Skip to content

Bump the minor-java-dependencies group across 1 directory with 20 updates#17

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/maven/minor-java-dependencies-b3adf844fa
Open

Bump the minor-java-dependencies group across 1 directory with 20 updates#17
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/maven/minor-java-dependencies-b3adf844fa

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 1, 2026

Bumps the minor-java-dependencies group with 20 updates in the / directory:

Package From To
com.fasterxml.jackson:jackson-bom 2.20.1 2.21.1
io.dropwizard:dropwizard-dependencies 4.0.16 4.0.17
io.micrometer:micrometer-bom 1.16.2 1.16.3
com.google.cloud:libraries-bom 26.73.0 26.76.0
io.opentelemetry:opentelemetry-bom 1.58.0 1.59.0
io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom 2.24.0 2.25.0
ch.qos.logback:logback-core 1.5.24 1.5.32
ch.qos.logback:logback-classic 1.5.24 1.5.32
ch.qos.logback.access:logback-access-common 2.0.8 2.0.12
org.yaml:snakeyaml 2.5 2.6
org.jetbrains.kotlin:kotlin-bom 2.2.21 2.3.10
org.signal:libsignal-server 0.86.6 0.87.5
io.opentelemetry.instrumentation:opentelemetry-logback-appender-1.0 2.24.0-alpha 2.25.0-alpha
org.assertj:assertj-core 3.27.6 3.27.7
org.codehaus.mojo:versions-maven-plugin 2.20.1 2.21.0
org.codehaus.mojo:templating-maven-plugin 3.0.0 3.1.0
org.apache.maven.plugins:maven-compiler-plugin 3.14.1 3.15.0
org.apache.maven.plugins:maven-dependency-plugin 3.9.0 3.10.0
org.apache.maven.plugins:maven-surefire-plugin 3.5.4 3.5.5
org.codehaus.mojo:properties-maven-plugin 1.2.1 1.3.0

Updates com.fasterxml.jackson:jackson-bom from 2.20.1 to 2.21.1

Commits
  • 08a5a9a [maven-release-plugin] prepare release jackson-bom-2.21.1
  • 5b03376 Prep for 2.21.1 release
  • 1d78778 Merge branch '2.20' into 2.21
  • cd46b24 Post-release dep version bump
  • 17179ff [maven-release-plugin] prepare for next development iteration
  • 2a26844 [maven-release-plugin] prepare release jackson-bom-2.20.2
  • 6adf11b Prep for 2.20.2 release
  • 441df8a Post-release version bump
  • a1b4814 [maven-release-plugin] prepare for next development iteration
  • 901b398 [maven-release-plugin] prepare release jackson-bom-2.21.0
  • Additional commits viewable in compare view

Updates io.dropwizard:dropwizard-dependencies from 4.0.16 to 4.0.17

Updates io.micrometer:micrometer-bom from 1.16.2 to 1.16.3

Release notes

Sourced from io.micrometer:micrometer-bom's releases.

1.16.3

🐞 Bug Fixes

  • Add immutable noop Observation.Context #7133
  • OSGi test isn't reporting failures #7060

📔 Documentation

  • Docs: Align AsciiDoc callout syntax #7148
  • Improve documentation of ExecutorServiceMetrics #7083

🔨 Dependency Upgrades

  • Bump ch.qos.logback:logback-classic from 1.5.24 to 1.5.26 #7125
  • Bump com.hazelcast:hazelcast from 5.3.8 to 5.6.0 #6802
  • Bump com.netflix.spectator:spectator-reg-atlas from 1.9.3 to 1.9.4 #7166
  • Bump dropwizard-metrics from 4.2.37 to 4.2.38 #7120
  • Bump gradle-wrapper from 8.14.3 to 8.14.4 #7112
  • Bump grpc from 1.76.2 to 1.76.3 #7137
  • Bump io.dropwizard.metrics5:metrics-core from 5.0.5 to 5.0.6 #7124
  • Bump io.freefair.aspectj.post-compile-weaving from 8.14.3 to 8.14.4 #7070
  • Bump io.spring.develocity.conventions from 0.0.24 to 0.0.25 #7101
  • Bump org.assertj:assertj-core from 3.27.6 to 3.27.7 #7126

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​izeye, @​mateusz-nalepa, and @​tkmsaaaam

