This is an automated email from the ASF dual-hosted git repository.
jbonofre pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow-java.git
The following commit(s) were added to refs/heads/main by this push:
new 268f0cf39 MINOR: Bump logback.version from 1.6.5 to 1.6.6 (#1434)
268f0cf39 is described below
commit 268f0cf39513561176acef75ec8c9f0817097906
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
AuthorDate: Mon Nov 2 14:02:09 2026 +0100
MINOR: Bump logback.version from 1.6.5 to 1.6.6 (#1434)
Bumps `logback.version` from 1.6.5 to 1.6.6.
Updates `ch.qos.logback:logback-classic` from 1.6.5 to 1.6.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-classic's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.6.6</h2>
<h3>2026-10-25 Release of logback version 1.6.6</h3>
<p>• <code>LoggingEventVO</code> now rejects, during deserialization,
throwable proxies whose cause or suppressed entries point back into the
graph of proxies, for example to their own parent. Such graphs cannot be
produced by logback itself. However, a crafted stream sent to a socket
receiver could use serialization back-references to build them, after
which <code>DefaultThrowableRenderer</code> and
<code>SyslogAppender</code> would loop forever and the recursive
converters would overflow the stack. These streams are now rejected with
an <code>InvalidObjectException</code>. Circular exceptions logged by
the application are still transmitted correctly. This issue was reported
and fixed in [PR <a
href="https://redirect.github.com/qos-ch/logback/issues/1079";>#1079</a>](<a
href="https://redirect.github.com/qos-ch/logback/pull/1079";>qos-ch/logback#1079</a>)
by <a href="https://github.com/arfa-21";>arfa-21</a>.</p>
<p>• <code>FileNamePattern</code> now escapes characters with a special
meaning in regular expressions, such as <code>(</code>, <code>[</code>
or <code>+</code>, when converting the literal parts of a file name
pattern into a regex. Previously, <code>RollingFileAppender</code>
failed to start when the path contained an unbalanced parenthesis, as in
<code>C:/Users/Michael(Financ</code>. This issue was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/914";>issues/914</a>
by <a href="https://github.com/danamlund";>danamlund</a>. Moreover, with
<code>SizeAndTimeBasedRollingPolicy</code> and a pattern such as
<code>app.%d.(%i).log</code>, existing archives were not recognized.
After a restart within the same period, the next rollover could
overwrite an existing archive, and <em>maxHistory</em> and
<em>totalSizeCap</em> never removed such archives. This issue was
reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/933";>issues/933</a>
by <a href="https://github.com/GeoffreyBoulay";>GeoffreyBoulay</a>. The
fix was contributed in [PR <a
href="https://redirect.github.com/qos-ch/logback/issues/1077";>#1077</a>](<a
href="https://redirect.github.com/qos-ch/logback/pull/1077";>qos-ch/logback#1077</a>)
by <a href="https://github.com/CCCLL";>Jialin Chen</a>. Regex
metacharacters in <code>%d{...}</code> date patterns are now escaped as
well.</p>
<p>• The conversion of date patterns into regular expressions now
follows the rules of <code>DateTimeFormatter</code>, which logback uses
to format dates, instead of those of <code>SimpleDateFormat</code>. In
particular, the <code>L</code> (stand-alone month) pattern letter is now
supported.</p>
<p>• <code>SyslogOutputStream</code> now connects its
<code>DatagramSocket</code> to the syslog host. Previously, the socket
was bound to the wildcard address, so that hardened environments saw an
unconnected UDP listener on all interfaces for as long as the
application ran. This issue was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/939";>issues/939</a>
by <a href="https://github.com/joao-rebelo";>joao-rebelo</a>. The fix was
contributed in [PR <a
href="https://redirect.github.com/qos-ch/logback/issues/1076";>#1076</a>](<a
href="https://redirect.github.com/qos-ch/logback/pull/1076";>qos-ch/logback#1076</a>)
by <a href="https://github.com/Lyin-OTTF";>Lyin-OTTF</a>.</p>
<p>If the socket cannot be connected, for example because the network is
not yet available, <code>SyslogOutputStream</code> falls back to an
unconnected socket and <code>SyslogAppenderBase</code> emits a warning.
