November 2020 - logback-dev

[JIRA] Updates for LOGBACK-1543: prudent mode lose efficacy since v1.2.0
by QOS.CH (JIRA) 30 Nov '20

30 Nov '20

logback / LOGBACK-1543 [Open] prudent mode lose efficacy since v1.2.0 ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1543 ============================== Issue created ------------------------------ nico_wen created this issue on 30/Nov/20 4:39 AM Summary: prudent mode lose efficacy since v1.2.0 Issue Type: Bug Affects Versions: 1.2.0 Assignee: Logback dev list Components: logback-core Created: 30/Nov/20 4:39 AM Environment: Since v1.2.0 the prudent mode is almost useless because safeWrite never get really invoked before v1.2.0 {code:java} // OutputStreamAppender.java try { // skip some irrelevant codes... writeOut(event) } catch (IOException ioe) { this.started = false; addStatus(new ErrorStatus("IO failure in appender", this, ioe)); } // and writeOut is overrided by FileAppender.java @Override protected void writeOut(E event) throws IOException { if (prudent) { safeWrite(event); // here is the point, it ensure write integrity with file lock } else { super.writeOut(event); } }{code} but since v1.2.0, the code was refactored to this {code:java} // OutputStreamAppender.java protected void subAppend(E event) { if (!isStarted()) { return; } try { // skip some irrelevant codes... byte[] byteArray = this.encoder.encode(event); writeBytes(byteArray); // there is no guarantee to safe write } catch (IOException ioe) { this.started = false; addStatus(new ErrorStatus("IO failure in appender", this, ioe)); } } {code} Priority: Critical Reporter: nico_wen ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

JDK 16 Early Access build 26 is now available
by Rory O'Donnell 27 Nov '20

27 Nov '20

Hi Ceki, OpenJDK 16 Early Access build 26**is now available at http://jdk.java.net/16 * These early-access , open-source builds are provided under the o GNU General Public License, version 2, with the Classpath Exception <http://openjdk.java.net/legal/gplv2+ce.html>. * Schedule: *JDK 16 Rampdown Phase One Starts on 2020/12/10 [1] * * Features [1]: Most recent Integrations: o Integrated JEP 389: Foreign Linker API (Incubator) <https://openjdk.java.net/jeps/389> with this release. + JEP 389 introduces an API that offers statically-typed, pure-Java access to native code. + This API, together with the JEP 383 <https://openjdk.java.net/jeps/383>, will considerably simplify the otherwise error-prone process of binding to a native library. ** * Release Notes [2] * Changes in recent builds that maybe of interest: o Build 26 + JDK-8202343: *Disable TLS 1.0 and 1.1* + JDK-8251317:**Support for CLDR version 38** + JDK-8212879: Make JVMTI TagMap table concurrent + JDK-8236926: Concurrently uncommit memory in G1 + JDK-8243559: Removed Root Certificates with 1024-bit Keys + JDK-8253459: Argument index of zero or unrepresentable by int throws IllegalFormatException + JDK-8256643: Terminally deprecate ThreadGroup stop, destroy, isDestroyed, setDaemon and isDaemon o Build 25 + JDK-8247781: Day period support added to java.time formats + JDK-8202471: (ann) Cannot read type annotations on generic receiver type's type variables *[**Reported by ByteBuddy]* + JDK-8255947: [macos] Signed macOS jpackage app doesn't filter spurious '-psn' argument *[**Reported by JOSM]* + JDK-8256063: Module::getPackages returns the set of package names in this module * JDK 16 - topics of interest o Inside Java Episode 7 “The Vector API” with John Rose and Paul Sandoz + https://inside.java/2020/11/17/podcast-007/ <https://inside.java/2020/11/17/podcast-007/> o Biased locking Obsoletion update + https://inside.java/2020/11/17/biased-locking-obsoletion/ <https://inside.java/2020/11/17/biased-locking-obsoletion/> * Project Loom with Ron Pressler o https://inside.java/2020/11/24/podcast-008/ * Update on 64-bit ARM Support for Oracle OpenJDK and Oracle JDK o https://inside.java/2020/11/12/arm-support-update/ <https://inside.java/2020/11/12/arm-support-update/> Project Lanai Early-Access: EA 7 Build 16-lanai+3-278 <http://jdk.java.net/lanai/> (2020/11/17) * These early-access builds are provided under the GNU General Public License, version 2, with the Classpath Exception <http://openjdk.java.net/legal/gplv2+ce.html> * These EA builds are produced for the purpose of gathering feedback. Use for any other purpose is at your own risk. * Please send feedback via e-mail to lanai-dev(a)openjdk.java.net <mailto:lanai-dev@openjdk.java.net>. To send e-mail to this address you must first subscribe to the mailing list <https://mail.openjdk.java.net/mailman/listinfo/lanai-dev>. The Java Cryptographic Roadmap has been updated [3]: * Distrust TLS 1.0 and TLS 1.1 by default o TLS protocol versions 1.0 and 1.1 are no longer considered secure and have been superseded by more secure and modern versions (TLS 1.2 and 1.3). This change has been integrated with JDK 16 Early Access build 26. * Upgrade of default algorithms used to encrypt PKCS12 keystores o The new algorithms are based on AES-256 and SHA-256 and are stronger than the old algorithms which were based on RC2, DESede, and SHA-1.This change is already included in JDK 16 Early Access build 23. RgdsRory [1] https://openjdk.java.net/projects/jdk/16/ [2] https://jdk.java.net/16/release-notes [3] https://www.java.com/en/jre-jdk-cryptoroadmap.html -- Rgds, Rory O'Donnell Quality Engineering Manager Oracle EMEA, Dublin, Ireland

