<?xml version="1.0"?>
<!--

   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
   The ASF licenses this file to You under the Apache License, Version 2.0
   (the "License"); you may not use this file except in compliance with
   the License.  You may obtain a copy of the License at

       https://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

-->
<!--
This file is also used by the maven-changes-plugin to generate the release notes.
Useful ways of finding items to add to this file are:

1.  Add items when you fix a bug or add a feature (this makes the
release process easy :-).

2.  Do a JIRA search for tickets closed since the previous release.

3.  Use the report generated by the maven-changelog-plugin to see all
SVN commits. TBA how to use this with SVN.

To generate the release notes from this file:

mvn changes:announcement-generate -Prelease-notes [-Dchanges.version=nn]
then tweak the formatting if necessary
and commit

The <action> type attribute can be add,update,fix,remove.
-->

<document xmlns="http://maven.apache.org/changes/2.0.0" 
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
  xsi:schemaLocation="http://maven.apache.org/changes/2.0.0 https://maven.apache.org/xsd/changes-2.0.0.xsd">
  <properties>
    <title>Release Notes</title>
  </properties>
  <body>
    <release version="1.4.0" date="2026-06-11" description="This is a feature and maintenance release. Java 8 or later is required.">
      <!-- FIX -->
      <action dev="ggregory" type="fix" due-to="Gary Gregory">Use the new Apache oak leaf logo.</action>
      <action dev="ggregory" type="fix" due-to="Stanimir Stamenkov, Gary Gregory">Fix broken URLs in website links.</action>
      <!-- ADD -->
      <action dev="ggregory" type="fix" due-to="Kiril Keranov, Gary Gregory">Add support for Jakarta servlets, see org.apache.commons.logging.jakarta.ServletContextCleaner #419.</action>
      <!-- UPDATE -->
      <action dev="ggregory" type="update" due-to="Gary Gregory">Bump org.apache.commons:commons-parent from 97 to 102.</action>
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump log4j2.version from 2.25.3 to 2.26.0.</action>
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18.</action>
    </release>
    <release version="1.3.6" date="2026-03-04" description="This is a feature and maintenance release. Java 8 or later is required.">
      <!-- FIX -->
      <action dev="ggregory" type="fix" due-to="Gary Gregory">Fix running spotbugs:check: Unable to parse configuration of mojo.</action>
      <action dev="ggregory" type="fix" due-to="Gary Gregory">Update deprecated call in PathableClassLoader.addLogicalLib(String).</action>
      <action dev="ggregory" type="fix" due-to="Gary Gregory">Fix malformed Javadoc comments.</action>
      <action dev="ggregory" type="fix" due-to="Gary Gregory">Fix log level in Slf4jLogFactory.error(Object, Throwable) #416.</action>
      <!-- ADD -->
      <!-- UPDATE -->
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump org.apache.commons:commons-parent from 81 to 97 #361, #367, #388, #409, #410.</action>
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump org.slf4j:slf4j-api from 2.0.16 to 2.0.17 #344.</action>
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump com.h3xstream.findsecbugs:findsecbugs-plugin from 1.13.0 to 1.14.0 #360.</action>
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump log4j2.version from 2.24.3 to 2.25.3 #371, #412.</action>
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0 #373.</action>
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump ch.qos.logback:logback-core from 1.3.14 to 1.3.16 #411..</action>
    </release>
    <release version="1.3.5" date="2025-01-31" description="This is a feature and maintenance release. Java 8 or later is required.">
      <!-- FIX -->
      <action dev="ggregory" type="fix" due-to="Gary Gregory">Javadoc is missing its Overview page.</action>
      <action dev="ggregory" type="fix" due-to="Gary Gregory">Remove -nouses directive from maven-bundle-plugin. OSGi package imports now state 'uses' definitions for package imports, this doesn't affect JPMS (from org.apache.commons:commons-parent:80).</action>
      <!-- ADD -->
      <!-- UPDATE -->
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump org.apache.commons:commons-parent from 72 to 81 #285, #287, #295, #298, #303, #310, #339.</action>
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump org.apache.commons:commons-lang3 from 3.16.0 to 3.17.0 #288 [test].</action>
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump log4j2.version from 2.23.1 to 2.24.3 #292, #299, #319, #328.</action>
      <!-- REMOVE -->
      <action type="remove" dev="ggregory" due-to="Gary Gregory">Remove "cobertura" plugin, we use JaCoco, Cobertura is unmaintained.</action>
    </release>
    <release version="1.3.4" date="2024-08-16" description="This is a feature and maintenance release. Java 8 or later is required.">
      <!-- FIX -->
      <action dev="pkarwasz" issue="LOGGING-192" type="fix" due-to="Björn Kautler, Piotr Karwasz">Fix factory loading from context class loader #280, #281.</action>
      <!-- ADD -->
      <!-- UPDATE -->
      <action dev="ggregory" type="update" due-to="Gary Gregory">Bump org.apache.commons:commons-parent from 71 to 72.</action>
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">Bump org.slf4j:slf4j-api from 2.0.13 to 2.0.16 #276, #282.</action>
    </release>
    <release version="1.3.3" date="2024-06-30" description="This is a feature and maintenance release. Java 8 or later is required.">
      <!-- FIX -->
      <action dev="ggregory" type="fix" issue="LOGGING-193" due-to="Philippe Marschall">Update Log4j 2 OSGi imports #268.</action> 
      <action dev="ggregory" type="fix" due-to="Gary Gregory">Fix PMD UnnecessaryFullyQualifiedName in SimpleLog.</action>
      <action dev="ggregory" type="fix" due-to="Gary Gregory">Fix NullPointerException in SimpleLog#write(Object) on null input.</action>
      <action dev="ggregory" type="fix" due-to="Gary Gregory">Fix NullPointerException in SimpleLog#write(StringBuffer) on null input.</action>
      <!-- ADD -->
      <!-- UPDATE -->
      <action dev="ggregory" type="update" due-to="Dependabot">Bump org.apache.commons:commons-parent from 69 to 71 #267.</action>
    </release>
    <release version="1.3.2" date="2024-05-11" description="This is a feature and maintenance release. Java 8 or later is required.">
      <action dev="ggregory" issue="LOGGING-190" type="fix" due-to="Hannes Wellmann, Gary Gregory, Johan Compagner">Add OSGi metadata to enable Service Loader Mediator #234.</action>
      <action dev="ggregory" issue="LOGGING-191" type="fix" due-to="Hannes Wellmann, Gary Gregory, Johan Compagner">Apache commons logging shows 1.4 as latest release instead of 1.3.1.</action>
      <action dev="ggregory" type="fix" due-to="Gary Gregory">Deprecate org.apache.commons.logging.LogSource.jdk14IsAvailable.</action>
      <!-- UPDATE -->
      <action dev="ggregory" type="update" due-to="Dependabot">Bump org.apache.commons:commons-parent from 67 to 69 #240.</action>
      <action dev="ggregory" type="update" due-to="Dependabot">Bump org.slf4j:slf4j-api from 2.0.12 to 2.0.13 #248.</action>
    </release>
    <release version="1.3.1" date="2024-03-16" description="This is a feature and maintenance release. Java 8 or later is required.">
      <!-- ADD -->
      <action type="add" dev="ggregory" due-to="Gary Gregory">Add Maven property project.build.outputTimestamp for build reproducibility.</action>
      <!-- FIX -->
      <action dev="ggregory" type="fix" due-to="Elliotte Rusty Harold">Remove references to very old JDK and Commons Logging versions #201.</action>
