| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: log4j-jcl | Distribution: openSUSE Tumbleweed |
| Version: 2.26.1 | Vendor: openSUSE |
| Release: 1.1 | Build date: Thu Jul 23 14:28:41 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 11358 | Source RPM: log4j-2.26.1-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: http://logging.apache.org/log4j | |
| Summary: Apache Log4j Commons Logging Bridge | |
Apache Log4j Commons Logging Bridge.
Apache-2.0
* Thu Jul 23 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.26.1
* Changed
+ Improve logging for LinkageError scenarios involving the LMAX
Disruptor library
* Fixed
+ Fix the createOnDemand behavior of RollingFileAppender to
correctly defer file and directory creation until the first
log event, while preserving eager creation when disabled
+ Improve documentation for locale handling in the Pattern
Layout date pattern converter
+ Fix handling of non-finite numbers while encoding MapMessage
to JSON
+ Fix encoding of MSGID and SD-ID fields of
StructuredDataMessage to XML
+ Fix stack trace rendering for exceptions with identity
malfunction (e.g., colliding equals() and/or hashCode()
implementations)
+ Fix resource leaks in ConfigurationSource when loading
configuration via URL fails
+ Fix KafkaAppender reporting error to error handler even after
a successful retry
- Generate META-INF/services files using bnd-maven-plugin
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.26.0
* Added
+ Add a new ConfigurationFactory::getConfiguration method
accepting multiple URIs
+ Add and export org.apache.logging.log4j.core.pattern
.NamedInstantPattern enabling users to programmatically access
named date & time patterns supported by Pattern Layout
+ Add log4j.plugin.processor.minAllowedMessageKind annotation
processor option to PluginProcessor to filter diagnostic
messages by severity. This allows builds that treat compiler
notes as errors (e.g. Maven with -Werror) to suppress
informational notes emitted during normal plugin processing
+ Add missing setters to Rfc5424LayoutBuilder
* Changed
+ Ensure scripts in the global Scripts element have explicit
names by throwing a ConfigurationException for unnamed ones
+ Simplify file manager registry factory methods
* Deprecated
+ Deprecated withers in builder classes in favor of setters.
This change improves API consistency with Log4j Core 3 and
helps users adapt to the upcoming changes
* Fixed
+ Fix script resolution failure when the Scripts element is
placed after a ScriptRef in the configuration
+ Fix ArrayIndexOutOfBoundsException thrown by
ThrowableStackTraceRenderer when the stack trace is modified
concurrently
+ Fix SLF4JLogger.atFatal() returning atLevel(Level.TRACE)
instead of atLevel(Level.FATAL). This was causing FATAL-level
log events to be silently discarded when using the fluent API
through the log4j-to-slf4j bridge
+ Fix Javadoc references across module boundaries (i.e.,
cross-references)
+ Fix header write in RollingRandomAccessFileManager that was
being incorrectly skipped if append=true and the file didn't
exist before
+ Fix a properties file configuration regression caused by not
referenced loggers, appenders, and filters
* Removed
+ Remove the jvmrunargs lookup.
* Updated
+ Update org.junit:junit-bom to version 5.13.4
+ Update org.mongodb:bson to version 5.6.1
+ Update org.xerial.snappy:snappy-java to version 1.1.10.8
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.25.4
* Fixed
+ Don't issue warnings if extra argument in parameterized
logging is null
+ Restore support for documented Rfc5424Layout parameter names
+ Take Throwable#toString() into account while rendering stack
traces in Pattern Layout
+ Added debug level logs for successful resource loading in
Loader class
+ Align SslConfiguration factory method usage with Log4j 2.12+
API. The verifyHostname attribute is now correctly recognized
(bsc#1262050, CVE-2026-34477)
+ Fix sanitization of structured data parameter names in RFC5424
layout
+ Replace invalid characters in XmlLayout output with the
Unicode replacement character (U+FFFD)
(bsc#1262092, CVE-2026-34480)
+ Replace invalid characters in Log4j1XmlLayout output with the
Unicode replacement character (U+FFFD)
(bsc#1262091, log4j-CVE-2026-34479)
+ Replace invalid characters in MapMessage.asXml() output with
the Unicode replacement character (U+FFFD)
+ Write non-finite floating-point numbers as strings in
JsonWriter (bsc#1262093, CVE-2026-34481)
- Removed patches:
* 0002-Remove-usage-of-toolchains.patch
* log4j-CVE-2026-34477.patch
* log4j-CVE-2026-34479.patch
* log4j-CVE-2026-34480.patch
* log4j-CVE-2026-34481.patch
* log4j-jackson-databind.patch
* logging-log4j-Remove-unsupported-EventDataConverter.patch
+ not needed with this version
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.25.3
* Changed
+ Optimize DefaultThreadContextMap.getCopy() performance by
avoiding megamorphic calls in HashMap constructor
* Fixed
+ Fix GraalVM metadata for nested classes to use binary names
instead of canonical names
+ Fix failures caused by null SslConfiguration
+ Fix incorrect handling of the host name verification in
SSL/TLS configuration, which is used by Socket Appender when
SSL/TLS is enabled (bsc#1255427, CVE-2025-68161)
* Removed