When a datagram sent on a connected socket fails due to an ICMP
"port unreachable" message caused by an earlier datagram, the
datagram is sent once more so that no message is lost. If the retry also
fails, a single warning is emitted instead of one error per event.</p>
<p>• <code>OutputStreamAppender</code> now stops its encoder when the
appender is stopped. Previously, encoders holding resources until they
were stopped, such as those of logstash-logback-encoder, were never
released, causing heap growth at each reconfiguration. This issue was
fixed in [PR <a
href="https://redirect.github.com/qos-ch/logback/issues/1072";>#1072</a>](<a
href="https://redirect.github.com/qos-ch/logback/pull/1072";>qos-ch/logback#1072</a>)
by <a href="https://github.com/samyuh";>Samuel Fernandes</a>.</p>
<p>• During variable substitution, an unmatched right curly brace now
causes an error to be reported, with the original value left unchanged.
Previously, the brace and all subsequent characters were silently
dropped, so that <code>%m}some text</code> became <code>%m</code>. This
issue was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/836";>issues/836</a>
by <a href="https://github.com/philsttr";>philsttr</a>.</p>
<p>• <code>LogbackMDCAdapter</code> now stores MDC entries in a
<code>LinkedHashMap</code>, so that the <code>%X</code> converter
outputs them in insertion order. This issue was reported in <a
href="https://jira.qos.ch/browse/LOGBACK-1337";>LOGBACK-1337</a> and
fixed by <a href="https://github.com/motlin";>Craig P. Motlin</a>.</p>
<p>• A bit-wise identical binary of this version can be reproduced by
building from <a href="https://github.com/qos-ch/logback";>source
code</a> at commit a9ee8019ee183e076ff5477957dbf90c4b04dd92 associated
with the tag <code>v_1.6.6</code>. The release was built using Java
"21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian
11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/qos-ch/logback/commit/a9ee8019ee183e076ff5477957dbf90c4b04dd92";><code>a9ee801</code></a>
prepare release 1.6.6</li>
<li><a
href="https://github.com/qos-ch/logback/commit/7fa8e8e4c939a7c1245af77a4f24661a6c7cac48";><code>7fa8e8e</code></a>
throw ScanException on unmatched '}' during variable substitution, fixes
<a
href="https://redirect.github.com/qos-ch/logback/issues/836";>#836</a></li>
<li><a
href="https://github.com/qos-ch/logback/commit/355b931bc4787da482bf98e7a203fb71c01afbac";><code>355b931</code></a>
Test round trip of circular exceptions through LoggingEventVO</li>
<li><a
href="https://github.com/qos-ch/logback/commit/c7b8e2f425cfdef62fd466f57ce137dc7988826d";><code>c7b8e2f</code></a>
reject cyclic throwable proxies in LoggingEventVO.readObject</li>
<li><a
href="https://github.com/qos-ch/logback/commit/6217f1163e054e880de2ce8b323a818d1790beb5";><code>6217f11</code></a>
fix loging of ThrowableProxy constructor taking isCyclic boolean</li>
<li><a
href="https://github.com/qos-ch/logback/commit/0b95858aa206af1b7c1a5d93f653f0785c0df31a";><code>0b95858</code></a>
LOGBACK-1337 LogbackMDCAdapter should store mdc in LinkedHashMap to
predict o...</li>
<li><a
href="https://github.com/qos-ch/logback/commit/5c1f5776bb85f63b34489771e868d23a34e89632";><code>5c1f577</code></a>
add LinkedHashMap to HardenedObjectInputStream whitelist</li>
<li><a
href="https://github.com/qos-ch/logback/commit/7c36c7177a8faeb296da96ce9780fa7425295b98";><code>7c36c71</code></a>
Escape regex metacharacters in date patterns, harden rolling tests</li>
<li><a
href="https://github.com/qos-ch/logback/commit/d268774cf73523f78fdd33ff3da4050a5fdd525f";><code>d268774</code></a>
Align date pattern to regex conversion with DateTimeFormatter</li>
<li><a
href="https://github.com/qos-ch/logback/commit/b4b48282163d046616659a45233875c45cf0c790";><code>b4b4828</code></a>
Escape regex metacharacters of literal text in FileNamePattern
regexes</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.6.5...v_1.6.6";>compare
view</a></li>
</ul>
</details>
<br />
Updates `ch.qos.logback:logback-core` from 1.6.5 to 1.6.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-core's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.6.6</h2>
<h3>2026-10-25 Release of logback version 1.6.6</h3>
<p>• <code>LoggingEventVO</code> now rejects, during deserialization,