      <action dev="ggregory" type="fix" due-to="Gary Gregory, Piotr P. Karwasz">Update from Logj 1 to the Log4j 2 API compatibility layer #231.</action>
      <action dev="ggregory" type="fix" due-to="Václav Haisman">Allow Servlet 4 in OSGi environment #191.</action>
      <action dev="ggregory" type="fix" due-to="Elliotte Rusty Harold">Fix generics warnings #213.</action>
      <action dev="ggregory" issue="LOGGING-189" type="fix" due-to="Václav Haisman, Sebb, Hannes Wellmann, Gary Gregory, Piotr P. Karwasz">Fix Import-Package entry for org.slf4j #188.</action>
      <!-- UPDATE -->
      <action dev="ggregory" type="update" due-to="Dependabot">Bump org.apache.commons:commons-parent from 65 to 67.</action>
      <action dev="ggregory" type="update" due-to="Dependabot, Piotr P. Karwasz">Bump log4j2.version from 2.21.1 to 2.23.1 #187, #230.</action>
      <action dev="ggregory" type="update" due-to="Dependabot">Bump org.slf4j:slf4j-api from 2.0.9 to 2.0.12 #207.</action>
      <action dev="ggregory" type="update" due-to="Dependabot, Gary Gregory">Bump ch.qos.logback:logback-classic from 1.3.11 to 1.3.14 #212.</action>
      <action dev="ggregory" type="update" due-to="Dependabot, Gary Gregory">Bump ch.qos.logback:logback-core from 1.3.11 to 1.3.14 #211.</action>
      <action dev="ggregory" type="update" due-to="Dependabot">Bump com.h3xstream.findsecbugs:findsecbugs-plugin from 1.12.0 to 1.13.0.</action>
      <action dev="ggregory" type="update" due-to="Dependabot">Bump logkit from 1.0.1 to 2.0 #32.</action>
    </release>
    <release version="1.3.0" date="2023-11-26" description="This is a feature and maintenance release. Java 8 or later is required.">
      <!-- ADD -->
      <action dev="ggregory" type="add" due-to="Piotr P. Karwasz">
        Add support for Log4j API and SLF4J #177.
      </action>
      <!-- REMOVE -->
      <action dev="ggregory" type="add" due-to="Piotr P. Karwasz">
        Deprecate org.apache.commons.logging.impl.WeakHashtable without replacement.
      </action>
      <action issue="LOGGING-188" dev="pkarwasz" type="add" due-to="Piotr P. Karwasz">
        Deprecate and disable `Jdk13LumberjackLogger` and `Log4JLogger`.
      </action>
      <action issue="LOGGING-173" dev="pkarwasz" type="add" due-to="SingingBush">
        Deprecate and disable `AvalonLogger` and `LogKitLogger`.
      </action>
      <!-- FIX -->
      <action issue="LOGGING-165" dev="britter" type="add">
        Add Automatic-Module-Name Manifest Header for Java 9 compatibility.
      </action>
      <action issue="LOGGING-163" dev="ggregory" type="fix" due-to="Kaloyan Spiridonov">
        BufferedReader is not closed properly.
      </action>
      <action issue="LOGGING-177" dev="ggregory" type="fix" due-to="Arturo Bernal">
        Remove redundant initializer #46
      </action>
      <action dev="ggregory" type="fix" due-to="Jakob van Kruijssen, Bruno P. Kinoshita, Gary Gregory">
        Use a weak reference for the cached class loader #71.
      </action>
      <action dev="ggregory" type="fix" due-to="xiaozhiliaoo">
        Add more entries to .gitignore file #25.
      </action>
      <action dev="ggregory" type="fix" due-to="Arturo Bernal">
        Minor Improvements #34.
      </action>
      <action type="fix" dev="ggregory" due-to="step-security-bot, Gary Gregory">
        [StepSecurity] ci: Harden GitHub Actions #145.
      </action>
      <action issue="LOGGING-185" type="fix" dev="pkarwasz" due-to="Piotr P. Karwasz">
        Replace custom code with `ServiceLoader` call.
      </action>
      <action type="fix" dev="ggregory" due-to="Gary Gregory">
        Fix possible NPEs in LogFactoryImpl.
      </action>
      <action type="fix" issue="LOGGING-185" dev="ggregory" due-to="Piotr P. Karwasz">
        Fix failing tests #180.
      </action>
      <action type="fix" dev="ggregory" due-to="Gary Gregory">
        Deprecate LogConfigurationException.cause in favor of getCause().
      </action>
      <action type="fix" dev="ggregory" due-to="Gary Gregory">
        Fix SpotBugs [ERROR] High: Found reliance on default encoding in org.apache.commons.logging.LogFactory.initDiagnostics(): new java.io.PrintStream(OutputStream) [org.apache.commons.logging.LogFactory] At LogFactory.java:[line 1205] DM_DEFAULT_ENCODING.
      </action>
      <action type="fix" dev="ggregory" due-to="Gary Gregory">
        Fix SpotBugs [ERROR] Medium: Class org.apache.commons.logging.impl.WeakHashtable defines non-transient non-serializable instance field queue [org.apache.commons.logging.impl.WeakHashtable] In WeakHashtable.java SE_BAD_FIELD.
      </action>
      <action type="fix" dev="ggregory" due-to="Piotr P. Karwasz">
        Set java.logging as optional module #183.
      </action>
      <action type="fix" dev="ggregory" due-to="Gary Gregory">
        Fix SpotBugs [ERROR] Medium: Switch statement found in org.apache.commons.logging.impl.SimpleLog.log(int, Object, Throwable) where default case is missing [org.apache.commons.logging.impl.SimpleLog] At SimpleLog.java:[lines 505-522] SF_SWITCH_NO_DEFAULT.
      </action>
      <action type="fix" dev="ggregory" due-to="Gary Gregory">
        Deprecate org.apache.commons.logging.impl.Jdk13LumberjackLogger.dummyLevel without replacement.
      </action>
      <!-- UPDATE -->
      <action dev="ggregory" type="update" due-to="Gary Gregory">
        Bump Java from 6 to 8.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot, Gary Gregory">
        Bump actions/cache from 2 to 3.0.10 #50, #77, #95, #98, #107, #110.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot, Gary Gregory">
        Bump actions/checkout from 2.3.1 to 3.1.0, #24, #63, #75, #109.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot, Gary Gregory">
        Bump actions/setup-java from 1.4.0 to 3.5.1 #21.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot, Gary Gregory">
        Bump junit from 3.8.1 to 5.9.1 Vintage #23, #38.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot">
        Bump clirr-maven-plugin from 2.2.2 to 2.8 #14.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot">
        Bump findbugs-maven-plugin from 2.5.2 to 3.0.5 #8.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot, Gary Gregory">
        Bump maven-failsafe-plugin from 2.12 to 3.0.0-M7 #31, #91.
      </action>
      <action dev="ggregory" type="update" due-to="Gary Gregory">
        Bump spotbugs-surefire-plugin from 2.22.2 to 3.0.0-M5.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot">
        Bump maven-dependency-plugin from 2.4 to 3.5.0 #29, #79, #117, #131.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot">
        Bump maven-pmd-plugin from 3.3 to 3.19.0 #28, #90, #100, #103.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot">
        Bump maven-assembly-plugin from 2.5 to 3.4.2 #30, #94, #96.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot">
        Bump servlet-api from 2.3 to 2.5 #27.
      </action>
      <action dev="ggregory" type="update" due-to="Gary Gregory, Dependabot">
        Bump maven-checkstyle-plugin from 2.7 to 3.2.1 #35, #101, #130.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot">
        Bump spotbugs-maven-plugin from 4.1.4 to 4.7.2.1 #33, #70, #78, #93, #97, #102, #112.
      </action>
      <action dev="ggregory" type="update" due-to="Dependabot">
        Bump spotbugs from 4.5.3 to 4.7.3 #81, #87, #92, #104, #115.
      </action>
      <action dev="kinow" type="update" due-to="Dependabot, Gary Gregory">
        Bump commons-parent from 52 to 65 #82, #106, #122, #126, #143.
      </action>
      <action dev="kinow" type="update" due-to="Dependabot">