Commits
  • 1963aac Downgrade Netty from 4.2.10 to 4.1.131 (#7177)
  • aecd95d Merge branch '1.15.x' into 1.16.x
  • cd83609 Improve flakiness of StatsdMeterRegistryPublishTest (#7053)
  • 991f09c Merge branch '1.15.x' into 1.16.x
  • bcbf4fe Bump io.micrometer:context-propagation from 1.1.3 to 1.1.4 (#7173)
  • 8fd4212 Bump io.micrometer:context-propagation from 1.2.0 to 1.2.1 (#7172)
  • f42488e Bump com.netflix.spectator:spectator-reg-atlas from 1.9.3 to 1.9.4 (#7166)
  • 848e9a9 Bump io.netty:netty-bom from 4.2.9.Final to 4.2.10.Final (#7165)
  • 8e309f3 Bump io.netty:netty-bom from 4.1.130.Final to 4.1.131.Final (#7162)
  • 0f9224f docs: fix broken callout list structure in example blocks (#7148)
  • Additional commits viewable in compare view

Updates com.google.cloud:libraries-bom from 26.73.0 to 26.76.0

Release notes

Sourced from com.google.cloud:libraries-bom's releases.

v26.76.0

26.76.0 (2026-02-14)

Dependencies

  • update dependency com.google.cloud:first-party-dependencies to v3.56.1 (#7376) (fb89846)
  • update dependency com.google.cloud:gapic-libraries-bom to v1.78.0 (#7380) (563aa97)
  • update dependency com.google.cloud:gapic-libraries-bom to v1.79.0 (#7396) (86e71da)
  • update dependency com.google.cloud:google-cloud-bigquery to v2.59.0 (#7388) (4622164)
  • update dependency com.google.cloud:google-cloud-bigquerystorage-bom to v3.21.0 (#7383) (3f90e6c)
  • update dependency com.google.cloud:google-cloud-bigtable-bom to v2.73.0 (#7379) (728fa9f)
  • update dependency com.google.cloud:google-cloud-datastore-bom to v2.34.0 (#7384) (5e742e0)
  • update dependency com.google.cloud:google-cloud-firestore-bom to v3.37.0 (#7390) (bb45f9c)
  • update dependency com.google.cloud:google-cloud-logging-logback to v0.134.0-alpha (#7387) (c603b7a)
  • update dependency com.google.cloud:google-cloud-nio to v0.128.12 (#7395) (31bb828)
  • update dependency com.google.cloud:google-cloud-pubsub-bom to v1.148.0 (#7385) (be03f5d)
  • update dependency com.google.cloud:google-cloud-pubsublite-bom to v1.16.1 (#7386) (9e1154d)
  • update dependency com.google.cloud:google-cloud-spanner-bom to v6.111.0 (#7382) (45958ff)
  • update dependency com.google.cloud:google-cloud-spanner-jdbc to v2.35.3 (#7392) (0943ea6)
  • update dependency com.google.cloud:google-cloud-storage-bom to v2.63.0 (#7391) (1544a28)

v26.75.0

GCP Libraries BOM 26.75.0

Upgrade Overview

The libraries-bom and its managed libraries have been upgraded to use Protobuf v4.33.2. All Protobuf gen code included in the managed libraries has been regenerated using protoc v33.2.


✅ Backward Compatibility

The new protobuf-java v4.33.2 runtime is fully backward-compatible with protoc gen code 3.x. You should not experience any incompatibilities from using older gen code with the new runtime. Should you experience compatibility issues, please consult the Known Incompatibilities & Mitigations. If the issue persists, please file a report via the support console or our GitHub repository


⚠️ Advisory: Vulnerability Warnings

After upgrading, you may see a new warning in your logs: Vulnerable protobuf generated type in use. This warning does not mean the Java SDK is vulnerable. It indicates that your application, or one of its other dependencies, is still using gen code < 3.21.7. For a detailed explanation and mitigation steps, please refer to the Java section in the official Protobuf v4.33.0 release notes.


Known Incompatibilities & Mitigations

While rare, the following incompatibilities may occur due to the version update:

1. Runtime Version Mismatch

  • Issue: The minimum required protobuf-java runtime version is now v4.33.2. Starting with the 4.x runtime, validations ensure the runtime version is higher than or equal to the gen code version. Using a lower version of protobuf-java will produce errors below.
  • Symptoms:
    • java.lang.NoClassDefFoundError: com/google/protobuf/RuntimeVersion$RuntimeDomain (when using 3.x versions).
    • com.google.protobuf.RuntimeVersion$ProtobufRuntimeVersionException (when using older 4.x versions).
  • Mitigation: Upgrade the version of protobuf-java to be greater than or equal to v4.33.2.

