)]}'
{
  "commit": "915428751b8871406268aeb27bd2f055dcfba6bf",
  "tree": "a2d1b30bd501a00b8b0bb4dd673f34f285715b1f",
  "parents": [
    "f2594c99cc98923ad5949713d4519c5d4f24f4f6"
  ],
  "author": {
    "name": "dependabot[bot]",
    "email": "49699333+dependabot[bot]@users.noreply.github.com",
    "time": "Mon Jul 06 16:00:46 2026 +0200"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Mon Jul 06 16:00:46 2026 +0200"
  },
  "message": "MINOR: Bump logback.version from 1.5.34 to 1.5.37 (#1209)\n\nBumps `logback.version` from 1.5.34 to 1.5.37.\nUpdates `ch.qos.logback:logback-classic` from 1.5.34 to 1.5.37\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/releases\"\u003ech.qos.logback:logback-classic\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eLogback 1.5.37\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-26 Release of logback version 1.5.37\u003c/strong\u003e\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e• Given the numerous vulnerabilities related to conditional\nconfiguration processing based on the evaluation of Java expressions\nusing the Janino library, support for such expressions has been removed.\nUsers are offered the an \u003ca\nhref\u003d\"https://logback.qos.ch/translator/services/conditionalConfigMigrator.html\"\u003eonline\nmigration service\u003c/a\u003e or the \u003ccode\u003e\u0026lt;condition\u0026gt;\u003c/code\u003e element\nintroduced in version 1.5.20. See the \u003ca\nhref\u003d\"https://logback.qos.ch/manual/configuration.html#conditional\"\u003erelevant\ndocumentation\u003c/a\u003e for more details.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\nc1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag\nv_1.5.37. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.36\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-25 Release of logback version 1.5.36\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• The \u0027condition\u0027 attribute in \u003ccode\u003e\u0026lt;if\u0026gt;\u003c/code\u003e elements now\nreject certain references that are associated with ACE attacks. This\nissue was reported by \u0026quot;yulate\u0026quot; (\u003ca\nhref\u003d\"mailto:yulate531@gmail.com.com\"\u003eyulate531@gmail.com.com\u003c/a\u003e) and\nregistered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-13006\"\u003eCVE-2026-13006\u003c/a\u003e.\n\u003cstrong\u003ePlease note that version 1.5.37 provides the full fix to this\nvulnerability.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\n9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag\nv_1.5.36. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.35\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e026-06-23 Release of logback version 1.5.35\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• The \u0027condition\u0027 attribute in \u003ccode\u003e\u0026lt;if\u0026gt;\u003c/code\u003e elements now\nrejects unicode escape sequences (\\u and \\U). This closes a bypass of\nthe existing prohibition on the new operator in Janino-evaluated\nconditions. This issue was reported by IcySun (\u003ca\nhref\u003d\"mailto:icysun@qq.com\"\u003eicysun@qq.com\u003c/a\u003e) and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-13006\"\u003eCVE-2026-13006\u003c/a\u003e.\n\u003cstrong\u003ePlease note that version 1.5.37 provides the full fix to this\nvulnerability.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• Added \u003ccode\u003eConfiguratorRank.AUTHENTICATING\u003c/code\u003e (rank 100), the\nhighest configurator rank, for certified/authenticating configurators\ndiscovered via the ServiceLoader mechanism.\n\u003ccode\u003eContextInitializer\u003c/code\u003e now requires that at most one such\nconfigurator exist on the classpath; if more than one is found,\ninitialization aborts with an error.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eConsoleCharsetPropertyDefiner\u003c/code\u003e is no longer shipped.\nThe Java 21 multi-release compilation of logback-core has been disabled,\nwhich removes this class from the published artifact. Configurations\nthat referenced\n\u003ccode\u003ech.qos.logback.core.property.ConsoleCharsetPropertyDefiner\u003c/code\u003e\nwill need an alternative approach for console charset detection.\u003c/p\u003e\n\u003cp\u003e• The logback-examples module is now included in artifacts published\nto Maven Central.