        Bump github/codeql-action from 1 to 2 #86.
      </action>
    </release>
    <release version="1.2" date="2014-07-11" description="This is a maintenance release containing bug fixes. Java 6 or later is required.">
      <action issue="LOGGING-37" dev="tn" type="fix" due-to="Matthias Ernst,Archie Cobbs">
        Improve performance of LogFactory#getFactory() by calling Thread#currentThread()#getContextClassLoader()
        directly instead of using reflection. As a consequence support for JDK 1.1 has been dropped.
      </action>
      <action issue="LOGGING-156" dev="tn" type="fix" due-to="Mikolaj Izdebski">
        Fix SecurityAllowedTestCase when executed with OpenJDK 1.7 due to an additional required RuntimePermission.
      </action>
      <action issue="LOGGING-157" dev="tn" type="fix" due-to="Ville Skyttä">
        Fix javadoc to comply with javadoc tool from jdk 1.8.
      </action>
    </release>
    <release version="1.1.3" date="2013-05-23" description="This is a maintenance release containing bug fixes.">
      <action issue="LOGGING-151" dev="tn" type="fix" due-to="Krzysztof Daniel">
        Use "org.apache.commons.logging" as bundle symbolic name.
      </action>
    </release>
    <release version="1.1.2" date="2013-03-20" description="This is a maintenance release containing bug fixes.">
      <action issue="LOGGING-124" dev="tn" type="fix" due-to="Christian Schneider">
        The jar manifest now contains proper OSGi-related metadata information.
      </action>
      <action issue="LOGGING-144" dev="tn" type="fix" due-to="Sebastian Bazley">
        LogFactory and LogFactoryImpl will not swallow certain errors anymore (ThreadDeath
        and VirtualMachineError).
      </action>
      <action issue="LOGGING-135" dev="tn" type="update" due-to="Sebastian Bazley">
        Improved thread-safety for several log adapters, including AvalonLogger, SimpleLog,
        Log4JLogger, LogKitLogger.
      </action>
      <action issue="LOGGING-138" dev="tn" type="update" due-to="Luke Lu">
        In case of a discovery failure now also the stacktrace of the cause will be
        added to the diagnostic message.
      </action>
      <action issue="LOGGING-132" dev="tn" type="fix" due-to="Nathan Niesen">
        Jdk14Logger now correctly uses the specified logger name.
      </action>
      <action issue="LOGGING-133" dev="tn" type="update" due-to="Shevek">
        Change scope of Jdk14Logger.log(Level, String, Throwable) to protected, allowing
        subclasses to modify the logging output.
      </action>
      <action issue="LOGGING-146" dev="tn" type="fix" due-to="Sebastian Bazley">
        Properly synchronize access to protected static field LogFactory.nullClassLoaderFactory.
      </action>
      <action issue="LOGGING-119" dev="tn" type="fix" due-to="Nitzan Niv, Philippe Mouawad">
        Prevent potential deadlock scenario in WeakHashtable.
      </action>
      <action issue="LOGGING-130" dev="sebb" type="fix" due-to="Matthew P. Del Buono">
        Potential missing privileged block for class loader.
      </action>
      <action issue="LOGGING-145" dev="sebb" type="fix">
        LogFactoryImpl.setAttribute - possible NPE.
      </action>
      <action issue="LOGGING-142" dev="sebb" type="fix" due-to="Jingguo Yao">
        Log4JLogger uses deprecated static members of Priority such as INFO.
      </action>
      <action issue="LOGGING-128" dev="sebb" type="fix" due-to="Peter Lawrey">
        Static analysis suggests a number of potential improvements.
      </action>
      <action issue="LOGGING-147" dev="sebb" type="fix">
        SimpleLog.log - unsafe update of shortLogName.
      </action>
      <action issue="LOGGING-148" dev="sebb" type="fix">
        LogFactory.diagnosticPrefix and diagnosticsStream could be final.
      </action>
    </release>
  </body>
</document>