... (truncated)

Commits
  • a15d73b chore: release main (#7394)
  • 86e71da deps: update dependency com.google.cloud:gapic-libraries-bom to v1.79.0 (#7396)
  • 31bb828 deps: update dependency com.google.cloud:google-cloud-nio to v0.128.12 (#7395)
  • fb89846 deps: update dependency com.google.cloud:first-party-dependencies to v3.56.1 ...
  • 728fa9f deps: update dependency com.google.cloud:google-cloud-bigtable-bom to v2.73.0...
  • 563aa97 deps: update dependency com.google.cloud:gapic-libraries-bom to v1.78.0 (#7380)
  • 45958ff deps: update dependency com.google.cloud:google-cloud-spanner-bom to v6.111.0...
  • 3f90e6c deps: update dependency com.google.cloud:google-cloud-bigquerystorage-bom to ...
  • 5e742e0 deps: update dependency com.google.cloud:google-cloud-datastore-bom to v2.34....
  • be03f5d deps: update dependency com.google.cloud:google-cloud-pubsub-bom to v1.148.0 ...
  • Additional commits viewable in compare view

Updates io.opentelemetry:opentelemetry-bom from 1.58.0 to 1.59.0

Release notes

Sourced from io.opentelemetry:opentelemetry-bom's releases.

Version 1.59.0

API

  • Stabilize complex attributes (#7973)
  • Limit init valid hex array to range that can be true (#7809)

Extensions

  • Trace propagators: Deprecate OtTracePropagator (#8020)
  • Trace propagators: Deprecate JaegerPropagator (#8019)

SDK

  • Move io.opentelemetry.sdk.internal to io.opentelemetry.sdk.common.internal (#8003)
  • Always return ExtendedOpenTelemetry when incubator is available (#7991)

Traces

  • Fix memory leak in SdkSpan#spanEndingThread (#7984)

Metrics

  • Rework and publish metric benchmarks (#8000)
  • Update LongLastValueAggregator algo to avoid allocations (#8017)

Testing

  • Fix OTel JUnit5 Extension cleanup when using Nested test classes (#7999)
  • Add assertion support for Span hasException(null) (#8033)

Exporters

  • DEPRECATION: opentelemetry-exporter-zipkin is now deprecated with the last release planned for 1.65.0 (August 2026) (#7974)
  • Refactor http, grpc senders and promote to public API (#7782)

Extensions

  • Jaeger remote sampler: Remove unused code (#7970)
  • Incubator: Add AlwaysRecordSampler (#7877)

Project tooling

  • Align generate release contributors (#8023)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@​austince @​baolongnt

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-bom's changelog.

Version 1.59.0 (2026-02-06)

API

  • Stabilize complex attributes (#7973)
  • Limit init valid hex array to range that can be true (#7809)

Extensions

  • Trace propagators: Deprecate OtTracePropagator (#8020)
  • Trace propagators: Deprecate JaegerPropagator (#8019)

SDK

  • Move io.opentelemetry.sdk.internal to io.opentelemetry.sdk.common.internal (#8003)
  • Always return ExtendedOpenTelemetry when incubator is available (#7991)

Traces

  • Fix memory leak in SdkSpan#spanEndingThread (#7984)

Metrics

  • Rework and publish metric benchmarks (#8000)
  • Update LongLastValueAggregator algo to avoid allocations (#8017)

Testing

  • Fix OTel JUnit5 Extension cleanup when using Nested test classes (#7999)
  • Add assertion support for Span hasException(null) (#8033)

Exporters

  • DEPRECATION: opentelemetry-exporter-zipkin is now deprecated with the last release planned for 1.65.0 (August 2026) (#7974)
  • Refactor http, grpc senders and promote to public API (#7782)

... (truncated)

Commits
  • d01a599 [release/v1.59.x] Prepare release 1.59.0 (#8055)
  • c2d6229 Prepare for 1.59.0 release (#8052)
  • 4335cf2 Stabilize complex attributes (#7973)
  • 3f5411d fix(deps): update dependency io.netty:netty-bom to v4.2.10.final (#8049)
  • ad771ea fix(deps): update armeriaversion to v1.36.0 (#8048)
  • a01befb chore(deps): update otel/opentelemetry-collector-contrib docker tag to v0.145...
  • 089600f fix(deps): update dependency com.google.api.grpc:proto-google-common-protos t...
  • d31d468 chore(deps): update plugin de.undercouch.download to v5.7.0 (#8043)
  • c68989a fix(deps): update dependency io.grpc:grpc-bom to v1.79.0 (#8044)
  • 1c4835c chore(deps): update plugin org.jsonschema2pojo to v1.3.2 (#8042)
  • Additional commits viewable in compare view

Updates io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom from 2.24.0 to 2.25.0

Release notes

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom's releases.

