This is an automated email from the ASF dual-hosted git repository. wu-sheng pushed a commit to branch fix/provider-logback-core-match in repository https://gitbox.apache.org/repos/asf/skywalking.git
commit 1c8640ddae38764cf429ad10ee22170ad2549eee Author: Wu Sheng <[email protected]> AuthorDate: Thu Jun 18 18:43:06 2026 +0800 Let Spring Boot manage logback (matched) - clears 4 logback-core CVE alerts #13913 pinned logback-classic to 1.2.13 while Spring Boot kept logback-core at 1.2.6 (mismatch -> NoSuchMethodError -> lua e2e hang). #13915 fixed the hang by adding an explicit logback-core 1.2.13 dep, but that made Dependabot flag logback-core (4 CVEs patched only in logback 1.3.x/1.5.x, which need SLF4J 2.0 / Java 17 - unreachable on this Java-8 / Spring Boot 2.5 fixture). Drop the explicit logback pins entirely and let spring-boot-dependencies manage both logback-classic and logback-core to the same version (1.2.6). Matched versions never trigger the NoSuchMethodError, and a BOM-managed (not declared) logback-core is not flagged by Dependabot - so the 4 alerts clear without shipping a vulnerable declared dependency, and the lua fix is preserved. --- .../java-test-service/e2e-service-provider/pom.xml | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/test/e2e-v2/java-test-service/e2e-service-provider/pom.xml b/test/e2e-v2/java-test-service/e2e-service-provider/pom.xml index 122151f3df..b8c86e60f1 100644 --- a/test/e2e-v2/java-test-service/e2e-service-provider/pom.xml +++ b/test/e2e-v2/java-test-service/e2e-service-provider/pom.xml @@ -35,7 +35,6 @@ <properties> <log4j2.version>2.25.4</log4j2.version> - <logback.version>1.2.13</logback.version> </properties> <dependencies> @@ -75,20 +74,14 @@ <version>${log4j2.version}</version> </dependency> <dependency> + <!-- No explicit version: let spring-boot-dependencies manage BOTH + logback-classic and logback-core to the same version so they never + mismatch. A classic newer than the managed core makes logback-classic's + ThrowableProxy call OptionHelper.isNotEmtpy() (absent in the older core), + throwing NoSuchMethodError when logging an exception. Java 8 / Spring + Boot 2.x keeps this on the logback 1.2.x line. --> <groupId>ch.qos.logback</groupId> <artifactId>logback-classic</artifactId> - <version>${logback.version}</version> - </dependency> - <dependency> - <!-- Pin logback-core to the same version as logback-classic. Spring Boot's - dependency management otherwise holds logback-core at an older version - (1.2.6), and logback-classic 1.2.13's ThrowableProxy calls - OptionHelper.isNotEmtpy() which only exists in the matching core, so - logging any exception throws NoSuchMethodError and kills the request - thread. --> - <groupId>ch.qos.logback</groupId> - <artifactId>logback-core</artifactId> - <version>${logback.version}</version> </dependency> <dependency> <groupId>org.apache.skywalking</groupId>
