MINOR: Bump logback.version from 1.5.18 to 1.5.20
Type: Pull Request
State: Open
![dependabot[bot]](https://github.com/dependabot.png){kind=small}
dependabot[bot]Association: Unknown
Comments: 3
(7 months ago)
(7 months ago)
dependencies java
⚠️ Dependabot is rebasing this PR ⚠️
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps logback.version from 1.5.18 to 1.5.20.
Updates ch.qos.logback:logback-classic from 1.5.18 to 1.5.20
Release notes
Sourced from ch.qos.logback:logback-classic's releases.
Logback 1.5.19
2025-09-30 Release of logback version 1.5.19
• Disallow "new" operator in the
conditionattribute of <if> elements. This fixes an ACE vulnerability recorded as CVE-2025-11226.• At initialization time, slightly better reporting about watched configuration files.
• Softer message regarding usage of ConsoleAppender and its potential impact on performance.
• In ViewStatusMessagesServlet, restrict processing of "Clear" button to POST method. This change was proposed by Ralf Wiebicke who also provided the relevant PR.
• A bit-wise identical binary of this version can be reproduced by building from source code at commit e572d4f87f06674788eb3ca7148e8d1dffc615fa associated with the tag v_1.5.19. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
Commits
930fb15prepare release 1.5.200b4432aprovide an alternative to Janino based conditional configuration processing -...258558fprovide an alternative to Janino based conditional configuration processing -...ee77a70provide an alternative to Janino based conditional configuration processing -...5ca7ce8provide an alternative to Janino based conditional configuration processing -...728803ffix typoaa5eeb1start work on version 1.5.20-SNAPSHOTe572d4fskip deployment of blackbox and example modules, published as version 1.5.94adae8badd plugin for Maven Central deploymentee70cf4prepare release 1.5.19- Additional commits viewable in compare view
Updates ch.qos.logback:logback-core from 1.5.18 to 1.5.20
Release notes
Sourced from ch.qos.logback:logback-core's releases.
Logback 1.5.19
2025-09-30 Release of logback version 1.5.19
• Disallow "new" operator in the
conditionattribute of <if> elements. This fixes an ACE vulnerability recorded as CVE-2025-11226.• At initialization time, slightly better reporting about watched configuration files.
• Softer message regarding usage of ConsoleAppender and its potential impact on performance.
• In ViewStatusMessagesServlet, restrict processing of "Clear" button to POST method. This change was proposed by Ralf Wiebicke who also provided the relevant PR.
• A bit-wise identical binary of this version can be reproduced by building from source code at commit e572d4f87f06674788eb3ca7148e8d1dffc615fa associated with the tag v_1.5.19. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
Commits
930fb15prepare release 1.5.200b4432aprovide an alternative to Janino based conditional configuration processing -...258558fprovide an alternative to Janino based conditional configuration processing -...ee77a70provide an alternative to Janino based conditional configuration processing -...5ca7ce8provide an alternative to Janino based conditional configuration processing -...728803ffix typoaa5eeb1start work on version 1.5.20-SNAPSHOTe572d4fskip deployment of blackbox and example modules, published as version 1.5.94adae8badd plugin for Maven Central deploymentee70cf4prepare release 1.5.19- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Package Dependencies
Technical Details
| ID: | 10951822 |
| UUID: | 3555271659 |
| Node ID: | PR_kwDONUSCK86vz-fB |
| Host: | GitHub |
| Repository: | apache/arrow-java |