+ Remove the com.github.spotbugs:spotbugs-annotations dependency
- Removed patch:
* log4j-CVE-2025-68161.patch
+ not needed with this version
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.25.2
* Fixed
+ Fix potential memory leak involving LogBuilder in Log4j API to
Logback bridge
+ Prevent unnecessary warnings in
AbstractDriverManagerConnectionSource
+ Fix missing newlines in default logging configuration for
log4j-core
+ Fix missing default Target value in Console Appender
+ Discard the sub-second part while obtaining the initial time
(i.e., creation time) of a file in RollingFileManager
+ Fix Pattern Layout exception stack trace converters to no
longer prepend newlines based on context
+ Fix the com.google.errorprone:error_prone_annotations
dependency whose version property gets erased due to
flattening
+ Fix detection of Throwable converters inside nested Pattern
Layout patterns when applying alwaysWriteExceptions
+ Fix parsing and merging of literals in
InstantPatternDynamicFormatter
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.25.1
* Fixed
+ Fix detection of the Disruptor major version in environments
with non-standard thread context classloader
+ Downgrade spotbugs-annotations to resolve Gradle build
failures
+ Fix incorrect version resolution of jspecify and
error_prone_annotations dependencies in published POM files
+ Restore compatibility with Spring Boot by allowing
reconfiguration using the LoggerContext.start method
+ Allow omission of the -Alog4j.graalvm.groupId and
- Alog4j.graalvm.artifactId arguments when building Log4j
plugins
+ Broaden the OSGi manifest's Import-Package constraints to
support Jakarta Servlet API up to version 6.
+ Enable the resource: protocol for configuration files by
default when running on GraalVM.
+ Fix timestamp formatting concurrency issue, when
log4j2.enabledThreadlocals is true
+ Fix GraalVM reachability metadata generation for methods with
annotated array type parameters, such as @Nullable String[]
+ Resolve PropertiesConfiguration compatibility issues with
GraalVM and address additional minor reflection-related
problems
+ Fixes NullPointerException thrown by
ThrowableStackTraceRenderer when suppressed exceptions are
mutated concurrently
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.25.0
* Added
+ Add Google OSS-Fuzz integration
+ Add a GraalVmProcessor annotation processor to generate
GraalVM reachability metadata.
+ Add MonitorResource configuration option to support the
monitoring of external files in addition to the configuration
file itself.
+ Fixed typo in "LoggerConfig.RootLogger
.Builder#withtFilter(...)" method. Created new corrected
'withFilter()' method and deprecated old method.
+ Add collectionName and databaseName arguments to the MongoDB
appender
* Changed
+ Remove JAnsi library support. Windows 10 console has supported
ANSI escapes since 2017
+ Consolidate exception rendering logic and improve circular
reference support in Pattern Layout
+ Rewrite JAnsiTextRenderer to work without JAnsi library
+ Switch prefixing stack traces in Pattern Layout from
whitespace to newline
+ Changes the layout used by the default configuration.
+ Switch to using Java's DateTimeFormatter for date & time
formatting of log event instants
+ Switch the default exception converter from the extended
exception converter to the plain exception converter
+ Don't close StringReaders because of batching.
+ Switch prefixing stack traces in Status Logger from whitespace
to newline
+ The MongoDb Appender shouldn't log a deprecation warning,
+ Add improved validation to StringMatchFilter for null/empty
text
+ Currently Java 8 users do not have access to timestamps with
sub-millisecond precision. This change moves the SystemClock
implementation from log4j-core-java9 to log4j-core, overriding
the current one, so that java 8 users can benefit from it.
+ Don't overwrite configured configuration name if the
configuration has no loggers / no root logger.
+ Update GcpLayout.json JSON Template Layout event template to
support automatic timestamp recognition by the Google Cloud
Logging. This also changes exception, thread, logger fields,
and removes insertId field.
+ Have org.apache.logging.log4j.util.Base64Util invoke
java.util.Base64 directly instead of reflectively.
+ Improve implementations of LogEvent.toImmutable() and
ReusableMessage.memento() and remove usage of ThrowableProxy
* Deprecated
+ Deprecate ThrowableProxy and all its usages
+ Deprecate AbstractLogger.checkMessageFactory(), since all
created Loggers are already MessageFactory-namespaced
+ Deprecated FixedDateTime, FastDateTime, and supporting classes
+ Use hard references to Loggers in LoggerRegistry
* Fixed
+ Switch MongoDB tests to use Docker.
+ Add a Jakarta-based JMS Appender module log4j-jakarta-jms and
deprecate the Javax version
+ Fix RollingFileManager to reopen the log file when the
rollover was unsuccessful
+ Fix certain exception rendering issues in Pattern Layout
+ Reload key & trust stores while reconfiguring network
appenders containing a TLS (formerly known as SSL)
configuration
+ Simplify the SSLContext instantiation for the TLS (formerly
known as SSL) configuration
+ Adding a compilation warning for Plugin Builder Attributes
that do not have a public setter.
+ Fix reloading of the configuration from an HTTP(S) source
+ Fix putAll() in the default thread context map implementation
+ Improves validation of HTTP Appender.
+ Fix getLogger() source incompatibility in Log4j 1 to Log4j 2
API Bridge (i.e., log4j-1.2-api)
+ Fix property extraction from the root exception in Pattern
Layout
+ Fix key removal issues in Thread Context
+ Fix Android-related issues in Log4j Core.
+ Fix the leak of non-Log4j dependencies in log4j-bom
+ Fix the conversion of o.a.l.Priority classes to Log4j 2 levels
+ Ensures synchronization between j.u.l.Logger.getLevel() and
j.u.l.Logger.setLevel() methods.
+ Add improved validation to AsyncWaitStrategyFactoryConfig for
null/empty factoryClassName.
+ Fix NullPointerException when using rootLogger = LEVEL
shorthand in properties without appender.
+ Fix ArrayIndexOutOfBoundsException in JSON Template Layout
truncated exception resolver
+ Properly handle null 'replacement' parameter in
RegexReplacement#createRegexReplacement.
+ Fix detection of location requirements in AsyncAppender.
+ Fix detection of location requirements in FailoverAppender.
+ Corrected @return javadoc for AbstractFilterable#isFiltered()
+ TypeConverters convert for "Level" incorrectly documented
behaviour for invalid value - updated javadoc.
+ Fix loading of the effective RecyclerFactoryConverter in JSON
Template Layout
+ Minimize lock usage in InternalLoggerRegistry.
+ Improved expunging of stale entries in InternalLoggerRegistry
to prevent potential memory leaks
+ Make annotation libraries visible transitively at compile time
for Gradle users through Gradle Module Metadata and for JPMS
users through requires static directives in module-info.java
files
+ Fix shutdownDisable configuration does not take effect
+ Fix ArrayIndexOutOfBoundsException on
StatusData#getFormattedStatus.
+ Deprecate or remove static hiding methods.
+ Verify the capability of SecurityManager so that platforms not
(fully) supporting it will not poison the stack trace
+ Improve performance and avoid memory consumption if logging
primitive arrays as parameters
+ Fix ArrayIndexOutOfBoundsException on invocation of Message
.getFormattedMessage() when any thread has no stack trace,
which occurs on some JVM implementations
+ StatusLogger now writes to standard error by default. This
fixes a regression introduced in 2.23.0
+ The ReadOnlyStringMap implementations now support equality
comparisons against each other
+ Fixes OSGi descriptor to accept Disruptor 4
+ Avoid surrogate character handling in JsonWriter
* Removed
+ Remove support for the {ansi} option in Pattern Layout
exception converters
* Updated
+ Update actions/stale to version 9.1.0
+ Update ch.qos.logback:logback-core to version 1.3.15
+ Update com.fasterxml.jackson:jackson-bom to version 2.19.0
+ Update com.github.spotbugs:spotbugs-annotations to version
4.9.3
+ Update io.fabric8:docker-maven-plugin to version 0.46.0
+ Update org.apache.cassandra:cassandra-all to version 3.11.19
+ Update org.apache.commons:commons-csv to version 1.14.0
+ Update org.apache.commons:commons-dbcp2 to version 2.13.0
+ Update org.apache.commons:commons-pool2 to version 2.12.1
+ Update org.apache.kafka:kafka-clients to version 3.9.1
+ Update org.apache.logging:logging-parent to version 12.1.1
+ Update org.apache.tomcat:tomcat-juli to version 10.1.30
+ Update org.eclipse.jetty:jetty-util to version
9.4.57.v20241219
+ Update org.jmdns:jmdns to version 3.6.1
+ Update org.mongodb:bson to version 5.5.1
+ Update org.slf4j:slf4j-api to version 2.0.17
+ Update org.springframework.cloud:spring-cloud-context to
version 4.3.0
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.24.3
* Fixed
+ Fix ConcurrentModificationException, if multiple threads
modify loggers concurrently. This bug affects users that
modify logger levels programmatically
+ Fix for RegexCreator NPE, the constructor expects a boolean
primitive, but the createFilter static method was boxed.
Fixed that to remove the NPE issues
+ Protects PropertiesUtil against property sources that call
PropertiesUtil recursively. In some cases such a property
source can even cause deadlocks
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.24.2
* Fixed
+ Fix key removal issues in Thread Context
+ Use hard references to Loggers in LoggerRegistry
+ Fix ArrayIndexOutOfBoundsException in JSON Template Layout
truncated exception resolver
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.24.1
* Changed
+ Rework LoggerRegistry to make it MessageFactory-namespaced.
This effectively allows loggers of same name, but different
message factory
+ Enable Docker-based tests in CI for JSON Template Layout
* Fixed
+ Switch MongoDB tests to use Docker.
+ Fix reloading of the configuration from an HTTP(S) source
+ Fix putAll() in the default thread context map implementation
* Updated
+ Update org.apache.logging:logging-parent to version 11.3.0
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.24.0
* Added
+ Add a faster DefaultThreadContextMap implementation
+ Add Logback throwable-consuming semantics as an option in
log4j-slf4j-impl and log4j-slf4j2-impl. Users can enable it by
setting the property log4j2.messageFactory to org.apache
.logging.slf4j.message.ThrowableConsumingMessageFactory
+ Add trace context fields to GcpLayout.json
+ Add "Plugin Reference" to the website. It is a
Javadoc-on-steroids focusing on Log4j plugins
+ Automate website deployment using the new CI infrastructure
shipped with org.apache.logging:logging-parent:11.0.0
* Changed
+ Fix usage of log4j-api in GraalVM without additional
reachability data
+ Ignore exceptions thrown by PropertySources
+ Add logging to PropertiesUtil and fix Duration parser
+ Disable level modification via JUL by default
+ Centralize initialization in the Provider class and deprecate
the log4j2.loggerContextFactory property
+ Remove log4j-kubernetes lookup. User should migrate to
io.fabric8:kubernetes-log4j
+ Disable JMX support by default. Requires log4j2.disableJmx to
be set to false to enable JMX support
+ Replace some usages of DateTimeFormatter#toString() with
DateTimeFormatter#formatTo(StringBuilder) to cut down on
allocations
+ Disable programmatic configuration in Log4j 1 Bridge if
log4j1.compatibility is false
+ Improve missing plugin descriptor warnings
+ Remove configuration properties caching and (undocumented)
fuzzy property name matching
+ Fixes property source ordering to account for different
sources with the same priority
+ Prioritize user-defined values of log4j2.enableThreadlocals,
log4j2.garbagefreeThreadContextMap and
log4j2.shutdownHookEnabled over the value of log4j2.isWebapp
+ Disallow duplicate keys in JSON Template Layout templates
+ Deprecate log4j2.defaultStatusLevel property in Log4j Core in
favor of log4j2.statusLoggerLevel
* Deprecated
+ Deprecate Message#getFormat() due to unclear semantics and
inconsistent implementations
+ Deprecate org.apache.logging.log4j.EventLogger for removal
+ Deprecate org.apache.logging.log4j.core.appender.rolling
.action.Duration class for removal
+ Deprecate the log4j-mongodb4 module in favor of log4j-mongodb
* Fixed
+ Use FQDN in RFC5424 Layout
+ Fix custom thread-context data provider handling in lookups
and filters
+ Fix handling of log4j2.messageFactory and
log4j2.flowMessageFactory properties
+ Discard blank keys in PropertiesUtil
+ Fix handling of log4j2.debug
+ Fix location requirement for the %F and %file keys in Pattern
Layout
+ Fix JsonLayout failure under JPMS
+ Fix empty string handling for TruncatingBufferedWriter
+ Fix that parameterized message formatting throws an exception
when there are insufficient number of parameters. It
previously simply didn't replace the '{}' sequence. The
behavior changed in 2.21.0 and should be restored for backward
compatibility
+ Fix ClassCastException in LMAX Disruptor 3 initialization
+ Fix requirement on the java.management module when JMX is
disabled, which is the default
+ Website is migrated to Antora with several formatting and link
fixes
* Removed
+ Move Flume Appender to its own release lifecycle
* Updated
+ Add module log4j-mongodb to track the current MongoDB driver
(currently version 5)
+ Remove module log4j-mongodb3, use log4j-mongodb instead,
log4j-mongodb4 is deprecated for removal
+ Update com.fasterxml.jackson:jackson-bom to version 2.17.2
+ Update com.github.luben:zstd-jni to version 1.5.6-5
+ Update commons-codec:commons-codec to version 1.17.1
+ Update commons-logging:commons-logging to version 1.3.4
+ Update github/codeql-action to version 3.25.1
+ Update io.fabric8:docker-maven-plugin to version 0.45.0
+ Update org.apache.cassandra:cassandra-all to version 3.11.17
+ Update org.apache.commons:commons-compress to version 1.27.1
+ Update org.apache.commons:commons-csv to version 1.11.0
+ Update org.apache.commons:commons-lang3 to version 3.17.0
+ Update org.apache.kafka:kafka-clients to version 3.8.0
+ Update org.apache.logging:logging-parent to version 11.2.0
+ Update org.eclipse.jetty:jetty-bom to version 9.4.56.v20240826
+ Update org.jctools:jctools-core to version 4.0.5
+ Update log4j-mongodb4 org.mongodb:* from 4.11.1 to 4.11.2
+ Update org.mongodb:bson to version 4.11.4
+ Update org.slf4j:slf4j-api to version 2.0.16
+ Update org.springframework:spring-framework-bom to version
5.3.39
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.23.1
* Changed
+ Fix handling of LoggerContextAware lookups
+ Fix NPE in PatternProcessor for a UNIX_MILLIS pattern
+ Improve performance of CloseableThreadContext#closeMap()
* Fixed
+ Fix that parameterized message formatting doesn't throw an
exception when there are insufficient number of parameters
+ Fix StatusLogger log level filtering when debug mode is
enabled
+ Add log4j2.statusLoggerDateFormatZone system property to set
the time-zone StatusLogger uses to format java.time.Instant.
Without this, formatting patterns accessing to
time-zone-specific fields (e.g., year-of-era) cause failures.
+ Fix StatusLogger to correctly read
log4j2.StatusLogger.properties resource
+ Fix stack overflow in StatusLogger
* Updated
+ Update jakarta.activation:jakarta.activation-api to version
2.1.3
+ Update jakarta.mail:jakarta.mail-api to version 2.1.3
+ Update org.apache.commons:commons-compress to version 1.26.0
+ Update org.apache.commons:commons-dbcp2 to version 2.12.0
+ Update org.apache.kafka:kafka-clients to version 3.7.0
+ Update org.eclipse.angus:angus-activation to version 2.0.2
+ Update org.eclipse.angus:jakarta.mail to version 2.0.3
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.23.0
* Added
+ Added support for LMAX Disruptor 4.x
* Changed
+ Make StatusLogger self-contained and testable
+ Simplify BND configuration after upgrade from version 6.4.1 to
7.0.0
* Deprecated
+ Deprecate the configuration attribute verbose (i.e.,
<Configuration verbose="...") and StatusConsoleListener filters
+ Deprecated the RingBufferLogEventHandler class for removal
from the public API in 3.x
* Fixed
+ Fix regression in JdkMapAdapterStringMap performance
+ Fix the behavior of Logger#setLevel and Logger#getLevel in the
Log4j 1.2 bridge
+ Fix the behavior of CoreLogger#getLevel and
CoreLogger#setLevel in the log4j-jul module
+ Allow deserialization of all arrays of allowed classes
+ Allow the <Properties> node to appear in any position in the
configuration element
+ Fix forgotten threadName field in RingBufferLogEvent#clear()
+ Fix StringBuilder cache corruption on recursive access
+ Fixed use of SecurityManager in LoaderUtil where
AccessController::doPrivileged should only be invoked when a
SecurityManager is installed. Some runtimes do not seem to
have this method available
+ Fix log4j-spring-cloud-config-client dependencies to include
only those required
+ Fix typo in Kubernetes clientKeyData configuration property
* Updated
+ Update com.fasterxml.jackson:jackson-bom to version 2.16.1
+ Update commons-codec:commons-codec to version 1.16.1
+ Update io.netty:netty-bom to version 4.1.107.Final
+ Update org.apache.logging:logging-parent to version 10.6.0
+ Update org.eclipse.jetty:jetty-bom to version 9.4.54.v20240208
+ Update org.jctools:jctools-core to version 4.0.3
+ Update org.springframework:spring-framework-bom to version
5.3.32
+ Update org.zeromq:jeromq to version 0.6.0
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.22.1
* Fixed
+ Mark JdkMapAdapterStringMap as frozen if map is immutable
+ Fix NPE in CloseableThreadContext
+ Use the module name of Conversant Media Disruptor from
version 1.2.16+ of the library
+ Fix NPE in RollingFileManager
+ Fix log4j-to-slf4j JPMS and OSGi descriptors
+ Workaround a Coursier/Ivy dependency resolution bug affecting
log4j-slf4j-impl and log4j-mongodb3
* Updated
+ Bumped the minimum Java version required for the build to
Java 17. Runtime requirements remain unchanged
+ Update com.github.luben:zstd-jni to version 1.5.5-11
+ Update com.google.guava:guava to version 33.0.0-jre
+ Update commons-codec:commons-codec to version 1.16.0
+ Update commons-io:commons-io to version 2.15.1
+ Update commons-logging:commons-logging to version 1.3.0
+ Update io.netty:netty-bom to version 4.1.104.Final
+ Update org.apache.commons:commons-compress to version 1.25.0
+ Update org.apache.commons:commons-dbcp2 to version 2.11.0
+ Update org.apache.commons:commons-lang3 to version 3.14.0
+ Update org.apache.commons:commons-pool2 to version 2.12.0
+ Update org.apache.kafka:kafka-clients to version 3.6.1
+ Update org.apache.logging:logging-parent to version 10.5.0
+ Update org.jctools:jctools-core to version 4.0.2
+ Update org.springframework.boot:spring-boot to version 2.7.18
+ Update org.springframework.cloud:spring-cloud-dependencies to
version 2021.0.9
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.22.0
* Changed
+ Change the order of evaluation of FormattedMessage formatters.
Messages are evaluated using java.util.Format only if they
don't comply to the java.text.MessageFormat or
ParameterizedMessage format
+ Change default encoding of HTTP Basic Authentication to UTF-8
and add log4j2.configurationAuthorizationEncoding property to
overwrite it
* Fixed
+ Harden deserialization process by requiring the usage of
FilteredObjectInputStream on Java 8 and ObjectInputFilter on
Java 9+ to deserialize custom classes
+ Fix MDC pattern converter causing issues for %notEmpty
+ Export missing OSGi & JPMS modules in
log4j-layout-template-json and log4j-1.2-api
+ Fix spring-test dependency scope change
+ Fix JPMS descriptors causing jlink issues
+ Add missing Implementation- and Specification- entries to
MANIFEST.MF (implemented by logging-parent version 10.3.0
update)
+ Fix NotSerializableException thrown when Logger is serialized
with a ReusableMessageFactory
* Removed
+ Removed unused FastDateParser which was causing unnecessary
heap overhead
* Updated
+ Update com.fasterxml.jackson:jackson-bom to version 2.16.0
+ Update com.github.luben:zstd-jni to version 1.5.5-10
+ Update com.google.guava:guava to version 32.1.3-jre
+ Update io.netty:netty-bom to version 4.1.101.Final
+ Update org.eclipse.persistence:org.eclipse.persistence.jpa to
version 2.7.13
+ Update org.fusesource.jansi:jansi to version 2.4.1
+ Update org.mongodb:bson to version 4.11.1
+ Update org.springframework:spring-framework-bom to version
5.3.30
+ Update org.springframework.boot:spring-boot to version 2.7.17
+ Update org.springframework:spring-framework-bom to version
5.3.31
+ Update org.zeromq:jeromq to version 0.5.4
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.21.1
* Fixed
+ Fixes the Apache Commons Logging (JCL) bridge: log4j-jcl
* Tue Jun 16 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.21.0
* Added
+ Added marker parent support to JsonTemplateLayout
+ Added ZStandard compression support
+ Added a warning for incorrect syntax of highlighting styles
* Changed
+ Open FileExtension methods to allow their usage in custom
RolloverStrategys
+ Bumped the minimum Java version required for the build to
JDK 11. Runtime requirements remain unchanged
+ Set the default minLevel and maxLevel of LevelRangeFilter to
OFF and ALL, respectively
+ Removed additional isFiltered checks in AsyncLoggerConfig
+ Use Java version-specific warnings in StackLocator
+ Started logging a status error event instead of an NPE in
OsgiServiceLocator.loadServices(Class, Lookup, boolean) when a
bundle has no valid BundleContext for a service type
+ Implemented a CI-based release process
* Fixed
+ Added validation to rolling file manager path conditions
+ Adapted the OSGi metadata of log4j-to-slf4j to work with
SLF4J 1 and 2. To achieve that used a version range of [1.7,3)
for the imported SLF4J packages
+ Fixed Javadoc failures
+ Removed locale-dependent toLowerCase/toUpperCase calls
+ Redirected old /<module>/apidocs URLs
+ Added environment variable arbiter
+ Fixed logging of java.sql.Date objects by appending it before
Log4J tries to call java.util.Date.toInstant() on it
+ Adapted the OSGi metadata of log4j-api, log4j-core,
log4j-slf4j-impl and log4j-slf4j2-impl to activate the bundle
when it is accessed. To achieve that set the
Bundle-ActivationPolicy to lazy for the log4j bundles
+ Avoided using released objects in StackTraceStringResolver of
JsonTemplateLayout
+ Added missing setter for connectionStringSource in
MongoDb4Provider builder
+ Fixed NPE in PluginElementVisitor
+ Added columnType as alias for the column mapping type attribute
+ Restored Log4jMarker visibility in SLF4J adapters
+ Fixed buffer size in Log4jFixedFormatter date time formatter
+ Fixed the propagation of synchronous action failures in
RollingFileManager and FileRenameAction
+ Fixed RollingFileManager to propagate failed synchronous
actions correctly
+ Replaced the usage of System.out in StackLocator for warnings
with System.err
+ Fixed concurrent date-time formatting issue in PatternLayout
+ Fixed runtime dependencies documentation
+ Allowed to override FQCN in Log4jEventBuilder by implementing
CallerBoundaryAware
+ Migrated MongoDB tests to JUnit 5 and Flapdoodle Embedded
MongoDB 4
+ Rewrote message parameter formatter with improved escape
handling
+ Improved formatting and serialization of StackTraceElement on
JDK 9+
+ Fixed MemoryMappedFileAppender buffer unmapping on JRE 9+
+ Fixed rollover strategy in the Log4j 1.x compatibility layer
+ Removed incorrect mention of base64 lookup and improve the
rest of the lookup manual
+ Implemented LocationAware for JsonTemplateLayout, since this
was causing location not being passed to underlying appenders
+ Added support for long values in MongoDb 4 appender to
configure collectionSize
+ Only shutdown Log4j after last Log4jServletContextListener is
executed
+ Allowed using Spring Arbiter without a Spring environment
+ Fixed context data loss if <AsyncLogger> components are used
