Re: [VOTE] Release Log4Net 2.0.9

2020-07-30 Thread Davyd McColl
Apologies if there's any confusion around sender address -- I've already fluffed this by sending from my work account (default in my mail client) -d On 2020/07/31 08:26:54, Davyd McColl wrote: Hi all, I've never done this before, so bear with me if I fluff it: This is a proposed vote to releas

[VOTE] Release Log4Net 2.0.9

2020-07-30 Thread Davyd McColl
Hi all, I've never done this before, so bear with me if I fluff it: This is a proposed vote to release log4net 2.0.9 from PR  https://github.com/apache/logging-log4net/pull/61 Release artifacts (including source zip) are at:  https://ci.appveyor.com/project/fluffynuts/logging-log4net/builds/34063

Re: Query related to release of patch LOG4NET-575

2020-07-30 Thread Nallapu, Shashi Kanth
Dear Team, Can you please provide an update on the below query. This is about the 2.1.0 release for issue LOG4NET-575. Currently we have a XXE vulnerability raised for log4net in our application. Our application uses log4net version 2.0.8 and Microsoft .net framework 4.5.2. By default, .net fram

Re: [VOTE] Log4Net dormant release

2020-07-30 Thread Dominik Psenner
I agree. People have to learn the mailing list mechanics. In this case I deliberately chose to accept the message because I valued it worthy for the readers of dev at logging. -- Sent from my phone. Typos are a kind gift to anyone who happens to find them. On Thu, Jul 30, 2020, 19:07 Ralph Goers

Re: [VOTE] Log4Net dormant release

2020-07-30 Thread Ralph Goers
Unfortunately, I had to moderate the message you just responded to so I am not sure if they will see the response. That said, I don’t think we should be cc’ing posters. They should subscribe. Ralph > On Jul 30, 2020, at 9:14 AM, Dominik Psenner wrote: > > Hi Shushi Kant, > > There is no main

Re: [VOTE] Log4Net dormant release

2020-07-30 Thread Dominik Psenner
Hi Shushi Kant, There is no maintainer to release binaries for You. A source only release was made some time ago, also to signal the dormant state of the project. This was aimed to be a signal to interesting parties to get involved in the project. I see at least these options: Option 1 is to get

Re: [VOTE] Log4Net dormant release

2020-07-30 Thread Nallapu, Shashi Kanth
Dear Team, Can you please provide an update on the below query. This is about the 2.1.0 release for issue LOG4NET-575. Currently we have a XXE vulnerability raised for log4net in our application. Our application uses log4net version 2.0.8 and Microsoft .net framework 4.5.2. By default, .net frame

Re: [apache/logging-log4j2] Bump springVersion from 3.2.18.RELEASE to 5.2.8.RELEASE (#391)

2020-07-30 Thread Matt Sicker
I'm no Maven expert, so the only thing I could think of that might be flexible enough to match our desire to test compatibility with older dependencies and their recent versions. It'd have to be on a case-by-case basis as some libraries follow SemVer while others don't. On Thu, 30 Jul 2020 at 08:0

Re: [apache/logging-log4j2] Bump springVersion from 3.2.18.RELEASE to 5.2.8.RELEASE (#391)

2020-07-30 Thread Gary Gregory
What I would like to know is what expectations are we giving our users? At work, I could never sell this unless our build and QA validates a product for all versions in a range, for every release. I am sure we are not proposing that and that the build... does what? Pick the latest in the range? La

Re: [CVE-2018-1285] XXE vulnerability in Apache log4net

2020-07-30 Thread Satish Rathore
Hi, Any further update , plans to release new version for vulnerability CVE-2018-1285 Thanks, Satish On 2020/05/25 16:28:20, Suthish Nair wrote: > Hi, > > Good Day! > > Is there any mitigation or vulnerability fix available for .NET Core > frameworks? > > Please let me know. > > Regards >

Re: [VOTE] Log4Net dormant release

2020-07-30 Thread Satish Rathore
Hi, Do we have any further update on this, any plan for releasing 2.1.0 Thanks, Satish On 2020/04/04 22:24:59, Ralph Goers wrote: > I have modified the STATUS.txt and README.txt for Log4Net, tagged the source, > zipped it and then published it to > https://dist.apache.org/repos/dist/dev/logg