dependabot[bot] opened a new pull request, #12758: URL: https://github.com/apache/maven/pull/12758
Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.6.2 to 1.6.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-classic's releases</a>.</em></p> <blockquote> <h2>Logback 1.6.3</h2> <h1>2026-08-14 Release of logback version 1.6.3</h1> <ul> <li> <p>In response <a href="https://www.cve.org/cverecord?id=CVE-2026-19880";>CVE-2026-19880</a>, <code>MDCBasedDiscriminator</code> (used by <code>SiftingAppender</code>) now strips forward and backward slashes (<code>/</code>, <code>\</code>) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).</p> </li> <li> <p>Colour console support is split out into a dedicated <a href="https://logback.qos.ch/manual/appenders.html#JansiConsoleAppender";><code>JansiConsoleAppender</code></a>. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the <a href="https://logback.qos.ch/manual/appenders.html#JansiConsoleAppender";>appenders documentation</a>.</p> </li> <li> <p>The <code>withJansi</code> property on <code>ConsoleAppender</code> is <strong>deprecated</strong>. Existing configurations that still set <code><withJansi>true</withJansi></code> continue to work for compatibility, but new setups should use <code>JansiConsoleAppender</code> instead.</p> </li> <li> <p><code>ConsoleAppender</code> no longer treats the process console as an exclusive resource: stopping it does not close <code>System.out</code> / <code>System.err</code>. <code>JansiConsoleAppender</code> pairs each <code>AnsiConsole.systemInstall()</code> with <code>systemUninstall()</code> on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for <a href="https://redirect.github.com/qos-ch/logback/issues/1063";>issues/1063</a>.</p> </li> <li> <p>Invocation throttling helpers were reworked: <code>SimpleInvocationGate</code> is renamed <code>FixedIntervalInvocationGate</code>, and <code>BatchedFixedIntervalInvocationGate</code> allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.</p> </li> <li> <p>The JPMS <code>module-info</code> for logback-core now exports the <code>ch.qos.logback.core.property</code> package, which had been missing from the module descriptor.</p> </li> <li> <p>A bit-wise identical binary of this version can be reproduced by building from <a href="https://github.com/qos-ch/logback";>source code</a> at commit <code>e8e824dede022a6d7208b36cfa875b0d1b7772f3</code> associated with the tag <code>v_1.6.3</code>. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/qos-ch/logback/commit/e8e824dede022a6d7208b36cfa875b0d1b7772f3";><code>e8e824d</code></a> prepare release 1.6.3</li> <li><a href="https://github.com/qos-ch/logback/commit/761821bfaacac3a0ad44fa546cfc814429bf9312";><code>761821b</code></a> MDCBasedDiscriminator has a gated warning mechanism</li> <li><a href="https://github.com/qos-ch/logback/commit/53ed1229008d8b1902f5c234deaa07d742890879";><code>53ed122</code></a> update copyright year</li> <li><a href="https://github.com/qos-ch/logback/commit/c7e2db244671ffa916182b5da8c89579eb54a645";><code>c7e2db2</code></a> rename SimpleInvocationGate as FixedIntervalInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/b5aa931b096a4b0b6a9e140b74fabe7da152cbf0";><code>b5aa931</code></a> added BatchedSimpleInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/1f22af7686aadd25c08b4bd1e6943a906a743ad4";><code>1f22af7</code></a> add javadocs to SimpleInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/638ffa7e7852478b605a91b3e91238ff26f8158c";><code>638ffa7</code></a> prevent forward and backward slashes to escape to other directories</li> <li><a href="https://github.com/qos-ch/logback/commit/7d6b9a4f8c8996834c0a694f6c141705a003d7bb";><code>7d6b9a4</code></a> add missing ch.qos.logback.core.property package</li> <li><a href="https://github.com/qos-ch/logback/commit/fa25930346f35636fb6a077c1f66ebb06edd3b6f";><code>fa25930</code></a> add an extension path in ConsoleAppender for JansiConsoleAppender</li> <li><a href="https://github.com/qos-ch/logback/commit/c73b43f2011f9d4545abc7ea461172276a0a43b3";><code>c73b43f</code></a> deprecate the withJansi path</li> <li>Additional commits viewable in <a href="https://github.com/qos-ch/logback/compare/v_1.6.2...v_1.6.3";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