1 0

[JIRA] (LOGBACK-1542) Fortify scan: dom4j Vulnerability
by QOS.CH (JIRA) 24 Nov '20

24 Nov '20

1 0

[JIRA] Updates for LOGBACK-1542: Fortify scan: dom4j Vulnerability
by QOS.CH (JIRA) 23 Nov '20

23 Nov '20

logback / LOGBACK-1542 [Open] Fortify scan: dom4j Vulnerability ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1542 ============================== Issue created ------------------------------ xavier lamourec created this issue on 23/Nov/20 11:53 AM Summary: Fortify scan: dom4j Vulnerability Issue Type: Bug Assignee: Logback dev list Components: logback-classic Created: 23/Nov/20 11:53 AM Environment: Hi Team, A security issue has been raised by our Fortify scan for the following component: {code}dom4j - XML eXternal Entity (XXE)\{code} *Component Name:* org.dom4j:dom4j *Component Version:* 2.1.1 *Repository:* maven *Instance ID:* B294C4B2311CED0EF0D8F9827BB423C1 *Primary Rule ID:* CVE-2020-10683 *CVSS Base Score:* 7.6 *CVSS Vector:* CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H [https://nvd.nist.gov/vuln/detail/CVE-2020-10683] [https://cwe.mitre.org/data/definitions/611.html|https://cwe.mitre.org/data/…] Priority: Major Reporter: xavier lamourec ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

Upgrade slf4j to 1.7.30 for 1.2.x?
by Kris Kalavantavanich 17 Nov '20

17 Nov '20

Hi, What do you think about upgrading slf4j from 1.7.25 to 1.7.30 for version 1.2.x? According to maven for logback-classic, seems like the latest stable version in 1.2.3 which was released nearly 4 years ago. I can help upgrade this as well, however, this will be my first PR for this project; guides are welcomed. Kind regards, Kris

1 0

[JIRA] (LOGBACK-1000) MDC default value is not parsed
by QOS.CH (JIRA) 17 Nov '20

17 Nov '20

1 0

[JIRA] Updates for LOGBACK-1541: Enable Gaffer
by QOS.CH (JIRA) 13 Nov '20

13 Nov '20

logback / LOGBACK-1541 [Open] Enable Gaffer ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1541 ============================== Issue created ------------------------------ Boris created this issue on 13/Nov/20 7:10 PM Summary: Enable Gaffer Issue Type: New Feature Affects Versions: 1.3.0-alpha5 Assignee: Logback dev list Created: 13/Nov/20 7:10 PM Labels: groovy Priority: Major Reporter: Boris Description: In the [news section|https://logback.qos.ch/news.html] it is mentioned that Gaffer was disabled because "all currently available versions of Groovy are incompatible with Java 9". This hasn't been true for years now and the latest Groovy 2.5.13 and Groovy 3.0.5 support even Java 15. Gaffer is probably in use by many projects, one being [Gretty|https://github.com/gretty-gradle-plugin/gretty] It would be nice to enable it again for Logback 1.3.x. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

