bump logback.version from 1.5.32 to 1.5.34 (#1171)\n\nBumps `logback.version` from 1.5.32 to 1.5.34.\nUpdates `ch.qos.logback:logback-classic` from 1.5.32 to 1.5.34\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/releases\"\u003ech.qos.logback:logback-classic\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eLogback 1.5.34\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-01 Release of logback version 1.5.34\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• In case certain StackTraceElement values returned by the\nThrowable.getStackTrace method are null, StackTraceElementProxy\nsubstitutes a dummy instance instead of throwing an\nIllegalArgumentException. This resolves [issues \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1040\"\u003e#1040\u003c/a\u003e](\u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1040\"\u003eqos-ch/logback#1040\u003c/a\u003e),\nreported by Naotsugu Kobayashi.\u003c/p\u003e\n\u003cp\u003e• HardenedObjectInputStream will now throw an InvalidClassException\nduring deserialization attempts of Proxy classes. This change addresses\npotential deserialization whitelist bypass vulnerability reported by \u003ca\nhref\u003d\"https://github.com/york-shen\"\u003eYork Shen\u003c/a\u003e and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-10532\"\u003eCVE-2026-10532\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\ne62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag\nv_1.5.34. This release was built using Java \u0026quot;21\u0026quot; 2023-10-17\nLTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.33\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-05-27 Release of logback version 1.5.33\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003ePropertiesConfiguratorModelHandler\u003c/code\u003e now registers\nproperties file URLs to the \u003ccode\u003eConfigurationWatchList\u003c/code\u003e when\nscan is enabled (via local scan\u003d\u0026quot;true\u0026quot; attribute or top-level\nconfiguration scan), ensuring changes are detected and reconfiguration\noccurs. This problem was reported in \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1034\"\u003eissues/1034\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• When processing \u003ccode\u003e\u0026lt;conversionRule\u0026gt;\u003c/code\u003e elements and\nboth \u003ccode\u003eclass\u003c/code\u003e and \u003ccode\u003econverterClass\u003c/code\u003e attributes are\nspecified, silently use the class attribute without issuing a warning.\nHowever, if the attribute values differ, a warning will be issued. This\nchange was requested in \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1031\"\u003eissues/1031\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eHardenedModelInputStream\u003c/code\u003e will no longer accept to\ndeserialize all classes located under the \u0026quot;java.lang\u0026quot; and\n\u0026quot;java.util\u0026quot; packages but a limited number of explicitly\nauthorized classes in those packages. This potential deserialization\nwhitelist bypass vulnerability was reported by \u003ca\nhref\u003d\"https://github.com/york-shen\"\u003eYork Shen\u003c/a\u003e and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-9828\"\u003eCVE-2026-9828\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• SSL parameters for \u003ccode\u003eSSLSocketAppender\u003c/code\u003e now enable\nhostname verification by default. Moreover, the default protocol is now\n\u0026quot;TLSv1.2\u0026quot;. This potential vulnerability was reported by York\nShen.\u003c/p\u003e\n\u003cp\u003e• When printing the status message field,\n\u003ccode\u003eViewStatusMessagesServletBase\u003c/code\u003e now escapes special\ncharacters such as \u0026quot;\u0026amp;\u0026quot; as character entities. This\npotential vulnerability was reported by York Shen.\u003c/p\u003e\n\u003cp\u003e• A bit-wise identical binary of this version can be reproduced by\nbuilding from source code at commit\n124e8b49b55ac34d08743a0646bd463410192647 associated with the tag\nv_1.5.33. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/e62272ac152469aec1ede056c3c7d0d7314e7bfe\"\u003e\u003ccode\u003ee62272a\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.34\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/1e9e926db1529b729a0e2d29fdee151c2aea0341\"\u003e\u003ccode\u003e1e9e926\u003c/code\u003e\u003c/a\u003e\nadd resolveProxyClassRejectsDynamicProxies unit test\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/2de5cbe90b74fa284685304bc91321313b0d8e2f\"\u003e\u003ccode\u003e2de5cbe\u003c/code\u003e\u003c/a\u003e\nadded StackTraceElementProxyTest, minor edits to AGENTS.md\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/0e9b9278b5d3f0b573762cd7b5482ed65244418e\"\u003e\u003ccode\u003e0e9b927\u003c/code\u003e\u003c/a\u003e\nin case StackTraceElement is null use a substitute, fixing\nissues/1040\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818\"\u003e\u003ccode\u003ef7a0654\u003c/code\u003e\u003c/a\u003e\nprevent resolveProxyClass bypass\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/249b81f3754f1fb58f8507f244a36c7a940854c0\"\u003e\u003ccode\u003e249b81f\u003c/code\u003e\u003c/a\u003e\ndocs are no longer distributed\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/1c3b26a839f05b6bc1769e5a028ef326c711cec8\"\u003e\u003ccode\u003e1c3b26a\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.34-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/124e8b49b55ac34d08743a0646bd463410192647\"\u003e\u003ccode\u003e124e8b4\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.33\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/d8fd6f25c7f12282871164911fe423c86e2ef8f3\"\u003e\u003ccode\u003ed8fd6f2\u003c/code\u003e\u003c/a\u003e\nescapeTags in message field when printing status messages\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/95edbeb8dbf53494f36324aeb7bef1825aff6cc4\"\u003e\u003ccode\u003e95edbeb\u003c/code\u003e\u003c/a\u003e\nhostnameVerification default to true in SSLParametersConfiguration,\nSSL.DEFAU...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ch.qos.logback:logback-core` from 1.5.32 to 1.5.34\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/releases\"\u003ech.qos.logback:logback-core\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eLogback 1.5.34\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-01 Release of logback version 1.5.34\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• In case certain StackTraceElement values returned by the\nThrowable.getStackTrace method are null, StackTraceElementProxy\nsubstitutes a dummy instance instead of throwing an\nIllegalArgumentException. This resolves [issues \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1040\"\u003e#1040\u003c/a\u003e](\u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1040\"\u003eqos-ch/logback#1040\u003c/a\u003e),\nreported by Naotsugu Kobayashi.\u003c/p\u003e\n\u003cp\u003e• HardenedObjectInputStream will now throw an InvalidClassException\nduring deserialization attempts of Proxy classes. This change addresses\npotential deserialization whitelist bypass vulnerability reported by \u003ca\nhref\u003d\"https://github.com/york-shen\"\u003eYork Shen\u003c/a\u003e and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-10532\"\u003eCVE-2026-10532\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\ne62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag\nv_1.5.34. This release was built using Java \u0026quot;21\u0026quot; 2023-10-17\nLTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.33\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-05-27 Release of logback version 1.5.33\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003ePropertiesConfiguratorModelHandler\u003c/code\u003e now registers\nproperties file URLs to the \u003ccode\u003eConfigurationWatchList\u003c/code\u003e when\nscan is enabled (via local scan\u003d\u0026quot;true\u0026quot; attribute or top-level\nconfiguration scan), ensuring changes are detected and reconfiguration\noccurs. This problem was reported in \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1034\"\u003eissues/1034\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• When processing \u003ccode\u003e\u0026lt;conversionRule\u0026gt;\u003c/code\u003e elements and\nboth \u003ccode\u003eclass\u003c/code\u003e and \u003ccode\u003econverterClass\u003c/code\u003e attributes are\nspecified, silently use the class attribute without issuing a warning.\nHowever, if the attribute values differ, a warning will be issued. This\nchange was requested in \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1031\"\u003eissues/1031\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eHardenedModelInputStream\u003c/code\u003e will no longer accept to\ndeserialize all classes located under the \u0026quot;java.lang\u0026quot; and\n\u0026quot;java.util\u0026quot; packages but a limited number of explicitly\nauthorized classes in those packages. This potential deserialization\nwhitelist bypass vulnerability was reported by \u003ca\nhref\u003d\"https://github.com/york-shen\"\u003eYork Shen\u003c/a\u003e and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-9828\"\u003eCVE-2026-9828\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• SSL parameters for \u003ccode\u003eSSLSocketAppender\u003c/code\u003e now enable\nhostname verification by default. Moreover, the default protocol is now\n\u0026quot;TLSv1.2\u0026quot;. This potential vulnerability was reported by York\nShen.\u003c/p\u003e\n\u003cp\u003e• When printing the status message field,\n\u003ccode\u003eViewStatusMessagesServletBase\u003c/code\u003e now escapes special\ncharacters such as \u0026quot;\u0026amp;\u0026quot; as character entities. This\npotential vulnerability was reported by York Shen.\u003c/p\u003e\n\u003cp\u003e• A bit-wise identical binary of this version can be reproduced by\nbuilding from source code at commit\n124e8b49b55ac34d08743a0646bd463410192647 associated with the tag\nv_1.5.33. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/e62272ac152469aec1ede056c3c7d0d7314e7bfe\"\u003e\u003ccode\u003ee62272a\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.34\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/1e9e926db1529b729a0e2d29fdee151c2aea0341\"\u003e\u003ccode\u003e1e9e926\u003c/code\u003e\u003c/a\u003e\nadd resolveProxyClassRejectsDynamicProxies unit test\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/2de5cbe90b74fa284685304bc91321313b0d8e2f\"\u003e\u003ccode\u003e2de5cbe\u003c/code\u003e\u003c/a\u003e\nadded StackTraceElementProxyTest, minor edits to AGENTS.md\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/0e9b9278b5d3f0b573762cd7b5482ed65244418e\"\u003e\u003ccode\u003e0e9b927\u003c/code\u003e\u003c/a\u003e\nin case StackTraceElement is null use a substitute, fixing\nissues/1040\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818\"\u003e\u003ccode\u003ef7a0654\u003c/code\u003e\u003c/a\u003e\nprevent resolveProxyClass bypass\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/249b81f3754f1fb58f8507f244a36c7a940854c0\"\u003e\u003ccode\u003e249b81f\u003c/code\u003e\u003c/a\u003e\ndocs are no longer distributed\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/1c3b26a839f05b6bc1769e5a028ef326c711cec8\"\u003e\u003ccode\u003e1c3b26a\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.34-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/124e8b49b55ac34d08743a0646bd463410192647\"\u003e\u003ccode\u003e124e8b4\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.33\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/d8fd6f25c7f12282871164911fe423c86e2ef8f3\"\u003e\u003ccode\u003ed8fd6f2\u003c/code\u003e\u003c/a\u003e\nescapeTags in message field when printing status messages\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/95edbeb8dbf53494f36324aeb7bef1825aff6cc4\"\u003e\u003ccode\u003e95edbeb\u003c/code\u003e\u003c/a\u003e\nhostnameVerification default to true in SSLParametersConfiguration,\nSSL.DEFAU...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "6a97ac46208ab3730b597eef9ad50f986dd284e2",
      "old_mode": 33188,
      "old_path": "pom.xml",
      "new_id": "231720eb4411c2a59e1e26098efc45a19deb4c36",
      "new_mode": 33188,
      "new_path": "pom.xml"
    }
  ]
}