deps: update dependency ch.qos.logback:logback-core to v1.5.19 [security] #3963
Conversation
trusted-contributions-gcf
bot
added
the
kokoro:force-run
Summary of ChangesHello @renovate-bot, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request focuses on a crucial security update, upgrading the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the ch.qos.logback:logback-core dependency to version 1.5.19 to address a security vulnerability. The update is applied in two separate Maven profiles within java-showcase/gapic-showcase/pom.xml.
While the intention to patch a security vulnerability is correct, the changes as proposed introduce issues:
- In the
slf4j2_logbackprofile,logback-coreis updated butlogback-classicis left at an older version, creating a version mismatch that is risky. - In the
disabledLoggingprofile, updatinglogback-coreto1.5.19creates a critical incompatibility with the SLF4J 1.x API used in that profile, which will cause runtime failures. This profile seems to have pre-existing version inconsistencies that are exacerbated by this change.
I have added detailed comments on the respective lines with explanations and suggestions for how to resolve these issues.
| <groupId>ch.qos.logback</groupId> | ||
| <artifactId>logback-core</artifactId> | ||
| <version>1.3.15</version> | ||
| <version>1.5.19</version> |
There was a problem hiding this comment.
This update introduces a critical incompatibility. The disabledLogging profile uses slf4j-api:1.7.36 (defined on line 330), but logback-core version 1.5.19 requires slf4j-api version 2.0.0 or higher. This mismatch will cause runtime errors like NoSuchMethodError.
This profile also has a version mismatch between logback-classic:1.2.13 and logback-core:1.5.19.
The previous version 1.3.15 was also incompatible with SLF4J 1.7.x.
To resolve this, the logging dependencies in this profile must be aligned. Given the other dependencies in this profile (slf4j-api:1.7.36 and logback-classic:1.2.13), it seems this profile is intended for SLF4J 1.x. If so, logback-core should be a version compatible with that, like 1.2.13. If an upgrade is necessary for security, the entire logging stack in this profile (slf4j-api, logback-classic, logback-core) should be upgraded to compatible versions (e.g., SLF4J 2.x and Logback 1.5.x).
| <groupId>ch.qos.logback</groupId> | ||
| <artifactId>logback-core</artifactId> | ||
| <version>1.5.16</version> | ||
| <version>1.5.19</version> |
There was a problem hiding this comment.
While updating logback-core to 1.5.19 is correct for the security fix, the corresponding logback-classic dependency on line 247 is still at 1.5.16. It is best practice to keep all modules of Logback at the same version to prevent potential runtime issues. Please consider updating logback-classic to 1.5.19 as well in this profile.
1 participant
This PR contains the following updates:
1.3.15->1.5.191.5.16->1.5.19Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2025-11226
QOS.CH logback-core versions up to 1.5.18 contain an ACE vulnerability in conditional configuration file processing in Java applications. This vulnerability allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting a malicious environment variable before program execution.
A successful attack requires the Janino library and Spring Framework to be present on the user's class path. Additionally, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privileges.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.