with an all async logger context
+ Fixed JsonTemplateLayout NPE thrown on custom log levels
+ Improved Log4j-config.xsd schema
+ Fixed NPE in ContextSelector
+ Avoided allocating ThreadLocals in AbstractLogger when they
are disabled, since this was causing memory leaks due to
retained reference to class loaders in web applications
+ Fixed %notEmpty directive of PatternLayout for empty MDC/NDC
inputs
+ Fixed file descriptor leak on Tomcat
+ Ensured FileOutputStream is closed in CommonsCompressAction
.execute()
* Removed
+ Moved log4j-jmx-gui to its own repository along with its own
release cycle
* Updated
+ Update Eclipse Angus Activation to version 2.0.1
+ Update Eclipse Angus Mail to version 2.0.2
+ Update com.datastax.cassandra:cassandra-driver-core to version
3.11.5
+ Update Apache Cassandra to version 3.11.16
+ Update Apache Commons Compress to version 1.24.0
+ Update Apache Commons CSV to version 1.10.0
+ Update Jackson to version 2.15.2
+ Update Jakarta Activation API to version 2.1.2
+ Update Jakarta Mail API to version 2.1.2
+ Update JCTools to version 4.0.1
+ Update Apache Kafka to version 3.4.0
+ Update Kubernetes client to version 5.12.4
+ Update org.mongodb:mongodb-driver-core to version 4.10.2
+ Update io.netty:netty-bom to version 4.1.97
+ Update Spring Boot to version 2.7.15
+ Update Spring Framework to version 5.3.29
+ Update Tomcat JULI to version 10.0.27
+ Update Woodstox to version 6.5.1
* Tue Apr 14 2026 Fridrich Strba <fstrba@suse.com>
- Added patches:
* log4j-CVE-2026-34479.patch
+ backported upstream fix for bsc#1262091 (CVE-2026-34479):
log processing denial of service due to improper XML escaping
* log4j-CVE-2026-34480.patch
+ backported upstream fix for bsc#1262092 (CVE-2026-34480):
invalid XML output causes denial of service in logging
* log4j-CVE-2026-34481.patch
+ backported upstream fix for bsc#1262093 (CVE-2026-34481):
denial of service via invalid JSON output
* Tue Apr 14 2026 Fridrich Strba <fstrba@suse.com>
- Added patch:
* log4j-CVE-2026-34477.patch
+ backported upstream fix for bsc#1262050 (CVE-2026-34477):
man-in-the-middle attack due to incomplete hostname
verification
* Mon Jan 05 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.18.0
* Added
+ Add support for Jakarta Mail API in the SMTP appender.
+ Add support for custom Log4j 1.x levels.
+ Add support for adding and retrieving appenders in Log4j 1.x
bridge.
+ Add support for custom LMAX disruptor WaitStrategy
configuration.
+ Add support for Apache Extras' RollingFileAppender in Log4j
1.x bridge.
+ Add MutableThreadContextMapFilter.
+ Add support for 24 colors in highlighting
* Changed
+ Improves ServiceLoader support on servlet containers.
+ Make the default disruptor WaitStrategy used by Async Loggers
garbage-free.
+ Do not throw UnsupportedOperationException when JUL
ApiLogger::setLevel is called.
+ Support Spring 2.6.x.
+ Move perf tests to log4j-core-its
+ Upgrade the Flume Appender to Flume 1.10.0
* Fixed
+ Fix minor typo #792.
+ Improve validation and reporting of configuration errors.
+ Allow enterprise id to be an OID fragment.
+ Fix problem with non-uppercase custom levels.
+ Avoid ClassCastException in JeroMqManager with custom
LoggerContextFactory #791.
+ DirectWriteRolloverStrategy should use the current time when
creating files.
+ Fixes the syslog appender in Log4j 1.x bridge, when used with
a custom layout.
+ log4j-1.2-api 2.17.2 throws NullPointerException while
removing appender with name as null.
+ Improve JsonTemplateLayout performance.
+ Fix resolution of non-Log4j properties.
+ Fixes Spring Boot logging system registration in a
multi-application environment.
+ JAR file containing Log4j configuration isn't closed.
+ Properties defined in configuration using a value attribute
(as opposed to element) are read correctly.
+ Syslog appender lacks the SocketOptions setting.
+ Log4j 1.2 bridge should not wrap components unnecessarily.
+ Update 3rd party dependencies for 2.18.0.
+ SizeBasedTriggeringPolicy would fail to rename files properly
when integer pattern contained a leading zero.
+ Fixes default SslConfiguration, when a custom keystore is
used.
+ Fixes appender concurrency problems in Log4j 1.x bridge.
+ Fix and test for race condition in FileUtils.mkdir().
+ LocalizedMessage logs misleading errors on the console.
+ Add missing message parameterization in RegexFilter.
+ Add the missing context stack to JsonLayout template.
+ HttpWatcher did not pass credentials when polling.
+ UrlConnectionFactory.createConnection now accepts an
AuthorizationProvider as a parameter.
+ The DirectWriteRolloverStrategy was not detecting the correct
index to use during startup.
+ Async Loggers were including the location information by
default.
+ ClassArbiter's newBuilder method referenced the wrong class.
+ Don't use Paths.get() to avoid circular file systems.
+ Fix parsing error, when XInclude is disabled.
+ Fix LevelRangeFilterBuilder to align with log4j1's behavior.
