rv602 opened a new pull request, #4251: URL: https://github.com/apache/logging-log4j2/pull/4251
## ⚠️ Hackathon proof — not intended for merge This draft PR documents an **internal Forge modernization hackathon** run against Log4j 2.x. It is **not** proposed as an upstream contribution. Please do not review for merge. **Branch:** [`rv602/logging-log4j2@feat/forge-modernization-swarm`](https://github.com/rv602/logging-log4j2/tree/feat/forge-modernization-swarm) **Forge project:** Log4j Modernization — **62/62 work orders completed** (WO-001–063; WO-020 did not exist in the generated backlog and was waived where referenced) ## Summary End-to-end modernization backlog executed via Forge-generated work orders: - **TrustGate** — `InputSanitizer` SPI, validation rules, fail-closed defaults, wiring into JNDI / config URI / `StrSubstitutor` / 1.x bridge, ArchUnit + CVE regression + JMH - **SPI / layers** — `config-spi`, `log4j-common`, util/config strangler facades, Watcher/Clock SPI extraction, `banCircularDependencies` + `dependencyConvergence` enforcer + CI gates - **Jakarta** — `log4j-jakarta-jpa`, JPMS descriptors, namespace CI validation, migration guide, OSGi fragment smoke tests - **Spring Boot 3** — Boot **3.5.16** / Framework **6.2.19** / Cloud **4.3.3**, Java 17 for Spring modules, AutoConfiguration.imports, API + JUnit 5 test migration, migration docs - **Deps / CI** — Mockito 5.x, WireMock 3.x, JDK matrix 17/21/25, OWASP dependency-check, japicmp, build-time + test-pass monitoring - **Release / docs** — modernization release notes, compatibility-breaks page, Antora architecture + TrustGate docs **Diff scale:** ~63 commits · ~328 files · +20k / −0.6k lines (vs `2.x`) ## Checklist (template) * Base branch is `2.x` * `./mvnw verify` — **not** claimed green for the full reactor on this branch (pragmatic hackathon scope; local JDK/enforcer caveats remain) * Changelog entries added under `src/changelog/.2.x.x/` for modernization themes * Tests added for TrustGate, ArchUnit, Spring modules, Jakarta smoke, OSGi fragment install, core-its integration smoke ## Known caveats (pragmatic scope) - WO-014/015 are **strangler facades**, not a full 80% ArchUnit util↔config cut - WO-061 E2E is TrustGate + Jakarta **smoke** (no embedded Artemis/H2/SMTP brokers) - WO-042 OSGi coverage is fragment **install/manifest** smoke; full host-attach blocked until TrustGate SPI package is exported for OSGi - Intentional japicmp exclusions for SPI moves documented in `compatibility-breaks.adoc` ## Test plan - [ ] Spot-check TrustGate CVE regression + ArchUnit invocation tests - [ ] `./mvnw validate` (circular deps + convergence) - [ ] Spring module tests: `log4j-spring-boot`, `log4j-spring-cloud-config-client` - [ ] Jakarta namespace script / OSGi fragment install smoke - [ ] japicmp job / binary-compatibility CI path --- *Opened as a draft solely as hackathon evidence. Maintainers can close without review.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
