Branch: refs/heads/main
Home: https://github.com/pmd/pmd-eclipse-plugin
Commit: 0dca02e74e81c998987faa0f829c7c1304f6420b
https://github.com/pmd/pmd-eclipse-plugin/commit/0dca02e74e81c998987faa0f829c7c1304f6420b
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M net.sourceforge.pmd.eclipse.plugin/pom.xml
Log Message:
-----------
Bump ch.qos.logback:logback-classic from 1.5.34 to 1.5.35 (#421)
Bumps
[ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from
1.5.34 to 1.5.35.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-classic's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.35</h2>
<p><strong>026-06-23 Release of logback version 1.5.35</strong></p>
<p>• The 'condition' attribute in <code><if></code> elements now
rejects unicode escape sequences (\u and \U). This closes a bypass of
the existing prohibition on the new operator in Janino-evaluated
conditions. This issue was reported by IcySun (<a
href="mailto:[email protected]";>[email protected]</a>) and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-13006";>CVE-2026-13006</a>.</p>
<p>• Added <code>ConfiguratorRank.AUTHENTICATING</code> (rank 100), the
highest configurator rank, for certified/authenticating configurators
discovered via the ServiceLoader mechanism.
<code>ContextInitializer</code> now requires that at most one such
configurator exist on the classpath; if more than one is found,
initialization aborts with an error.</p>
<p>• <code>ConsoleCharsetPropertyDefiner</code> is no longer shipped.
The Java 21 multi-release compilation of logback-core has been disabled,
which removes this class from the published artifact. Configurations
that referenced
<code>ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner</code>
will need an alternative approach for console charset detection.</p>
<p>• The logback-examples module is now included in artifacts published
to Maven Central.</p>
<p>• <code>JoranConfigurator.makeAnotherInstance()</code> and
<code>DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()</code>
are now protected, allowing derived configurators to override these
methods.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
08bd1598d565d83444f72983935e7da4746783b7 associated with the tag
v_1.5.35. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/qos-ch/logback/commit/08bd1598d565d83444f72983935e7da4746783b7";><code>08bd159</code></a>
preapre release 1.5.35</li>
<li><a
href="https://github.com/qos-ch/logback/commit/37d256b825fc62b4a3908fa29d8b4e34acf79ed0";><code>37d256b</code></a>
indentation changes only</li>
<li><a
href="https://github.com/qos-ch/logback/commit/d3d73078afbb0691423f60a066d77503fdf05fc3";><code>d3d7307</code></a>
minor comment</li>
<li><a
href="https://github.com/qos-ch/logback/commit/fa0411a9393282ba69396ce65f122d281c079ac0";><code>fa0411a</code></a>
radomize file location</li>
<li><a
href="https://github.com/qos-ch/logback/commit/834fdba8085727f96fc12214ff6dd71ab3ac6a25";><code>834fdba</code></a>
disable consoleCharset test</li>
<li><a
href="https://github.com/qos-ch/logback/commit/42eabc374ad8348e9f74e9cd4b59ae5168dd1c2b";><code>42eabc3</code></a>
fix messages in IfModelHandler</li>
<li><a
href="https://github.com/qos-ch/logback/commit/347efc8ec3f10defafd0cf6d4b9a0c81b3320c3a";><code>347efc8</code></a>
add unicode escape prevention</li>
<li><a
href="https://github.com/qos-ch/logback/commit/1b6ba73679437670b37aa1d9061ca82dfd554afb";><code>1b6ba73</code></a>
allow derived classes to override makeAnotherInstance</li>
<li><a
href="https://github.com/qos-ch/logback/commit/340e8be17c9a43d022c301e00b83601affd1fee5";><code>340e8be</code></a>
check for unicode escape codes in Janino conditions</li>
<li><a
href="https://github.com/qos-ch/logback/commit/4468f5e5fb67872a14131a7d4feb736131d17202";><code>4468f5e</code></a>
adding support for certifying configurators</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.35";>compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot]
<49699333+dependabot[bot]@users.noreply.github.com>
To unsubscribe from these emails, change your notification settings at
https://github.com/pmd/pmd-eclipse-plugin/settings/notifications
_______________________________________________
Pmd-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/pmd-commits