Version 2.25.0

This release targets the OpenTelemetry SDK 1.59.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they are still alpha quality and will continue to have breaking changes. Please see the VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

🚫 Deprecations

  • Deprecated getDelegate(), request(), channel(), remoteAddress() in HTTP client request wrapper classes in favor of getRequest(), getChannel(), getRemoteAddress() for consistency (#15942)
  • Deprecated NettyClientTelemetry.setChannelContext() in favor of setParentContext() (#16010)
  • Deprecated new* methods in favor of create* methods in Armeria and Jetty client instrumentation (e.g., newDecorator()createDecorator(), newHttpClient()createHttpClient()) (#16009)
  • Deprecated NettyServerTelemetry.createResponseHandler() and createCombinedHandler() overloads that expose internal classes (#16011)
  • Deprecated RatpackServerTelemetry.getHandler(), getExecInterceptor(), and getExecInitializer() in favor of createHandler(), createExecInterceptor(), and createExecInitializer() (#16013)
  • Deprecated setPeerService() in HTTP, gRPC, Dubbo, and Armeria instrumentation builders in favor of addAttributesExtractor() (#16059)
  • Deprecated RpcAttributesGetter.getMethod() in favor of getRpcMethod() to support stable RPC semantic conventions (#16121)
  • Deprecated PeerServiceResolver, PeerServiceAttributesExtractor, and HttpClientPeerServiceAttributesExtractor in favor of renamed classes ServicePeerResolver, ServicePeerAttributesExtractor, and HttpClientServicePeerAttributesExtractor (#16071)
  • Deprecated setStatementSanitizationEnabled() in favor of setQuerySanitizationEnabled() across database instrumentation builders (Cassandra, JDBC, Lettuce, Mongo, R2DBC) (#16133)
  • Deprecated individual runtime metric classes (Classes, Cpu, GarbageCollector, MemoryPools, Threads) in favor of RuntimeMetrics (#16064)
  • Deprecated SqlStatementInfo in favor of SqlQuery, and SqlStatementSanitizer in favor of SqlQuerySanitizer (#16074)

🌟 New library instrumentation

📈 Enhancements

  • Logback appender: add declarative config support (#15813)
  • OkHttp: avoid weak reference in library instrumentation (#15977)
  • HTTP clients: Enable query redaction by default in library instrumentations (#16096)
  • HttpURLConnection: mark as early instrumentation to ensure virtual fields are used (#16142)

🛠️ Bug fixes

  • Dropwizard metrics: Sanitize names where needed to comply with OpenTelemetry requirements (#15954)
  • Instrumentation API incubator: Fix span key mapping for MESSAGING_CONSUMER_PROCESS (#16001)
  • Couchbase: Fix local address occasionally missing (#16035)
  • Internal logging: Map jul config level to debug instead of info (#16141)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@​imavroukakis @​jackshirazi @​jaydeluca @​jkwatson

... (truncated)

Changelog

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom's changelog.

Version 2.25.0 (2026-02-13)

⚠️ Breaking changes to non-stable APIs

🚫 Deprecations

  • Deprecated getDelegate(), request(), channel(), remoteAddress() in HTTP client request wrapper classes in favor of getRequest(), getChannel(), getRemoteAddress() for consistency (#15942)
  • Deprecated NettyClientTelemetry.setChannelContext() in favor of setParentContext() (#16010)
  • Deprecated new* methods in favor of create* methods in Armeria and Jetty client instrumentation (e.g., newDecorator()createDecorator(), newHttpClient()createHttpClient()) (#16009)
  • Deprecated NettyServerTelemetry.createResponseHandler() and createCombinedHandler() overloads that expose internal classes (#16011)
  • Deprecated RatpackServerTelemetry.getHandler(), getExecInterceptor(), and getExecInitializer() in favor of createHandler(), createExecInterceptor(), and createExecInitializer() (#16013)
  • Deprecated setPeerService() in HTTP, gRPC, Dubbo, and Armeria instrumentation builders in favor of addAttributesExtractor() (#16059)
  • Deprecated RpcAttributesGetter.getMethod() in favor of getRpcMethod() to support stable RPC semantic conventions (#16121)
  • Deprecated PeerServiceResolver, PeerServiceAttributesExtractor, and HttpClientPeerServiceAttributesExtractor in favor of renamed classes ServicePeerResolver, ServicePeerAttributesExtractor, and HttpClientServicePeerAttributesExtractor (#16071)
  • Deprecated setStatementSanitizationEnabled() in favor of setQuerySanitizationEnabled() across database instrumentation builders (Cassandra, JDBC, Lettuce, Mongo, R2DBC) (#16133)
  • Deprecated individual runtime metric classes (Classes, Cpu, GarbageCollector, MemoryPools, Threads) in favor of RuntimeMetrics (#16064)
  • Deprecated SqlStatementInfo in favor of SqlQuery, and SqlStatementSanitizer in favor of SqlQuerySanitizer (#16074)

