This is a vote to release Log4j 2.17.0, the next version of the Log4j 2 project.
Please download, test, and cast your votes on the log4j developers list. [] +1, release the artifacts [] -1, don't release because... The vote will remain open for as short amount as time as required to vet the release. All votes are welcome and we encourage everyone to test the release, but only Logging PMC votes are “officially” counted. As always, at least 3 +1 votes and more positive than negative votes are required. Note that a pre-release version of this was distributed to all reporters of the issue covered by CVE-2021-45105 and all who tested confirmed the issue was addressed. Changes in this version include: Fixed Bugs • LOG4J2-3230: Fix string substitution recursion. • LOG4J2-3242: Limit JNDI to the java protocol only. JNDI will remain disabled by default. Rename JNDI enablement property from 'log4j2.enableJndi' to 'log4j2.enableJndiLookup', 'log4j2.enableJndiJms', and 'log4j2.enableJndiContextSelector'. • LOG4J2-3242: Limit JNDI to the java protocol only. JNDI will remain disabled by default. The enablement property has been renamed to 'log4j2.enableJndiJava' • LOG4J2-3241: Do not declare log4j-api-java9 and log4j-core-java9 as dependencies as it causes problems with the Maven enforcer plugin. • LOG4J2-3247: PropertiesConfiguration.parseAppenderFilters NPE when parsing properties file filters. • LOG4J2-3249: Log4j 1.2 bridge for Syslog Appender defaults to port 512 instead of 514. • LOG4J2-3237: Log4j 1.2 bridge API hard codes the Syslog protocol to TCP. Tag: a) for a new copy do "git clone https://github.com/apache/logging-log4j2.git and then "git checkout tags/log4j-2.17.0-rc1” or just "git clone -b log4j-2.17.0-rc1 https://github.com/apache/logging-log4j2.git" b) for an existing working copy to “git pull” and then “git checkout tags/log4j-2.17.0-rc1” Web Site: https://logging.staged.apache.org/log4j/2.x/index.html Maven Artifacts: https://repository.apache.org/content/repositories/orgapachelogging-1071 Distribution archives: https://dist.apache.org/repos/dist/dev/logging/log4j/ You may download all the Maven artifacts by executing: wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate https://repository.apache.org/content/repositories/orgapachelogging-1071/org/apache/logging/log4j/ Ralph