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eJoranConfigurator.makeAnotherInstance()\u003c/code\u003e and\n\u003ccode\u003eDefaultJoranConfigurator.performMultiStepConfigurationFileSearch()\u003c/code\u003e\nare now protected, allowing derived configurators to override these\nmethods.\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\n08bd1598d565d83444f72983935e7da4746783b7 associated with the tag\nv_1.5.35. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/c1df7f522e648eec7b4ef6a12c8758fec0f00048\"\u003e\u003ccode\u003ec1df7f5\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.37\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/a1899674579c67711a4fff6bdc569f4bfb25ead5\"\u003e\u003ccode\u003ea189967\u003c/code\u003e\u003c/a\u003e\nremove conditional based on janino\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/aaa905292dc24235a0cd7514c4815d0eeb6c0446\"\u003e\u003ccode\u003eaaa9052\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.37-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/9b94c37562bf25a6a944146701d42ee6c4eee888\"\u003e\u003ccode\u003e9b94c37\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.36\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/e6a8280ba2c61a448226bccbced70444aaa6e7eb\"\u003e\u003ccode\u003ee6a8280\u003c/code\u003e\u003c/a\u003e\nprevent attacks using disallowed references\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/24c4b63f60e5bbfa591c20cf39f2ce50ff8cff4f\"\u003e\u003ccode\u003e24c4b63\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.36-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/08bd1598d565d83444f72983935e7da4746783b7\"\u003e\u003ccode\u003e08bd159\u003c/code\u003e\u003c/a\u003e\npreapre release 1.5.35\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/37d256b825fc62b4a3908fa29d8b4e34acf79ed0\"\u003e\u003ccode\u003e37d256b\u003c/code\u003e\u003c/a\u003e\nindentation changes only\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/d3d73078afbb0691423f60a066d77503fdf05fc3\"\u003e\u003ccode\u003ed3d7307\u003c/code\u003e\u003c/a\u003e\nminor comment\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/fa0411a9393282ba69396ce65f122d281c079ac0\"\u003e\u003ccode\u003efa0411a\u003c/code\u003e\u003c/a\u003e\nradomize file location\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.37\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ch.qos.logback:logback-core` from 1.5.34 to 1.5.37\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/releases\"\u003ech.qos.logback:logback-core\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eLogback 1.5.37\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-26 Release of logback version 1.5.37\u003c/strong\u003e\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e• Given the numerous vulnerabilities related to conditional\nconfiguration processing based on the evaluation of Java expressions\nusing the Janino library, support for such expressions has been removed.\nUsers are offered the an \u003ca\nhref\u003d\"https://logback.qos.ch/translator/services/conditionalConfigMigrator.html\"\u003eonline\nmigration service\u003c/a\u003e or the \u003ccode\u003e\u0026lt;condition\u0026gt;\u003c/code\u003e element\nintroduced in version 1.5.20. See the \u003ca\nhref\u003d\"https://logback.qos.ch/manual/configuration.html#conditional\"\u003erelevant\ndocumentation\u003c/a\u003e for more details.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\nc1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag\nv_1.5.37. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.36\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-25 Release of logback version 1.5.36\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• The \u0027condition\u0027 attribute in \u003ccode\u003e\u0026lt;if\u0026gt;\u003c/code\u003e elements now\nreject certain references that are associated with ACE attacks. This\nissue was reported by \u0026quot;yulate\u0026quot; (\u003ca\nhref\u003d\"mailto:yulate531@gmail.com.com\"\u003eyulate531@gmail.com.com\u003c/a\u003e) and\nregistered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-13006\"\u003eCVE-2026-13006\u003c/a\u003e.\n\u003cstrong\u003ePlease note that version 1.5.37 provides the full fix to this\nvulnerability.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\n9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag\nv_1.5.36. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.35\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e026-06-23 Release of logback version 1.5.35\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• The \u0027condition\u0027 attribute in \u003ccode\u003e\u0026lt;if\u0026gt;\u003c/code\u003e elements now\nrejects unicode escape sequences (\\u and \\U). This closes a bypass of\nthe existing prohibition on the new operator in Janino-evaluated\nconditions. This issue was reported by IcySun (\u003ca\nhref\u003d\"mailto:icysun@qq.com\"\u003eicysun@qq.com\u003c/a\u003e) and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-13006\"\u003eCVE-2026-13006\u003c/a\u003e.\n\u003cstrong\u003ePlease note that version 1.5.37 provides the full fix to this\nvulnerability.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• Added \u003ccode\u003eConfiguratorRank.AUTHENTICATING\u003c/code\u003e (rank 100), the\nhighest configurator rank, for certified/authenticating configurators\ndiscovered via the ServiceLoader mechanism.\n\u003ccode\u003eContextInitializer\u003c/code\u003e now requires that at most one such\nconfigurator exist on the classpath; if more than one is found,\ninitialization aborts with an error.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eConsoleCharsetPropertyDefiner\u003c/code\u003e is no longer shipped.\nThe Java 21 multi-release compilation of logback-core has been disabled,\nwhich removes this class from the published artifact. Configurations\nthat referenced\n\u003ccode\u003ech.qos.logback.core.property.ConsoleCharsetPropertyDefiner\u003c/code\u003e\nwill need an alternative approach for console charset detection.\u003c/p\u003e\n\u003cp\u003e• The logback-examples module is now included in artifacts published\nto Maven Central.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eJoranConfigurator.makeAnotherInstance()\u003c/code\u003e and\n\u003ccode\u003eDefaultJoranConfigurator.performMultiStepConfigurationFileSearch()\u003c/code\u003e\nare now protected, allowing derived configurators to override these\nmethods.\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\n08bd1598d565d83444f72983935e7da4746783b7 associated with the tag\nv_1.5.35. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/c1df7f522e648eec7b4ef6a12c8758fec0f00048\"\u003e\u003ccode\u003ec1df7f5\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.37\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/a1899674579c67711a4fff6bdc569f4bfb25ead5\"\u003e\u003ccode\u003ea189967\u003c/code\u003e\u003c/a\u003e\nremove conditional based on janino\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/aaa905292dc24235a0cd7514c4815d0eeb6c0446\"\u003e\u003ccode\u003eaaa9052\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.37-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/9b94c37562bf25a6a944146701d42ee6c4eee888\"\u003e\u003ccode\u003e9b94c37\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.36\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/e6a8280ba2c61a448226bccbced70444aaa6e7eb\"\u003e\u003ccode\u003ee6a8280\u003c/code\u003e\u003c/a\u003e\nprevent attacks using disallowed references\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/24c4b63f60e5bbfa591c20cf39f2ce50ff8cff4f\"\u003e\u003ccode\u003e24c4b63\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.36-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/08bd1598d565d83444f72983935e7da4746783b7\"\u003e\u003ccode\u003e08bd159\u003c/code\u003e\u003c/a\u003e\npreapre release 1.5.35\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/37d256b825fc62b4a3908fa29d8b4e34acf79ed0\"\u003e\u003ccode\u003e37d256b\u003c/code\u003e\u003c/a\u003e\nindentation changes only\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/d3d73078afbb0691423f60a066d77503fdf05fc3\"\u003e\u003ccode\u003ed3d7307\u003c/code\u003e\u003c/a\u003e\nminor comment\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/fa0411a9393282ba69396ce65f122d281c079ac0\"\u003e\u003ccode\u003efa0411a\u003c/code\u003e\u003c/a\u003e\nradomize file location\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.37\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: JB Onofré \u003cjbonofre@apache.org\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d9f9d59c43cfbe6d0961b31431c8c55d07fe9e02",
      "old_mode": 33188,
      "old_path": "pom.xml",
      "new_id": "78137eb4e9ea149fec2d45c0a1765b2ce056a273",
      "new_mode": 33188,
      "new_path": "pom.xml"
    }
  ]
}