- slf4j-dev - mailman3.qos.ch

Release of SLF4J version 1.7.34
by Ceki Gülcü 25 Jan '22

25 Jan '22

Hello all, I am very happy to announce the immediate availability of SLF4J version 1.7.34. In this release, the "slf4j-log4j12" artifact automatically instructs Maven to use the "slf4j-reload4j" artifact instead. As you might have guessed, the "slf4j-reload4j" binding delegates log processing to the reload4j logging framework. The reload4j project is a fork of Apache log4j version 1.2.17 with the goal of fixing pressing security issues. It is intended as a drop-in replacement for log4j version 1.2.17. By drop-in, we mean the replacement of log4j.jar with reload4j.jar in your build with no source code changes in .java files being necessary. Reload4j project web site: https://reload4j.qos.ch/ If you are using slf4j-log4j12 as your binding of choice, please consider using slf4j-reload4j instead. In SLF4J version 1.7.34 and later, this redirection is seamless and automatic. Please refer to the the news page for more details on this release: http://www.slf4j.org/news.html The relevant artifacts should hit the Maven central repository within the next few hours. The 1.7.x series: The Simple Logging Facade for Java or (SLF4J) serves as a simple facade or abstraction for various logging frameworks, e.g. java.util.logging, reload4j and logback, allowing the end user to plug in the desired logging framework at deployment time. Binary compatibility: Mixing mixing different versions of slf4j-api.jar and SLF4J binding can cause problems. For example, if you are using slf4j-api-1.7.1.jar, then you should also use slf4j-simple-1.7.1.jar, using slf4j-simple-1.5.5.jar will not work. >From the client's perspective all versions of slf4j-api are compatible. Client code compiled with slf4j-api-N.jar will run perfectly fine with slf4j-api-M.jar for any N and M. You only need to ensure that the version of your binding matches that of the slf4j-api.jar. You do not have to worry about the version of slf4j-api.jar used to compile a given dependency in your project. You can always use *any* version of slf4j-api.jar, and as long as the version of slf4j-api.jar and its binding match, you should be fine. Downloading SLF4J: You can download SLF4J, including full source code, class files and documentation from Maven central under the "org.slf4j" groupId. Announcement mailing list: You can receive SLF4J related announcements by subscribing to the SLF4J announce mailing list. To subscribe to QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce Donations and sponsorship You can also support SLF4J/logback/reload4j projects via donations and sponsorship. We thank our current supporters and sponsors for their continued contributions. https://github.com/sponsors/qos-ch Enjoy, -- Ceki Gülcü Please contact support(at)qos.ch for donations, sponsorship or support contracts related to SLF4J/logback/reload4j projects.

1 0

slf4j 2.0.0-alpha6 still referring to log4j 1.x
by Vijayendhiran M 24 Jan '22

24 Jan '22

Hi Team, We are trying to upgrade slf4j to the latest version 2.0.0-alpha6 <https://mvnrepository.com/artifact/org.slf4j/slf4j-api/2.0.0-alpha6>. We have noticed that it is still referring to log4j 1.x. We need to upgrade log4j version 2.x in our application. Looking for your support. Thanks, Vijay.

4 7

[JIRA] Updates for SLF4J-538: There are high-risk vulnerabilities in Apache Log4j 1.x of SLF4J
by QOS.CH (JIRA) 22 Jan '22

22 Jan '22

SLF4J / SLF4J-538 [Open] There are high-risk vulnerabilities in Apache Log4j 1.x of SLF4J ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-538 ============================== Issue created ------------------------------ zhengqin created this issue on 22/Jan/22 3:01 AM Summary: There are high-risk vulnerabilities in Apache Log4j 1.x of SLF4J Issue Type: Bug Affects Versions: 1.7.30, 1.7.31, 1.7.32, 1.7.33 Assignee: SLF4J developers list Created: 22/Jan/22 3:01 AM Labels: vulnerabilities Priority: Critical Reporter: zhengqin Severity: critical Description: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23307] [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23305] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23302 ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-537: Release slf4j-jdk-platform-logging for 1.x
by QOS.CH (JIRA) 20 Jan '22

20 Jan '22

SLF4J / SLF4J-537 [Open] Release slf4j-jdk-platform-logging for 1.x ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-537 ============================== 1 comment ------------------------------ robin bygrave on 20/Jan/22 2:07 AM I have created a slf4j 1.x compatible platform logger at [https://github.com/avaje/slf4j-jdk-platform-logging] I am happy to donate this if desired. It is a refactor/modifications from the slf4j 2.x one. Cheers, Rob. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-537: Release slf4j-jdk-platform-logging for 1.x
by QOS.CH (JIRA) 17 Jan '22

17 Jan '22

SLF4J / SLF4J-537 [Open] Release slf4j-jdk-platform-logging for 1.x ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-537 ============================== Issue created ------------------------------ Ben Manes created this issue on 17/Jan/22 6:48 PM Summary: Release slf4j-jdk-platform-logging for 1.x Issue Type: Improvement Assignee: SLF4J developers list Created: 17/Jan/22 6:48 PM Priority: Major Reporter: Ben Manes Description: Support for the Java 9 platform logger could be added without negatively impacting slf4j 1.x. Those users who are on later JDKs can opt-in and benefit due to being an independent dependency. Currently only 2.x has support, but it is in alpha so most users will not benefit. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-536: Add keyed deque support to MDC
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-536 [Open] Add keyed deque support to MDC ============================== Here's what changed in this issue in the last few minutes. This issue has been created View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-536 ============================== Issue created ------------------------------ Ceki Gülcü created this issue on 14/Jan/22 12:11 AM Summary: Add keyed deque support to MDC Issue Type: Bug Assignee: Ceki Gülcü Components: Core API Created: 14/Jan/22 12:11 AM Environment: Keyed deque in MDC can be quite useful and should be property documented. Priority: Major Reporter: Ceki Gülcü ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-455: Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete...
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-455 [Resolved] Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete... ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-455 ============================== 1 comment ------------------------------ Ceki Gülcü on 13/Jan/22 9:54 PM [~Neustradamus] Good suggestion. Will do and thank you. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-431: Mark EventData as deprecated in preparation for its removal
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-431 [Closed] Mark EventData as deprecated in preparation for its removal ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-431 ============================== 1 comment ------------------------------ Ceki Gülcü on 13/Jan/22 9:42 PM In 1.8.0-beta2 we are talking about the deprecation of the {{EventData}} class. Thus, the 1.8.0-beta2 tag for fix version is correct and does not need to be changed. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-430: Remove org.slf4j.ext.EventData due to security issue
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-430 [Reopened] Remove org.slf4j.ext.EventData due to security issue ============================== Here's what changed in this issue in the last few minutes. There are 2 updates, 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-430 ============================== 2 updates ------------------------------ Changes by Ceki Gülcü on 13/Jan/22 9:35 PM Resolution: (was: Fixed) Status: Reopened (was: Closed) ============================== 1 comment ------------------------------ Ceki Gülcü on 13/Jan/22 9:37 PM Changed the fixed tag to version 1.8.0-beta4. There was no 1.8.0-beta3 release. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-455: Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete...
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-455 [Resolved] Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete... ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-455 ============================== 1 comment ------------------------------ Neustradamus on 13/Jan/22 9:23 PM @ceki: Update Issue 430 and 431 with the good solved versions. Inform about the organization which manages CVEs to update the CVE-2018-8088: It has been solved in 1.7.26 and 1.8.0-beta4. You can inform too for: - Fix CVE-2021-4104 - Fix CVE-2019-17571 ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0