+ Fixes problem with wrong ANSI escape code for bright colors
+ Log4j 1.2 bridge should generate Log4j 2.x messages based on
the parameter runtime type.
- Update to 2.19.0
* Added
+ Add implementation of SLF4J2 fluent API.
+ Add support for SLF4J2 stack-valued MDC.
* Changed
+ Add getExplicitLevel method to LoggerConfig.
+ Allow PropertySources to be added.
+ Allow Plugins to be injected with the LoggerContext reference.
* Fixed
+ Add correct manifest entries for OSGi to log4j-jcl
+ Improve support for passwordless keystores.
+ SystemPropertyArbiter was assigning the value as the name.
+ Make JsonTemplateLayout stack trace truncation operate for
each label block.
+ Fix recursion between Log4j 1.2 LogManager and Category.
+ Fix resolution of properties not starting with log4j2..
+ Logger$PrivateConfig.filter(Level, Marker, String) was
allocating empty varargs array.
+ Allows a space separated list of style specifiers in the
%style pattern for consistency with %highlight.
+ Fix NPE in log4j-to-jul in the case the root logger level is
null.
+ Fix RollingRandomAccessFileAppender with
DirectWriteRolloverStrategy can't create the first log file of
different directory.
+ Generate new SSL certs for testing.
+ Fix ServiceLoaderUtil behavior in the presence of a
SecurityManager.
+ Fix regression in Rfc5424Layout default values.
+ Harden InstantFormatter against delegate failures.
+ Add async support to Log4jServletFilter.
* Removed
+ Removed build page in favor of a single build instructions
file.
+ Remove SLF4J 1.8.x binding.
- Update to 2.20.0
* Added
+ Add support for timezones in RollingFileAppender date pattern
+ Add LogEvent timestamp to ProducerRecord in KafkaAppender
+ Add PatternLayout support for abbreviating the name of all
logger components except the 2 rightmost
+ Removes internal field that leaked into public API.
+ Add a LogBuilder#logAndGet() method to emulate the
Logger#traceEntry method.
* Changed
+ Simplify site generation
+ Switch the issue tracker from JIRA to GitHub Issues
+ Remove liquibase-log4j2 maven module
+ Fix order of stacktrace elements, that causes cache misses in
ThrowableProxyHelper.
+ Switch from com.sun.mail to Eclipse Angus.
+ Add Log4j2 Core as default runtime dependency of the
SLF4J2-to-Log4j2 API bridge.
+ Replace maven-changes-plugin with a custom changelog
implementation
+ Moved log4j-api and log4j-core artifacts with classifier tests
to log4j-api-test and log4j-core-test respectively.
* Deprecated
+ Deprecate support for package scanning for plugins
* Fixed
+ Copy programmatically supplied location even if
includeLocation="false".
+ Eliminate status logger warning, when disableAnsi or
noConsoleNoAnsi is used the style and highlight patterns.
+ Fix detection of location requirements in RewriteAppender.
+ Replace regex with manual code to escape characters in
Rfc5424Layout.
+ Fix java.sql.Time object formatting in MapMessage
+ Fix previous fire time computation in CronTriggeringPolicy
+ Correct default to not include location for AsyncRootLoggers
+ Make StatusConsoleListener use SimpleLogger internally.
+ Lazily evaluate the level of a SLF4J LogEventBuilder
+ Fixes priority of Legacy system properties, which are now back
to having higher priority than Environment variables.
+ Protects ServiceLoaderUtil from unchecked ServiceLoader
exceptions.
+ Fix Configurator#setLevel for internal classes
+ Fix level propagation in Log4jBridgeHandler
+ Disable OsgiServiceLocator if not running in OSGI container.
+ When using a Date Lookup in the file pattern the current time
should be used.
+ Fixed LogBuilder filtering in the presence of global filters.
- Removed patch:
* log4j-java8compat.patch
+ not needed with this version
- Modified patch:
* logging-log4j-Remove-unsupported-EventDataConverter.patch
+ rediff
- Added patch:
* 0002-Remove-usage-of-toolchains.patch
+ do not use the maven-toolchains-plugin
* log4j-CVE-2025-68161.patch
+ bsc#1255427, CVE-2025-68161: absent TLS hostname verification
may allow a man-in-the-middle attack
* Fri Oct 11 2024 Fridrich Strba <fstrba@suse.com>
- Build the extra modules even for SLE
* Mon Apr 29 2024 Fridrich Strba <fstrba@suse.com>
- The binaries are compatible with java 1.8
- Fetch newer upstream keyring
* Sun Mar 10 2024 Fridrich Strba <fstrba@suse.com>
- Added patch:
* log4j-jackson-databind.patch
+ do not use previously deprecated methods, removed in
jackson-databind 2.16.x
/usr/share/java/log4j /usr/share/java/log4j/log4j-jcl.jar /usr/share/maven-metadata/log4j-jcl.xml /usr/share/maven-poms/log4j /usr/share/maven-poms/log4j/log4j-jcl.pom
Generated by rpm2html 1.8.1
Fabrice Bellet, Mon Aug 3 00:04:55 2026