apache-log4j2 (2.26.1-1) [PTS] [DDPO]

OK: VCS matches the version in the archive

Git: https://salsa.debian.org/java-team/apache-log4j2.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: master
Path: debian/changelog
Repo size: 12300288
Browser: https://salsa.debian.org/java-team/apache-log4j2
Last scan: 2026-10-16 03:00:30+00
Next scan: 2026-10-24 12:33:00+00
Merge requests: 3

Debian changelog in Git:

apache-log4j2 (2.26.1-1) unstable; urgency=medium

  * Team upload.

  [ tony mancill ]
  * New upstream version 2.26.1
    Addresses the following CVEs:
    - CVE-2025-68161 (Closes: #1123744)
    - CVE-2026-34479 (Closes: #1133848)
    - CVE-2026-34480 (Closes: #1133847)
    - CVE-2026-34481 (Closes: #1133846)
    - CVE-2026-49844 (Closes: #1141960)
  * Exclude Build-Depends: groovy (Closes: #1109751)
    Thank you to Bastian Germann for the patch.
  * Add libjspecify to Build-Depends
  * Drop MongoDB appender support (log4j-mongodb) until a newer version
    of the MongoDB driver (libmongodb-java) is available.
  * Update Debian poms for added/removed modules in upstream 2.26.1
  * Update debian/rules to set POM revision property to upstream package version
  * Update d/maven.rules and ignoreRules for new upstream release
  * Freshen and add patches needed for new upstream release
  * Bump Standards-Version to 4.7.4

  [ Emmanuel Bourg ]
  * Removed the Priority field
  * Converted debian/watch to the version 5 format

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 16 Oct 2026 00:22:08 +0200

This branch is even with tag debian/2.26.1-1