throwable proxies whose cause or suppressed entries point back into the
graph of proxies, for example to their own parent. Such graphs cannot be
produced by logback itself. However, a crafted stream sent to a socket
receiver could use serialization back-references to build them, after
which <code>DefaultThrowableRenderer</code> and
<code>SyslogAppender</code> would loop forever and the recursive
converters would overflow the stack. These streams are now rejected with
an <code>InvalidObjectException</code>. Circular exceptions logged by
the application are still transmitted correctly. This issue was reported
and fixed in [PR <a
href="https://redirect.github.com/qos-ch/logback/issues/1079";>#1079</a>](<a
href="https://redirect.github.com/qos-ch/logback/pull/1079";>qos-ch/logback#1079</a>)
by <a href="https://github.com/arfa-21";>arfa-21</a>.</p>
<p>• <code>FileNamePattern</code> now escapes characters with a special
meaning in regular expressions, such as <code>(</code>, <code>[</code>
or <code>+</code>, when converting the literal parts of a file name
pattern into a regex. Previously, <code>RollingFileAppender</code>
failed to start when the path contained an unbalanced parenthesis, as in
<code>C:/Users/Michael(Financ</code>. This issue was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/914";>issues/914</a>
by <a href="https://github.com/danamlund";>danamlund</a>. Moreover, with
<code>SizeAndTimeBasedRollingPolicy</code> and a pattern such as
<code>app.%d.(%i).log</code>, existing archives were not recognized.
After a restart within the same period, the next rollover could
overwrite an existing archive, and <em>maxHistory</em> and
<em>totalSizeCap</em> never removed such archives. This issue was
reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/933";>issues/933</a>
by <a href="https://github.com/GeoffreyBoulay";>GeoffreyBoulay</a>. The
fix was contributed in [PR <a
href="https://redirect.github.com/qos-ch/logback/issues/1077";>#1077</a>](<a
href="https://redirect.github.com/qos-ch/logback/pull/1077";>qos-ch/logback#1077</a>)
by <a href="https://github.com/CCCLL";>Jialin Chen</a>. Regex
metacharacters in <code>%d{...}</code> date patterns are now escaped as
well.</p>
<p>• The conversion of date patterns into regular expressions now
follows the rules of <code>DateTimeFormatter</code>, which logback uses
to format dates, instead of those of <code>SimpleDateFormat</code>. In
particular, the <code>L</code> (stand-alone month) pattern letter is now
supported.</p>
<p>• <code>SyslogOutputStream</code> now connects its
<code>DatagramSocket</code> to the syslog host. Previously, the socket
was bound to the wildcard address, so that hardened environments saw an
unconnected UDP listener on all interfaces for as long as the
application ran. This issue was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/939";>issues/939</a>
by <a href="https://github.com/joao-rebelo";>joao-rebelo</a>. The fix was
contributed in [PR <a
href="https://redirect.github.com/qos-ch/logback/issues/1076";>#1076</a>](<a
href="https://redirect.github.com/qos-ch/logback/pull/1076";>qos-ch/logback#1076</a>)
by <a href="https://github.com/Lyin-OTTF";>Lyin-OTTF</a>.</p>
<p>If the socket cannot be connected, for example because the network is
not yet available, <code>SyslogOutputStream</code> falls back to an
unconnected socket and <code>SyslogAppenderBase</code> emits a warning.
When a datagram sent on a connected socket fails due to an ICMP
"port unreachable" message caused by an earlier datagram, the
datagram is sent once more so that no message is lost. If the retry also
fails, a single warning is emitted instead of one error per event.</p>
<p>• <code>OutputStreamAppender</code> now stops its encoder when the
appender is stopped. Previously, encoders holding resources until they
were stopped, such as those of logstash-logback-encoder, were never
released, causing heap growth at each reconfiguration. This issue was
fixed in [PR <a
href="https://redirect.github.com/qos-ch/logback/issues/1072";>#1072</a>](<a
href="https://redirect.github.com/qos-ch/logback/pull/1072";>qos-ch/logback#1072</a>)
by <a href="https://github.com/samyuh";>Samuel Fernandes</a>.</p>
<p>• During variable substitution, an unmatched right curly brace now
causes an error to be reported, with the original value left unchanged.
