From f9e84fc52df4060450fa0c9b1eebfa6c22cacf83 Mon Sep 17 00:00:00 2001
From: KevinTen <22876610+kevinten10@users.noreply.github.com>
Date: Thu, 23 Jul 2026 00:02:41 +0800
Subject: [PATCH] security: update Jackson and logging coverage
---
.github/workflows/build_and_test.yml | 11 +++++++++--
README.md | 18 ++++++++++++++++++
README_ZH.md | 15 +++++++++++++++
pom.xml | 2 +-
sdk-springboot/pom.xml | 2 +-
5 files changed, 44 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index 0dce75c..b6d0385 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -10,12 +10,18 @@ permissions:
jobs:
test:
- name: Java ${{ matrix.java }}
+ name: Java ${{ matrix.java }} / Logback ${{ matrix.logback }}
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
- java: ["8", "11"]
+ include:
+ - java: "8"
+ logback: "1.3.16"
+ - java: "11"
+ logback: "1.3.16"
+ - java: "11"
+ logback: "1.5.38"
steps:
- name: Check out source
uses: actions/checkout@v7
@@ -32,5 +38,6 @@ jobs:
-DskipTests=false
-Dcheckstyle.skip=false
-Drat.skip=false
+ -Dlogback.version=${{ matrix.logback }}
-Dmaven.javadoc.skip=true
-Dgpg.skip=true
diff --git a/README.md b/README.md
index b2b609b..8df7352 100644
--- a/README.md
+++ b/README.md
@@ -16,6 +16,24 @@ Capa is a rich-SDK implementation of Cloud Application APIs for Java. Applicatio
- Maven 3.8.1 or later
- A Capa SPI implementation for every capability used by the application
+### Logging compatibility
+
+The Java 8-compatible build pins Logback `1.3.16`. Upstream classifies the
+entire Logback 1.3.x line as end-of-life; maintained Logback 1.5.x releases
+require Java 11 or later. Applications that use the Capa Logback integration
+should choose one of these paths:
+
+- On Java 11 or later, manage `logback-core` and `logback-classic` to `1.5.38`
+ or a later compatible 1.5.x release. CI verifies the repository with
+ `-Dlogback.version=1.5.38`.
+- On Java 8, use the actively maintained Log4j 2 integration where possible,
+ or plan a Java 11 migration before accepting untrusted logging
+ configuration.
+
+See the [Logback download and support status](https://logback.qos.ch/download.html)
+for the current runtime requirements. Do not load logging configuration from
+untrusted sources.
+
## Add the SDK
Current repository version: `1.11.13.2.RELEASE`.
diff --git a/README_ZH.md b/README_ZH.md
index 97d16a6..59df050 100644
--- a/README_ZH.md
+++ b/README_ZH.md
@@ -16,6 +16,21 @@ Capa 是面向 Java 应用的富 SDK 模式 Cloud Application API 实现。应
- Maven 3.8.1 或更高版本
- 为应用实际使用的每项能力提供对应的 Capa SPI 实现
+### 日志依赖兼容性
+
+兼容 Java 8 的构建固定使用 Logback `1.3.16`。Logback 上游已经将整个
+1.3.x 系列标记为停止维护，仍受维护的 1.5.x 系列要求 Java 11 或更高版本。
+使用 Capa Logback 集成的应用应选择以下路径之一：
+
+- Java 11 或更高版本：通过依赖管理将 `logback-core` 和
+ `logback-classic` 更新到 `1.5.38` 或之后兼容的 1.5.x 版本。CI 使用
+ `-Dlogback.version=1.5.38` 验证该组合。
+- Java 8：尽可能使用仍在维护的 Log4j 2 集成；如果应用会接收不可信的日志
+ 配置，应先迁移到 Java 11。
+
+当前运行时要求以 [Logback 下载与支持状态](https://logback.qos.ch/download.html)
+为准。不要从不可信来源加载日志配置。
+
## 引入 SDK
当前仓库版本为 `1.11.13.2.RELEASE`。
diff --git a/pom.xml b/pom.xml
index 5b1d36a..67e3649 100644
--- a/pom.xml
+++ b/pom.xml
@@ -85,7 +85,7 @@
3.3.22.RELEASE
1.7.21
1.39.0
- 2.18.8
+ 2.18.9
1.62.0
5.3.1
3.6.0
diff --git a/sdk-springboot/pom.xml b/sdk-springboot/pom.xml
index 6a81d06..450be52 100644
--- a/sdk-springboot/pom.xml
+++ b/sdk-springboot/pom.xml
@@ -30,7 +30,7 @@
capa-sdk-springboot
- 2.18.8
+ 2.18.9
4.12.0
5.3.39
2.7.18