... (truncated)

Commits
  • 399dae9 [release/v2.25.x] Prepare release 2.25.0 (#16159)
  • b1c11e8 Update change log for upcoming release (#16157)
  • 056af8c fix(deps): update dependency org.springframework:spring-test to v7.0.4 (#16156)
  • 7eb964f Last peer service terminology update (#16149)
  • dec960f Mark url connection as early instrumentation (#16142)
  • 34514eb Rename database semantic convention internal identifiers (#16150)
  • c1ffbe3 Rename test variables from dbName to namespace for semantic convention alignm...
  • f27845a Rename internal statementSanitizationEnabled to querySanitizationEnabled ...
  • cfa0383 More database terminology alignment (#16147)
  • 7b076a7 A bit more service peer terminology updates (#16146)
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-core from 1.5.24 to 1.5.32

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.5.32

2026-02-16 Release of logback version 1.5.32

• In DefaultProcessor, fixed incorrect check for dependencies contained within a parent model. Previous only the direct children were scanned. This fixes logback-access/issues/34.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e807335a67535b4eacce94e942c0bcb649665d93 associated with the tag v_1.5.32. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.31

2026-02-14 Release of logback version 1.5.31

• Fixed missing META-INF/services directory in logback-classic.jar. This issue rendered logback-classic version 1.5.30 unusable with SLF4J.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 168e42f9f9a18a3ffdf31eb2bfe80a71e33ecd8b associated with the tag v_1.5.31. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.30

2026-02-14 Release of logback version 1.5.30

In this version, logback-classic.jar was missing the META-INF/services directory, making it unusable with SLF4J. Version 1.5.31 (released later on the same day) fixes this issue.

• Fix scanning issue when an included file becomes available at a later time. This problem was reported in issues/1021 by Sergey Nazarov.

• Standardized code for version checking across modules.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 44164f10ca3fb44ce0e68519f13564b87e3aca61 associated with the tag v_1.5.30. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.29

2026-02-09 Release of logback version 1.5.29

• In response to issues/1017, appender names and appender references are once again subject to variable substitution, reverting the change introduced in version 1.5.28.

Logback 1.5.28

2026-02-06 Release of logback version 1.5.28

• Appender names or appender references are no longer subject to variable substitution.

• Fixed issue with configurations with conditionals encompassing appenders. This was reported in issues/1016 reported by Sergey Sazonov.

• The element now admits a 'scan' attribute which can be used to override the 'scan' attribute in the element.

• Fixed NullPointerException thrown by VersionUtil.checkForVersionEquality method occurring with GraalVM Native Images. This issue was reported in issues/1014.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e7a1855ab562bb102333f754603ff89359bf3cfc associated with the tag v_1.5.28. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.27

2026-01-30 Release of logback version 1.5.27

• Updated license to Eclipse Public License version 2.0 from version 1.0, retaining the GPL 2.1 dual-license.

• Fixed missing MDC data transmitted by SocketAppender reported in issues/1010 by Lars Vogel.

... (truncated)

Commits
  • e807335 prepare release 1.5.32
  • dc35d55 fix logback-access/issues/34 by checking if dependency is a sub-model of the ...
  • 8e32278 added simple test for appender definitiob via file inclusion
  • 834dbed start work on 1.5.32-SNAPSHOT
  • 168e42f add test to check that Logback SLF4J provider can be activated
  • ed45362 prepare release 1.5.31
  • 609dae7 fix missing META-INF directory
  • 7739739 start work on 1.5.31-SNAPSHOT
  • 44164f1 prepare release 1.5.30
  • 9874f06 test for top-file as a resource, introduced new module logback-classic-misc
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.24 to 1.5.32

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.5.32

2026-02-16 Release of logback version 1.5.32

• In DefaultProcessor, fixed incorrect check for dependencies contained within a parent model. Previous only the direct children were scanned. This fixes logback-access/issues/34.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e807335a67535b4eacce94e942c0bcb649665d93 associated with the tag v_1.5.32. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.31

2026-02-14 Release of logback version 1.5.31

• Fixed missing META-INF/services directory in logback-classic.jar. This issue rendered logback-classic version 1.5.30 unusable with SLF4J.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 168e42f9f9a18a3ffdf31eb2bfe80a71e33ecd8b associated with the tag v_1.5.31. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.30

2026-02-14 Release of logback version 1.5.30

In this version, logback-classic.jar was missing the META-INF/services directory, making it unusable with SLF4J. Version 1.5.31 (released later on the same day) fixes this issue.

• Fix scanning issue when an included file becomes available at a later time. This problem was reported in issues/1021 by Sergey Nazarov.

• Standardized code for version checking across modules.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 44164f10ca3fb44ce0e68519f13564b87e3aca61 associated with the tag v_1.5.30. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.29

2026-02-09 Release of logback version 1.5.29

• In response to issues/1017, appender names and appender references are once again subject to variable substitution, reverting the change introduced in version 1.5.28.

Logback 1.5.28

2026-02-06 Release of logback version 1.5.28

• Appender names or appender references are no longer subject to variable substitution.

• Fixed issue with configurations with conditionals encompassing appenders. This was reported in issues/1016 reported by Sergey Sazonov.

• The element now admits a 'scan' attribute which can be used to override the 'scan' attribute in the element.

• Fixed NullPointerException thrown by VersionUtil.checkForVersionEquality method occurring with GraalVM Native Images. This issue was reported in issues/1014.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e7a1855ab562bb102333f754603ff89359bf3cfc associated with the tag v_1.5.28. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.27

2026-01-30 Release of logback version 1.5.27

• Updated license to Eclipse Public License version 2.0 from version 1.0, retaining the GPL 2.1 dual-license.

• Fixed missing MDC data transmitted by SocketAppender reported in issues/1010 by Lars Vogel.

... (truncated)

Commits
  • e807335 prepare release 1.5.32
  • dc35d55 fix logback-access/issues/34 by checking if dependency is a sub-model of the ...
  • 8e32278 added simple test for appender definitiob via file inclusion
  • 834dbed start work on 1.5.32-SNAPSHOT
  • 168e42f add test to check that Logback SLF4J provider can be activated
  • ed45362 prepare release 1.5.31
  • 609dae7 fix missing META-INF directory
  • 7739739 start work on 1.5.31-SNAPSHOT
  • 44164f1 prepare release 1.5.30
  • 9874f06 test for top-file as a resource, introduced new module logback-classic-misc
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.24 to 1.5.32

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.5.32

2026-02-16 Release of logback version 1.5.32

• In DefaultProcessor, fixed incorrect check for dependencies contained within a parent model. Previous only the direct children were scanned. This fixes logback-access/issues/34.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e807335a67535b4eacce94e942c0bcb649665d93 associated with the tag v_1.5.32. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.31

2026-02-14 Release of logback version 1.5.31

• Fixed missing META-INF/services directory in logback-classic.jar. This issue rendered logback-classic version 1.5.30 unusable with SLF4J.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 168e42f9f9a18a3ffdf31eb2bfe80a71e33ecd8b associated with the tag v_1.5.31. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.30

2026-02-14 Release of logback version 1.5.30

In this version, logback-classic.jar was missing the META-INF/services directory, making it unusable with SLF4J. Version 1.5.31 (released later on the same day) fixes this issue.

• Fix scanning issue when an included file becomes available at a later time. This problem was reported in issues/1021 by Sergey Nazarov.

• Standardized code for version checking across modules.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 44164f10ca3fb44ce0e68519f13564b87e3aca61 associated with the tag v_1.5.30. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.29

2026-02-09 Release of logback version 1.5.29

• In response to issues/1017, appender names and appender references are once again subject to variable substitution, reverting the change introduced in version 1.5.28.

Logback 1.5.28

2026-02-06 Release of logback version 1.5.28

• Appender names or appender references are no longer subject to variable substitution.

• Fixed issue with configurations with conditionals encompassing appenders. This was reported in issues/1016 reported by Sergey Sazonov.

• The element now admits a 'scan' attribute which can be used to override the 'scan' attribute in the element.

