cf88353b35Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.5.32 to 1.5.34. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-classic's releases</a>.</em></p> <blockquote> <h2>Logback 1.5.34</h2> <p><strong>2026-06-01 Release of logback version 1.5.34</strong></p> <p>• In case certain StackTraceElement values returned by the Throwable.getStackTrace method are null, StackTraceElementProxy substitutes a dummy instance instead of throwing an IllegalArgumentException. This resolves [issues <a href="https://redirect.github.com/qos-ch/logback/issues/1040">#1040</a>](<a href="https://redirect.github.com/qos-ch/logback/issues/1040">qos-ch/logback#1040</a>), reported by Naotsugu Kobayashi.</p> <p>• HardenedObjectInputStream will now throw an InvalidClassException during deserialization attempts of Proxy classes. This change addresses potential deserialization whitelist bypass vulnerability reported by <a href="https://github.com/york-shen">York Shen</a> and registered as <a href="https://www.cve.org/cverecord?id=CVE-2026-10532">CVE-2026-10532</a>.</p> <p>• A bitwise identical binary of this version can be reproduced by building from source code at commit e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag v_1.5.34. This release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <h2>Logback 1.5.33</h2> <p><strong>2026-05-27 Release of logback version 1.5.33</strong></p> <p>• <code>PropertiesConfiguratorModelHandler</code> now registers properties file URLs to the <code>ConfigurationWatchList</code> when scan is enabled (via local scan="true" attribute or top-level configuration scan), ensuring changes are detected and reconfiguration occurs. This problem was reported in <a href="https://redirect.github.com/qos-ch/logback/issues/1034">issues/1034</a>.</p> <p>• When processing <code><conversionRule></code> elements and both <code>class</code> and <code>converterClass</code> attributes are specified, silently use the class attribute without issuing a warning. However, if the attribute values differ, a warning will be issued. This change was requested in <a href="https://redirect.github.com/qos-ch/logback/issues/1031">issues/1031</a>.</p> <p>• <code>HardenedModelInputStream</code> will no longer accept to deserialize all classes located under the "java.lang" and "java.util" packages but a limited number of explicitly authorized classes in those packages. This potential deserialization whitelist bypass vulnerability was reported by <a href="https://github.com/york-shen">York Shen</a> and registered as <a href="https://www.cve.org/cverecord?id=CVE-2026-9828">CVE-2026-9828</a>.</p> <p>• SSL parameters for <code>SSLSocketAppender</code> now enable hostname verification by default. Moreover, the default protocol is now "TLSv1.2". This potential vulnerability was reported by York Shen.</p> <p>• When printing the status message field, <code>ViewStatusMessagesServletBase</code> now escapes special characters such as "&" as character entities. This potential vulnerability was reported by York Shen.</p> <p>• A bit-wise identical binary of this version can be reproduced by building from source code at commit 124e8b49b55ac34d08743a0646bd463410192647 associated with the tag v_1.5.33. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="e62272ac15"><code>e62272a</code></a> prepare release 1.5.34</li> <li><a href="1e9e926db1"><code>1e9e926</code></a> add resolveProxyClassRejectsDynamicProxies unit test</li> <li><a href="2de5cbe90b"><code>2de5cbe</code></a> added StackTraceElementProxyTest, minor edits to AGENTS.md</li> <li><a href="0e9b9278b5"><code>0e9b927</code></a> in case StackTraceElement is null use a substitute, fixing issues/1040</li> <li><a href="f7a0654c2b"><code>f7a0654</code></a> prevent resolveProxyClass bypass</li> <li><a href="249b81f375"><code>249b81f</code></a> docs are no longer distributed</li> <li><a href="1c3b26a839"><code>1c3b26a</code></a> start work on 1.5.34-SNAPSHOT</li> <li><a href="124e8b49b5"><code>124e8b4</code></a> prepare release 1.5.33</li> <li><a href="d8fd6f25c7"><code>d8fd6f2</code></a> escapeTags in message field when printing status messages</li> <li><a href="95edbeb8db"><code>95edbeb</code></a> hostnameVerification default to true in SSLParametersConfiguration, SSL.DEFAU...</li> <li>Additional commits viewable in <a href="https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
80 lines
4.6 KiB
TOML
80 lines
4.6 KiB
TOML
[versions]
|
|
# plugins version
|
|
atomicfu = "0.33.0"
|
|
binaryCompatibilityValidatorPlugin = "0.18.1"
|
|
detekt = "2.0.0-alpha.3"
|
|
dokka = "2.2.0"
|
|
kotlin = "2.3.21"
|
|
kover = "0.9.8"
|
|
ktlint = "14.2.0"
|
|
knit = "0.5.1"
|
|
mavenPublish = "0.36.0"
|
|
netty = "4.2.14.Final"
|
|
|
|
# libraries version
|
|
awaitility = "4.3.0"
|
|
collections-immutable = "0.4.0"
|
|
coroutines = "1.11.0"
|
|
kotest = "6.1.11"
|
|
kotlinx-io = "0.9.0"
|
|
ktor = "3.4.3"
|
|
logging = "8.0.03"
|
|
mockk = "1.14.11"
|
|
serialization = "1.11.0"
|
|
slf4j = "2.0.18"
|
|
logback = "1.5.34"
|
|
junit = "5.14.4"
|
|
|
|
[libraries]
|
|
# Plugins
|
|
detekt-gradle = { module = "dev.detekt:detekt-gradle-plugin", version.ref = "detekt" }
|
|
dokka-gradle = { module = "org.jetbrains.dokka:dokka-gradle-plugin", version.ref = "dokka" }
|
|
kotlin-gradle = { module = "org.jetbrains.kotlin:kotlin-gradle-plugin", version.ref = "kotlin" }
|
|
kotlin-serialization = { module = "org.jetbrains.kotlin:kotlin-serialization", version.ref = "kotlin" }
|
|
kotlinx-atomicfu-gradle = { module = "org.jetbrains.kotlinx:atomicfu-gradle-plugin", version.ref = "atomicfu" }
|
|
maven-publish = { module = "com.vanniktech:gradle-maven-publish-plugin", version.ref = "mavenPublish" }
|
|
|
|
# Kotlinx libraries
|
|
kotlin-logging = { group = "io.github.oshai", name = "kotlin-logging", version.ref = "logging" }
|
|
kotlinx-collections-immutable = { group = "org.jetbrains.kotlinx", name = "kotlinx-collections-immutable", version.ref = "collections-immutable" }
|
|
kotlinx-coroutines-core = { group = "org.jetbrains.kotlinx", name = "kotlinx-coroutines-core", version.ref = "coroutines" }
|
|
kotlinx-coroutines-core-wasm = { group = "org.jetbrains.kotlinx", name = "kotlinx-coroutines-core-wasm-js", version.ref = "coroutines" }
|
|
kotlinx-io-core = { group = "org.jetbrains.kotlinx", name = "kotlinx-io-core", version.ref = "kotlinx-io" }
|
|
kotlinx-serialization-json = { group = "org.jetbrains.kotlinx", name = "kotlinx-serialization-json", version.ref = "serialization" }
|
|
|
|
# Ktor
|
|
ktor-client-apache5 = { group = "io.ktor", name = "ktor-client-apache5", version.ref = "ktor" }
|
|
ktor-client-auth = { group = "io.ktor", name = "ktor-client-auth", version.ref = "ktor" }
|
|
ktor-client-core = { group = "io.ktor", name = "ktor-client-core", version.ref = "ktor" }
|
|
ktor-client-logging = { group = "io.ktor", name = "ktor-client-logging", version.ref = "ktor" }
|
|
ktor-server-content-negotiation = { group = "io.ktor", name = "ktor-server-content-negotiation", version.ref = "ktor" }
|
|
ktor-client-content-negotiation = { group = "io.ktor", name = "ktor-client-content-negotiation", version.ref = "ktor" }
|
|
ktor-serialization = { group = "io.ktor", name = "ktor-serialization-kotlinx-json", version.ref = "ktor" }
|
|
ktor-server-auth = { group = "io.ktor", name = "ktor-server-auth", version.ref = "ktor" }
|
|
ktor-server-core = { group = "io.ktor", name = "ktor-server-core", version.ref = "ktor" }
|
|
ktor-server-sse = { group = "io.ktor", name = "ktor-server-sse", version.ref = "ktor" }
|
|
ktor-server-websockets = { group = "io.ktor", name = "ktor-server-websockets", version.ref = "ktor" }
|
|
|
|
# Testing
|
|
awaitility = { group = "org.awaitility", name = "awaitility-kotlin", version.ref = "awaitility" }
|
|
kotest-assertions-core = { group = "io.kotest", name = "kotest-assertions-core", version.ref = "kotest" }
|
|
kotest-assertions-json = { group = "io.kotest", name = "kotest-assertions-json", version.ref = "kotest" }
|
|
kotest-assertions-ktor = { group = "io.kotest", name = "kotest-assertions-ktor", version.ref = "kotest" }
|
|
kotlinx-coroutines-test = { group = "org.jetbrains.kotlinx", name = "kotlinx-coroutines-test", version.ref = "coroutines" }
|
|
ktor-client-mock = { group = "io.ktor", name = "ktor-client-mock", version.ref = "ktor" }
|
|
ktor-server-test-host = { group = "io.ktor", name = "ktor-server-test-host", version.ref = "ktor" }
|
|
mockk = { module = "io.mockk:mockk", version.ref = "mockk" }
|
|
netty-bom = { group = "io.netty", name = "netty-bom", version.ref = "netty" }
|
|
slf4j-simple = { group = "org.slf4j", name = "slf4j-simple", version.ref = "slf4j" }
|
|
logback-classic = { group = "ch.qos.logback", name = "logback-classic", version.ref = "logback" }
|
|
junit-jupiter-params = { module = "org.junit.jupiter:junit-jupiter-params", version.ref = "junit" }
|
|
|
|
# Samples
|
|
ktor-client-cio = { group = "io.ktor", name = "ktor-client-cio", version.ref = "ktor" }
|
|
ktor-server-cio = { group = "io.ktor", name = "ktor-server-cio", version.ref = "ktor" }
|
|
|
|
[plugins]
|
|
kotlinx-binary-compatibility-validator = { id = "org.jetbrains.kotlinx.binary-compatibility-validator", version.ref = "binaryCompatibilityValidatorPlugin" }
|
|
kover = { id = "org.jetbrains.kotlinx.kover", version.ref = "kover" }
|
|
ktlint = { id = "org.jlleitschuh.gradle.ktlint", version.ref = "ktlint" }
|
|
knit = { id = "org.jetbrains.kotlinx.knit", version.ref = "knit" }
|