)]}'
{
  "commit": "0de250f72d95078a2cdef4ad9119c63116101a5c",
  "tree": "74ca9a2b5d7080914d9d3ba0232f87a232066573",
  "parents": [
    "6e8fd9ca70316a80f85a606d2fac1b69770700f9"
  ],
  "author": {
    "name": "Piotr P. Karwasz",
    "email": "pkarwasz-github@apache.org",
    "time": "Mon Aug 31 23:54:39 2026 +0200"
  },
  "committer": {
    "name": "Piotr P. Karwasz",
    "email": "pkarwasz-github@apache.org",
    "time": "Mon Aug 31 23:57:38 2026 +0200"
  },
  "message": "Serialize ObjectArrayMessage elements through the filtered wrapper\n\n`ObjectArrayMessage.readObject` read its `Object[]` with a plain\n`readObject()` call, the last remaining direct object read in a\nshipped `readObject` method. It now uses the same per-element\n`writeWrappedObject`/`readWrappedObject` mechanism as\n`ParameterizedMessage`, which re-applies the deserialization allowlist\nto each element and replaces non-`Serializable` elements with their\n`String.valueOf` representation on the writing side.\n\nThe shared loop moves to `SerializationUtil.writeWrappedObjects`/\n`readWrappedObjects`, which also bounds the array allocation during\ndeserialization: at most 256 elements are pre-allocated and the array\ngrows as elements are actually read, so a forged length cannot force a\nlarge allocation. `ParameterizedMessage`, whose serialized form is\nunchanged, picks up the same bound on its previously eager\n`new Object[argCount]`.\n\nCompatibility: the serialized form of `ObjectArrayMessage` changes;\nstreams written by earlier versions are rejected by newer readers and\nvice versa.\n\nPart of the hardening series from #4168.\n\nAssisted-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8acd13b3d71e067b3fe565862fa466770c1a8b1d",
      "old_mode": 33188,
      "old_path": "log4j-api-test/src/test/java/org/apache/logging/log4j/message/ObjectArrayMessageTest.java",
      "new_id": "44ffc8a33779f3a95c50f0a62b3979c4d88a7c82",
      "new_mode": 33188,
      "new_path": "log4j-api-test/src/test/java/org/apache/logging/log4j/message/ObjectArrayMessageTest.java"
    },
    {
      "type": "modify",
      "old_id": "4bd5df91bef88d6e0e8d393ae8807a5bf4a167c2",
      "old_mode": 33188,
      "old_path": "log4j-api-test/src/test/java/org/apache/logging/log4j/message/ParameterizedMessageTest.java",
      "new_id": "c96e831d9c323cb52dbe90ec3c97ce70e857f83c",
      "new_mode": 33188,
      "new_path": "log4j-api-test/src/test/java/org/apache/logging/log4j/message/ParameterizedMessageTest.java"
    },
    {
      "type": "modify",
      "old_id": "b30b51f647d03a93462e589ee6273fe9e42a5bf3",
      "old_mode": 33188,
      "old_path": "log4j-api/src/main/java/org/apache/logging/log4j/message/ObjectArrayMessage.java",
      "new_id": "6153bc313f28fe9d134d5e63cdc2b6f6f8915e42",
      "new_mode": 33188,
      "new_path": "log4j-api/src/main/java/org/apache/logging/log4j/message/ObjectArrayMessage.java"
    },
    {
      "type": "modify",
      "old_id": "a93b495e42e94b47e40155d1df68df3998183837",
      "old_mode": 33188,
      "old_path": "log4j-api/src/main/java/org/apache/logging/log4j/message/ParameterizedMessage.java",
      "new_id": "b0e1edf56c8561b652b5a3f1e685dadca67cb9f2",
      "new_mode": 33188,
      "new_path": "log4j-api/src/main/java/org/apache/logging/log4j/message/ParameterizedMessage.java"
    },
    {
      "type": "modify",
      "old_id": "6eeca8189a9c8190f9c540e56761c7a3da350606",
      "old_mode": 33188,
      "old_path": "log4j-api/src/main/java/org/apache/logging/log4j/util/internal/SerializationUtil.java",
      "new_id": "b25d9e24ee46ffc3022a0246d2b2f2f8964ee737",
      "new_mode": 33188,
      "new_path": "log4j-api/src/main/java/org/apache/logging/log4j/util/internal/SerializationUtil.java"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "031c20bc4cb09456e61d4ee126733f44fd380f63",
      "new_mode": 33188,
      "new_path": "src/changelog/.2.x.x/4274_wrap_object_array_message_serialization.xml"
    }
  ]
}