• Fixed NullPointerException thrown by VersionUtil.checkForVersionEquality method occurring with GraalVM Native Images. This issue was reported in issues/1014.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e7a1855ab562bb102333f754603ff89359bf3cfc associated with the tag v_1.5.28. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.27

2026-01-30 Release of logback version 1.5.27

• Updated license to Eclipse Public License version 2.0 from version 1.0, retaining the GPL 2.1 dual-license.

• Fixed missing MDC data transmitted by SocketAppender reported in issues/1010 by Lars Vogel.

... (truncated)

Commits
  • e807335 prepare release 1.5.32
  • dc35d55 fix logback-access/issues/34 by checking if dependency is a sub-model of the ...
  • 8e32278 added simple test for appender definitiob via file inclusion
  • 834dbed start work on 1.5.32-SNAPSHOT
  • 168e42f add test to check that Logback SLF4J provider can be activated
  • ed45362 prepare release 1.5.31
  • 609dae7 fix missing META-INF directory
  • 7739739 start work on 1.5.31-SNAPSHOT
  • 44164f1 prepare release 1.5.30
  • 9874f06 test for top-file as a resource, introduced new module logback-classic-misc
  • Additional commits viewable in compare view

Updates ch.qos.logback.access:logback-access-common from 2.0.8 to 2.0.12

Updates org.yaml:snakeyaml from 2.5 to 2.6

Commits

Updates org.jetbrains.kotlin:kotlin-bom from 2.2.21 to 2.3.10

Release notes

Sourced from org.jetbrains.kotlin:kotlin-bom's releases.

Kotlin 2.3.10

Changelog

Compiler

  • KT-83984...

    Description has been truncated

…ates

Bumps the minor-java-dependencies group with 20 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `2.20.1` | `2.21.1` |
| io.dropwizard:dropwizard-dependencies | `4.0.16` | `4.0.17` |
| [io.micrometer:micrometer-bom](https://github.com/micrometer-metrics/micrometer) | `1.16.2` | `1.16.3` |
| [com.google.cloud:libraries-bom](https://github.com/googleapis/java-cloud-bom) | `26.73.0` | `26.76.0` |
| [io.opentelemetry:opentelemetry-bom](https://github.com/open-telemetry/opentelemetry-java) | `1.58.0` | `1.59.0` |
| [io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom](https://github.com/open-telemetry/opentelemetry-java-instrumentation) | `2.24.0` | `2.25.0` |
| [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.5.24` | `1.5.32` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.5.24` | `1.5.32` |
| ch.qos.logback.access:logback-access-common | `2.0.8` | `2.0.12` |
| [org.yaml:snakeyaml](https://bitbucket.org/snakeyaml/snakeyaml) | `2.5` | `2.6` |
| [org.jetbrains.kotlin:kotlin-bom](https://github.com/JetBrains/kotlin) | `2.2.21` | `2.3.10` |
| [org.signal:libsignal-server](https://github.com/signalapp/libsignal) | `0.86.6` | `0.87.5` |
| [io.opentelemetry.instrumentation:opentelemetry-logback-appender-1.0](https://github.com/open-telemetry/opentelemetry-java-instrumentation) | `2.24.0-alpha` | `2.25.0-alpha` |
| [org.assertj:assertj-core](https://github.com/assertj/assertj) | `3.27.6` | `3.27.7` |
| [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions) | `2.20.1` | `2.21.0` |
| [org.codehaus.mojo:templating-maven-plugin](https://github.com/mojohaus/templating-maven-plugin) | `3.0.0` | `3.1.0` |
| [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.14.1` | `3.15.0` |
| [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin) | `3.9.0` | `3.10.0` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.5.4` | `3.5.5` |
| [org.codehaus.mojo:properties-maven-plugin](https://github.com/mojohaus/properties-maven-plugin) | `1.2.1` | `1.3.0` |



Updates `com.fasterxml.jackson:jackson-bom` from 2.20.1 to 2.21.1
- [Commits](FasterXML/jackson-bom@jackson-bom-2.20.1...jackson-bom-2.21.1)

Updates `io.dropwizard:dropwizard-dependencies` from 4.0.16 to 4.0.17

Updates `io.micrometer:micrometer-bom` from 1.16.2 to 1.16.3
- [Release notes](https://github.com/micrometer-metrics/micrometer/releases)
- [Commits](micrometer-metrics/micrometer@v1.16.2...v1.16.3)

Updates `com.google.cloud:libraries-bom` from 26.73.0 to 26.76.0
- [Release notes](https://github.com/googleapis/java-cloud-bom/releases)
- [Commits](googleapis/java-cloud-bom@v26.73.0...v26.76.0)