Previously, the brace and all subsequent characters were silently
dropped, so that <code>%m}some text</code> became <code>%m</code>. This
issue was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/836";>issues/836</a>
by <a href="https://github.com/philsttr";>philsttr</a>.</p>
<p>• <code>LogbackMDCAdapter</code> now stores MDC entries in a
<code>LinkedHashMap</code>, so that the <code>%X</code> converter
outputs them in insertion order. This issue was reported in <a
href="https://jira.qos.ch/browse/LOGBACK-1337";>LOGBACK-1337</a> and
fixed by <a href="https://github.com/motlin";>Craig P. Motlin</a>.</p>
<p>• A bit-wise identical binary of this version can be reproduced by
building from <a href="https://github.com/qos-ch/logback";>source
code</a> at commit a9ee8019ee183e076ff5477957dbf90c4b04dd92 associated
with the tag <code>v_1.6.6</code>. The release was built using Java
"21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian
11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/qos-ch/logback/commit/a9ee8019ee183e076ff5477957dbf90c4b04dd92";><code>a9ee801</code></a>
prepare release 1.6.6</li>
<li><a
href="https://github.com/qos-ch/logback/commit/7fa8e8e4c939a7c1245af77a4f24661a6c7cac48";><code>7fa8e8e</code></a>
throw ScanException on unmatched '}' during variable substitution, fixes
<a
href="https://redirect.github.com/qos-ch/logback/issues/836";>#836</a></li>
<li><a
href="https://github.com/qos-ch/logback/commit/355b931bc4787da482bf98e7a203fb71c01afbac";><code>355b931</code></a>
Test round trip of circular exceptions through LoggingEventVO</li>
<li><a
href="https://github.com/qos-ch/logback/commit/c7b8e2f425cfdef62fd466f57ce137dc7988826d";><code>c7b8e2f</code></a>
reject cyclic throwable proxies in LoggingEventVO.readObject</li>
<li><a
href="https://github.com/qos-ch/logback/commit/6217f1163e054e880de2ce8b323a818d1790beb5";><code>6217f11</code></a>
fix loging of ThrowableProxy constructor taking isCyclic boolean</li>
<li><a
href="https://github.com/qos-ch/logback/commit/0b95858aa206af1b7c1a5d93f653f0785c0df31a";><code>0b95858</code></a>
LOGBACK-1337 LogbackMDCAdapter should store mdc in LinkedHashMap to
predict o...</li>
<li><a
href="https://github.com/qos-ch/logback/commit/5c1f5776bb85f63b34489771e868d23a34e89632";><code>5c1f577</code></a>
add LinkedHashMap to HardenedObjectInputStream whitelist</li>
<li><a
href="https://github.com/qos-ch/logback/commit/7c36c7177a8faeb296da96ce9780fa7425295b98";><code>7c36c71</code></a>
Escape regex metacharacters in date patterns, harden rolling tests</li>
<li><a
href="https://github.com/qos-ch/logback/commit/d268774cf73523f78fdd33ff3da4050a5fdd525f";><code>d268774</code></a>
Align date pattern to regex conversion with DateTimeFormatter</li>
<li><a
href="https://github.com/qos-ch/logback/commit/b4b48282163d046616659a45233875c45cf0c790";><code>b4b4828</code></a>
Escape regex metacharacters of literal text in FileNamePattern
regexes</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.6.5...v_1.6.6";>compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot]
<49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 42d597b32..428b3f4b7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -113,7 +113,7 @@ under the License.
<checkstyle.failOnViolation>true</checkstyle.failOnViolation>
<error_prone_core.version>2.51.0</error_prone_core.version>
<checker.framework.version>4.3.1</checker.framework.version>
- <logback.version>1.6.5</logback.version>
+ <logback.version>1.6.6</logback.version>
<doclint>none</doclint>
<additionalparam>-Xdoclint:none</additionalparam>
<surefire.argLine.extend/>