JDK 16 Early Access build 24 is now available
by Rory O'Donnell 13 Nov '20

13 Nov '20

Hi Ceki, OpenJDK 16 Early Access build 24**is now available at http://jdk.java.net/16 * These early-access , open-source builds are provided under the o GNU General Public License, version 2, with the Classpath Exception <http://openjdk.java.net/legal/gplv2+ce.html>. * Schedule 2020/12/10 Rampdown Phase One 2021/01/14 Rampdown Phase Two 2021/02/04 Initial Release Candidate 2021/02/18 Final Release Candidate 2021/03/16 General Availability * Features: o JEPs targeted to JDK 16, so far: + JEP 338: Vector API (Incubator) <https://openjdk.java.net/jeps/338> + JEP 347: Enable C++14 Language Features <https://openjdk.java.net/jeps/347> + JEP 357: Migrate from Mercurial to Git <https://openjdk.java.net/jeps/357> + JEP 369: Migrate to GitHub <https://openjdk.java.net/jeps/369> + JEP 376: ZGC: Concurrent Thread-Stack Processing <https://openjdk.java.net/jeps/376> + JEP 380: Unix-Domain Socket Channels <https://openjdk.java.net/jeps/380> + JEP 386: Alpine Linux Port <https://openjdk.java.net/jeps/386> + JEP 387: Elastic Metaspace <https://openjdk.java.net/jeps/387> + JEP 388: Windows/AArch64 Port <https://openjdk.java.net/jeps/388> + JEP 392: Packaging Tool <https://openjdk.java.net/jeps/392> + JEP 393: Foreign-Memory Access API (Third Incubator) <https://openjdk.java.net/jeps/393> + JEP 394: Pattern Matching for instanceof <https://openjdk.java.net/jeps/394> + JEP 395: Records <https://openjdk.java.net/jeps/395> ** * Release Notes are available at http://jdk.java.net/16/release-notes <http://jdk.java.net/16/release-notes> * Changes in recent builds that maybe of interest: o Build 24 + JDK-8231599: NPE when loading a preview classfile from a future Java version # *Reported by JUnit5* + JDK-8254661: arm32: additional cleanup after fixing SIGSEGV # *Reported by JaCoCo* + JDK-8255584: `HttpPrincipal::getName` returns incorrect name + JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d o Build 23 + JDK-8254876: (fs) NullPointerException not thrown when first argument to Path.of or Paths.get is null + JDK-8255576: (fs) Files.isHidden() throws ArrayIndexOutOfBoundsException (unix) # *Reported by JUnit5* + JDK-8255616: Removal of experimental features AOT and Graal JIT o Build 22 + JDK-8243583: Change 'final' error checks to throw ICCE + JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c Project Loom Early-Access Build: Build 16-loom+7-285 <http://jdk.java.net/loom/> (2020/11/4) * *Want to know more* - check out - https://inside.java/2020/11/11/project-loom-at-nyc-java-sig/ * These early-access builds are provided under the GNU General Public License, version 2, with the Classpath Exception <http://openjdk.java.net/legal/gplv2+ce.html> o These builds are based on jdk-16+20 <https://github.com/openjdk/jdk/releases/tag/jdk-16%2B20> o These EA builds are produced for the purpose of gathering feedback. Use for any other purpose is at your own risk. o Please send feedback via e-mail to loom-dev(a)openjdk.java.net <mailto:loom-dev@openjdk.java.net>. To send e-mail to this address you must first subscribe to the mailing list <http://mail.openjdk.java.net/mailman/listinfo/loom-dev>. Rgds,Rory -- Rgds, Rory O'Donnell Quality Engineering Manager Oracle EMEA, Dublin, Ireland

1 0

[JIRA] Updates for LOGBACK-1540: threadName has empty value that is logged via logback-access
by QOS.CH (JIRA) 12 Nov '20

12 Nov '20

logback / LOGBACK-1540 [Open] threadName has empty value that is logged via logback-access ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1540 ============================== Issue created ------------------------------ Krystian created this issue on 12/Nov/20 2:00 PM Summary: threadName has empty value that is logged via logback-access Issue Type: Bug Affects Versions: 1.2.3, 1.3.0-alpha5 Assignee: Logback dev list Created: 12/Nov/20 2:00 PM Environment: Jetty 9.4.34.v20201102 Debian Priority: Major Reporter: Krystian Description: according to the documentation: https://logback.qos.ch/manual/layouts.html |[|https://logback.qos.ch/manual/layouts.html#threadName]*I / threadName*|Name of the thread which processed the request.| but when you set [%*I*] or [%*threadName*] at logback-access.xml in the log file will be saved "[-]" no value is set as threadName, eg. <encoder> <pattern>%h %l %u [%date\{ISO8601}] [%I] "%r" %s %b "%i\{Referer}" [%D]ms</pattern> </encoder> ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for LOGBACK-1539: TimeBasedArchiveRemover does not delete all history
by QOS.CH (JIRA) 12 Nov '20

12 Nov '20

logback / LOGBACK-1539 [Open] TimeBasedArchiveRemover does not delete all history ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1539 ============================== Issue created ------------------------------ David Law created this issue on 12/Nov/20 1:20 PM Summary: TimeBasedArchiveRemover does not delete all history Issue Type: Bug Affects Versions: 1.2.3 Assignee: Logback dev list Attachments: List_of_Current_and_Rolling_Logfiles.txt, logback-1.xml, startPrintPDF_startup.log-2.txt Components: logback-core Created: 12/Nov/20 1:20 PM Environment: SUSE Linux Enterprise Server 11 (x86_64) openJDK v14.0.2 Labels: TimeBasedArchiveRemover maxHistory Priority: Major Reporter: David Law Description: {{ch.qos.logback.core.rolling.helper.}}{{TimeBasedArchiveRemover}} ...does not delete all history. I have attached the following files: * Logbacks Console output * logback.xml * a list of current & expired Logfiles detailing which should have been deleted Maybe this is related to Bug LOGBACK-772? (from 2012) ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0