-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 16 Oct 2026 00:22:08 +0200 Source: apache-log4j2 Architecture: source Version: 2.26.1-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> Changed-By: Emmanuel Bourg <ebourg@apache.org> Closes: 1109751 1123744 1133846 1133847 1133848 1141960 Changes: apache-log4j2 (2.26.1-1) unstable; urgency=medium . * Team upload. . [ tony mancill ] * New upstream version 2.26.1 Addresses the following CVEs: - CVE-2025-68161 (Closes: #1123744) - CVE-2026-34479 (Closes: #1133848) - CVE-2026-34480 (Closes: #1133847) - CVE-2026-34481 (Closes: #1133846) - CVE-2026-49844 (Closes: #1141960) * Exclude Build-Depends: groovy (Closes: #1109751) Thank you to Bastian Germann for the patch. * Add libjspecify to Build-Depends * Drop MongoDB appender support (log4j-mongodb) until a newer version of the MongoDB driver (libmongodb-java) is available. * Update Debian poms for added/removed modules in upstream 2.26.1 * Update debian/rules to set POM revision property to upstream package version * Update d/maven.rules and ignoreRules for new upstream release * Freshen and add patches needed for new upstream release * Bump Standards-Version to 4.7.4 . [ Emmanuel Bourg ] * Removed the Priority field * Converted debian/watch to the version 5 format Checksums-Sha1: 4966ab762d538660fe35a4715fd921e217804fcb 2907 apache-log4j2_2.26.1-1.dsc 2b1231ddc0725f19038ceb7c0d1a211eb147e3f3 1551040 apache-log4j2_2.26.1.orig.tar.xz ef2fb65d208fbc9ded85030d6abe4f111afac92e 10848 apache-log4j2_2.26.1-1.debian.tar.xz 5afb3c6afd9cc5a71ab8d058dc563eec61142668 16031 apache-log4j2_2.26.1-1_source.buildinfo Checksums-Sha256: 9df9cc67b8abdc1dc76ab729f8655c78cece7ab12a0ecc798e7567019c89339e 2907 apache-log4j2_2.26.1-1.dsc aa9007f3f03c838d008f43b6e165955a1ef6f258ad0c91366bac2dda74ce29fa 1551040 apache-log4j2_2.26.1.orig.tar.xz 8b2935e05cd5c19372306eabcf02ae96012b168e79c2e9fe38852226c25c5df9 10848 apache-log4j2_2.26.1-1.debian.tar.xz 90c46b6accbc099bc02a8aaaeb2f49ac8e1e66fc1dd8a405c89d188d01581184 16031 apache-log4j2_2.26.1-1_source.buildinfo Files: 0df3b46099fed287028f50aac4b9f2f2 2907 java optional apache-log4j2_2.26.1-1.dsc 10273152b26afa5a289d6e8f7f17d008 1551040 java optional apache-log4j2_2.26.1.orig.tar.xz 3df1e64eb457c6151c14fe2dd5943c28 10848 java optional apache-log4j2_2.26.1-1.debian.tar.xz a7a09b805636c8a48235851c1c46e193 16031 java optional apache-log4j2_2.26.1-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrRUkkSHGVib3VyZ0Bh cGFjaGUub3JnAAoJEPUTxBnkudCsqZEP/jxWo4B9qsr8rP5osHmv/DWT1nDyEtYs ZTDpQt78B4opRXMnvqHhfEa39XB1mJSkbgEDBHiBTjrCjZYNiLRXpYd7kvk2gMzV uSYKGNjTpfyNnZvr1AEzAZi+o0+DpdVGXIrCVIE4l/yjas3zC3tFc8BmCAYr3m1O ve/V8ZgOOHe3Fa5F7ovWrRaXpC1E+SUz7R0jKQjXy6kU5CSgfQsVPxBQs+Hfv+wp sz6Vw5ayxUjYlXjc8OI6c/w/FNoIE38KHgpFfVnJxAOmB4lH8aFiahx5BItz6AZD HS54e3q45uaJzQKZo+XuAwV/xxTerRkQtiDkPhN/yxGYOksG86Fmxb32JN2oW7ip HZyQJCwMTxO5/Zw2A0F+oxo7d9humN11Ql/2c+Vz1FsYb1UQU34TKKaNzWnq01L7 4mRuRnEDMMf/FfchqxyvxI1z8KeMZJtf4PkOx0Krx3iRZz6Gl2jft2cIkTAEVcmB O0QWGWPCTuonmybyvBk8BR1wBzOoARFPyxkXnoUjWX5LtdO9WPcXl/BghGbYuLJb UrR77BU8GGIFwZ/gGHv4hjsBzE5ITCMDxLbdCdsNi2lokQfZM7M+TVW98RFdJfYh 2IwzoyJuGnqW82svZkaiBbGKg45bpbYR0Ygd42rdLXzY8JpIt3+v1w1IPGZOmpzr UnbiYZ9+od/F =MCpb -----END PGP SIGNATURE-----
