Repository navigation
Leave the logback version to the application, update dependencies - #40
Merged
Merged
Conversation
logback-classic becomes a provided dependency: an application using a logback appender brings its own logback, and the compile-scope 1.2.11 used to win Maven's nearest-first resolution in projects without dependency management, downgrading them to a logback line with published CVEs and making Quarkus' logback extension refuse to build. It is compiled against 1.2.13, the last 1.2.x, to keep supporting Java 8 and logback 1.2 at runtime. jackson-databind goes from 2.13.5 to 2.22.3, which still targets Java 8, and the examples use current logback, Jackson and SLF4J versions (logback 1.5 needs Java 11). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PetrHeinz
marked this pull request as ready for review
September 29, 2026 10:25
PetrHeinz
changed the title
Brings the branch up to the 0.3.9 changes on main before the examples are touched again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`debug="true"` prints logback's whole configuration status on every start, and on logback 1.3 and newer, which the examples now use, that status includes every substituted `${...}` value: a source token moved into an environment variable would end up on stdout. Logback still prints the status on its own whenever there is a warning or an error.
The READMEs say that the examples need Java 11 for logback 1.5, what to change on Java 8, and that an application declares logback itself.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
main now carries the v0.3.9 version commit. examples/gradle/build.gradle keeps logback-logtail 0.3.9 from main and this branch's logback, Jackson and SLF4J versions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
logback-classic1.2.11 andjackson-databind2.13.5 were compile dependencies. Maven picks the nearest declaration, so a project without dependency management whose own logback comes in deeper (a starter, an extension) ended up on logback 1.2.11. Measured with 0.3.8: a Quarkus 3.33 app with quarkus-logging-logback failed to build ("ch.qos.logback:logback-core version 1.2.11 is not compatible with quarkus-logback which requires at least 1.5.33"). OSV lists CVE-2023-6378 (high) for logback-classic 1.2.11, 7 advisories for logback-core 1.2.11 and 5 for jackson-databind 2.13.5 (two high), and the examples told users to add exactly those versions.logback-classicis nowprovided: the application brings its own logback, as every application configuring a logback appender does and as the docs and examples already ask. It is compiled against 1.2.13, the last 1.2.x, so Java 8 and logback 1.2 stay supported at runtime. Applications that only declaredlogback-logtailand relied on it for logback now need to declarelogback-classicthemselves. They find out right away: their build fails with "package org.slf4j does not exist", or, if they declareslf4j-apion its own, SLF4J prints "No SLF4J providers were found" at startup (both checked with a throwaway consumer project). Without dependency management, a project whose logback comes in throughspring-boot-starter-logging3.5.16 resolved logback-classic 1.2.11 with 0.3.8 and keeps the starter's 1.5.34 now, and the Quarkus app above builds without pinning logback at all.jackson-databindgoes to 2.22.3, which still targets Java 8 (class file version 52) and has none of those advisories. The suite passes unchanged.debug="true": on logback 1.3 and newer it prints every substituted${…}value at startup, a source token kept in an environment variable included. Their READMEs say that they need Java 11 for logback 1.5, what to change on Java 8, and that an application declares logback itself.The dependency change may deserve a minor version rather than a patch.
🤖 Generated with Claude Code