Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MS7] Branch main overhaul #2 #2016

Closed
vy opened this issue Nov 28, 2023 · 4 comments
Closed

[MS7] Branch main overhaul #2 #2016

vy opened this issue Nov 28, 2023 · 4 comments
Assignees
Labels
STF-Milestones Milestones funded by the Sovereign Tech Fund
Milestone

Comments

@vy
Copy link
Member

vy commented Nov 28, 2023

@vy vy added the STF-Milestones Milestones funded by the Sovereign Tech Fund label Nov 28, 2023
@vy vy added this to the 3.0.0 milestone Nov 28, 2023
@vy vy self-assigned this Nov 28, 2023
@ppkarwasz
Copy link
Contributor

I would also propose to bind #2076 to this task as a cleanup job.

The whole log4j-slf4j-impl should IMHO be removed from 3.x or at least reimplemented in terms of log4j-slf4j2-impl.

@ppkarwasz
Copy link
Contributor

ppkarwasz commented Jan 2, 2024

I am currently working on:

  • log4j-mongodb4

so I marked them as done to prevent collisions.

@ppkarwasz ppkarwasz changed the title [MS7] Unified memory management #2 [MS7] Branch main overhaul #2 Jan 3, 2024
ppkarwasz added a commit to ppkarwasz/logging-log4j2 that referenced this issue Jan 3, 2024
We move `o.a.l.l.core.parser` to the samples repository, since it is
independent from Log4j Core and unused:

apache/logging-log4j-samples@de33cee

This code is potentially (transitively) exploitable each time Jackson
has a deserialization vulnerability.

Part of apache#2016.
ppkarwasz added a commit to ppkarwasz/logging-log4j2 that referenced this issue Jan 3, 2024
We move `o.a.l.l.core.parser` to the samples repository, since it is
independent from Log4j Core and unused:

apache/logging-log4j-samples@de33cee

This code is potentially (transitively) exploitable each time Jackson
has a deserialization vulnerability.

Part of apache#2016.
@ppkarwasz
Copy link
Contributor

ppkarwasz commented Jan 3, 2024

Related to this are PRs that remove additional dependencies from log4j-core:

ppkarwasz added a commit that referenced this issue Jan 3, 2024
The only differences were in the POM file.

Part of #2016.
ppkarwasz added a commit that referenced this issue Jan 4, 2024
We port mostly aesthetical changes from `2.x`.

Part of #2016.
@grobmeier
Copy link
Member

completed

@ppkarwasz ppkarwasz modified the milestones: 3.0.0, 3.0.0-beta2 Feb 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
STF-Milestones Milestones funded by the Sovereign Tech Fund
Projects
None yet
Development

No branches or pull requests

3 participants