Updates `io.opentelemetry:opentelemetry-bom` from 1.58.0 to 1.59.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.58.0...v1.59.0)

Updates `io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom` from 2.24.0 to 2.25.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java-instrumentation@v2.24.0...v2.25.0)

Updates `ch.qos.logback:logback-core` from 1.5.24 to 1.5.32
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.24...v_1.5.32)

Updates `ch.qos.logback:logback-classic` from 1.5.24 to 1.5.32
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.24...v_1.5.32)

Updates `ch.qos.logback:logback-classic` from 1.5.24 to 1.5.32
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.24...v_1.5.32)

Updates `ch.qos.logback.access:logback-access-common` from 2.0.8 to 2.0.12

Updates `org.yaml:snakeyaml` from 2.5 to 2.6
- [Commits](https://bitbucket.org/snakeyaml/snakeyaml/branches/compare/snakeyaml-2.6..snakeyaml-2.5)

Updates `org.jetbrains.kotlin:kotlin-bom` from 2.2.21 to 2.3.10
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.2.21...v2.3.10)

Updates `org.signal:libsignal-server` from 0.86.6 to 0.87.5
- [Release notes](https://github.com/signalapp/libsignal/releases)
- [Changelog](https://github.com/signalapp/libsignal/blob/main/RELEASE_NOTES.md)
- [Commits](signalapp/libsignal@v0.86.6...v0.87.5)

Updates `io.opentelemetry.instrumentation:opentelemetry-logback-appender-1.0` from 2.24.0-alpha to 2.25.0-alpha
- [Release notes](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-java-instrumentation/commits)

Updates `org.assertj:assertj-core` from 3.27.6 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](assertj/assertj@assertj-build-3.27.6...assertj-build-3.27.7)

Updates `org.codehaus.mojo:versions-maven-plugin` from 2.20.1 to 2.21.0
- [Release notes](https://github.com/mojohaus/versions/releases)
- [Changelog](https://github.com/mojohaus/versions/blob/master/ReleaseNotes.md)
- [Commits](mojohaus/versions@2.20.1...2.21.0)

Updates `org.codehaus.mojo:templating-maven-plugin` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/mojohaus/templating-maven-plugin/releases)
- [Commits](mojohaus/templating-maven-plugin@3.0.0...templating-maven-plugin-3.1.0)

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.14.1 to 3.15.0
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.14.1...maven-compiler-plugin-3.15.0)

Updates `org.apache.maven.plugins:maven-dependency-plugin` from 3.9.0 to 3.10.0
- [Release notes](https://github.com/apache/maven-dependency-plugin/releases)
- [Commits](apache/maven-dependency-plugin@maven-dependency-plugin-3.9.0...maven-dependency-plugin-3.10.0)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.4 to 3.5.5
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.4...surefire-3.5.5)

Updates `org.codehaus.mojo:properties-maven-plugin` from 1.2.1 to 1.3.0
- [Release notes](https://github.com/mojohaus/properties-maven-plugin/releases)
- [Commits](mojohaus/properties-maven-plugin@1.2.1...properties-maven-plugin-1.3.0)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.21.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: io.dropwizard:dropwizard-dependencies
  dependency-version: 4.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-java-dependencies
- dependency-name: io.micrometer:micrometer-bom
  dependency-version: 1.16.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-java-dependencies
- dependency-name: com.google.cloud:libraries-bom
  dependency-version: 26.76.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: io.opentelemetry:opentelemetry-bom
  dependency-version: 1.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom
  dependency-version: 2.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.5.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-java-dependencies
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.5.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-java-dependencies
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.5.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-java-dependencies
- dependency-name: ch.qos.logback.access:logback-access-common
  dependency-version: 2.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-java-dependencies
- dependency-name: org.yaml:snakeyaml
  dependency-version: '2.6'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: org.jetbrains.kotlin:kotlin-bom
  dependency-version: 2.3.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: org.signal:libsignal-server
  dependency-version: 0.87.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: io.opentelemetry.instrumentation:opentelemetry-logback-appender-1.0
  dependency-version: 2.25.0-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: org.assertj:assertj-core
  dependency-version: 3.27.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-java-dependencies
- dependency-name: org.codehaus.mojo:versions-maven-plugin
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: org.codehaus.mojo:templating-maven-plugin
  dependency-version: 3.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: org.apache.maven.plugins:maven-dependency-plugin
  dependency-version: 3.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.5.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-java-dependencies
- dependency-name: org.codehaus.mojo:properties-maven-plugin
  dependency-version: 1.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-java-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Mar 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants