Skip to content

build(deps-dev): bump ch.qos.logback:logback-core from 1.5.33 to 1.5.34 in /google-cloud-jar-parent#13785

Merged
whowes merged 1 commit into
mainfrom
dependabot/maven/google-cloud-jar-parent/ch.qos.logback-logback-core-1.5.34
Jul 22, 2026
Merged

build(deps-dev): bump ch.qos.logback:logback-core from 1.5.33 to 1.5.34 in /google-cloud-jar-parent#13785
whowes merged 1 commit into
mainfrom
dependabot/maven/google-cloud-jar-parent/ch.qos.logback-logback-core-1.5.34

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor

Bumps ch.qos.logback:logback-core from 1.5.33 to 1.5.34.

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.5.34

2026-06-01 Release of logback version 1.5.34

• In case certain StackTraceElement values returned by the Throwable.getStackTrace method are null, StackTraceElementProxy substitutes a dummy instance instead of throwing an IllegalArgumentException. This resolves [issues #1040](qos-ch/logback#1040), reported by Naotsugu Kobayashi.

• HardenedObjectInputStream will now throw an InvalidClassException during deserialization attempts of Proxy classes. This change addresses potential deserialization whitelist bypass vulnerability reported by York Shen and registered as CVE-2026-10532.

• A bitwise identical binary of this version can be reproduced by building from source code at commit e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag v_1.5.34. This release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits
  • e62272a prepare release 1.5.34
  • 1e9e926 add resolveProxyClassRejectsDynamicProxies unit test
  • 2de5cbe added StackTraceElementProxyTest, minor edits to AGENTS.md
  • 0e9b927 in case StackTraceElement is null use a substitute, fixing issues/1040
  • f7a0654 prevent resolveProxyClass bypass
  • 249b81f docs are no longer distributed
  • 1c3b26a start work on 1.5.34-SNAPSHOT
  • See full diff in compare view

@dependabot dependabot Bot added dependencies java Pull requests that update java code labels Jul 15, 2026
@dependabot
dependabot Bot requested review from a team as code owners July 15, 2026 22:46
@dependabot dependabot Bot added dependencies java Pull requests that update java code labels Jul 15, 2026
@whowes

whowes commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

Bumps [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) from 1.5.33 to 1.5.34.
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.33...v_1.5.34)

---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.5.34
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/maven/google-cloud-jar-parent/ch.qos.logback-logback-core-1.5.34 branch from 14abae7 to 0d67345 Compare July 22, 2026 15:10
@whowes whowes added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 22, 2026
@whowes
whowes merged commit ec6164a into main Jul 22, 2026
373 of 374 checks passed
@whowes
whowes deleted the dependabot/maven/google-cloud-jar-parent/ch.qos.logback-logback-core-1.5.34 branch July 22, 2026 19:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies java Pull requests that update java code kokoro:force-run Add this label to force Kokoro to re-run the tests.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants