2026-07-09 Release of logback version 1.5.38

• In HardenedObjectInputStream, fixed a typo preventing Throwable objects from being white-filtered. This issue was reported in PR #1045 by t0rchwo0d.

• A bitwise identical binary of this version can be reproduced by building from source code at commit d04984a41fce42977466f45a2f076f0ee5cc4207 associated with the tag v_1.5.38. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.406...7.21.0-rc.407

• SingleThreadEventExecutor: document Throwable safety contract on run() by @daguimu in https://github.com/netty/netty/pull/16814
• Make HTTP/2 frame hashCode consistent with equals by @daguimu in https://github.com/netty/netty/pull/16692
• Add BlockHound exception for DnsQueryIdSpace (#16896) by @chrisvest in https://github.com/netty/netty/pull/16915
• FlowControlHandler: Fix autoRead behavior by @chrisvest in https://github.com/netty/netty/pull/16912
• Auto-port 4.1: Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize by @netty-project-bot in https://github.com/netty/netty/pull/16911
• MQTT: Fix MQTT decoder size check after variable header replay by @daguimu in https://github.com/netty/netty/pull/16916
• MQTT: Make the decodeProperties early-REPLAY check actually fire by @daguimu in https://github.com/netty/netty/pull/16813
• Reject control characters at the boundary of HTTP method names (#16723) by @chrisvest in https://github.com/netty/netty/pull/16933
• Auto-port 4.1: Update to latest tcnative release by @netty-project-bot in https://github.com/netty/netty/pull/16941
• Auto-port 4.1: Fix HTTP 2 PUSH_PROMISE stream association validation by @netty-project-bot in https://github.com/netty/netty/pull/16955
• Auto-port 4.1: Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder by @netty-project-bot in https://github.com/netty/netty/pull/16957
• Auto-port 4.1: Add opt-in validation of mandatory pseudo-header fields for HTTP/2 by @netty-project-bot in https://github.com/netty/netty/pull/16964
• Strictly validate MQTT UTF-8 Encoded String (#16939) by @chrisvest in https://github.com/netty/netty/pull/16965
• Auto-port 4.1: Stop DateFormatter trailing token from running past the parse end by @netty-project-bot in https://github.com/netty/netty/pull/16968
• Auto-port 4.1: IpFilter: Deprecate constructor which use accept by default by @netty-project-bot in https://github.com/netty/netty/pull/16973
• Add RFC 10008 QUERY Method support (#16966) by @normanmaurer in https://github.com/netty/netty/pull/16978
• Correctly release and fail queued traffic-shaping writes on close (#16959) by @normanmaurer in https://github.com/netty/netty/pull/16976
• Auto-port 4.1: FlowControlHandler: respect auto-read when toggled while dequeueing by @netty-project-bot in https://github.com/netty/netty/pull/16983
• IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout (#16982) by @chrisvest in https://github.com/netty/netty/pull/16989
• Auto-port 4.1: Fix typo in AbstractSniHandler Javadoc by @netty-project-bot in https://github.com/netty/netty/pull/16995
• Auto-port 4.1: Reconcile AbstractCoalescingBufferQueue readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames by @netty-project-bot in https://github.com/netty/netty/pull/16997
• Reject control characters at the boundary of the HTTP version token (#16971) by @normanmaurer in https://github.com/netty/netty/pull/16986
• Auto-port 4.1: Reset UTF-8 decode state on CR in StompSubframeDecoder by @netty-project-bot in https://github.com/netty/netty/pull/17003
• Auto-port 4.1: HTTP2: Pass the correct number of arguments when logging goaway by @netty-project-bot in https://github.com/netty/netty/pull/17017
• FastLz: Guard decompression against truncated input (#17000) by @chrisvest in https://github.com/netty/netty/pull/17015
• Backport 4.1 Fix propagation of startTls for client SslContext handler by @skyguard1 in https://github.com/netty/netty/pull/17020
• Auto-port 4.1: Reject non-token characters in HTTP/2 header names by @netty-project-bot in https://github.com/netty/netty/pull/17022
• Update lz4-java to 1.11.1 by @yawkat in https://github.com/netty/netty/pull/17060
• Pin github actions to reduce risk (#17043) by @normanmaurer in https://github.com/netty/netty/pull/17044
• Merge branches from forks (#17063) by @normanmaurer in https://github.com/netty/netty/pull/17065

Full Changelog: https://github.com/netty/netty/compare/netty-4.1.135.Final...netty-4.1.136.Final

• 6283602: [rb] generate the BiDi protocol layer from the shared binding-neutral schema (#17731) (Titus Fortner) #17731
• 52a6dad: [docs] ADR implementation updates - track by PR number, clarify PR body vs ADR, tracking status by issue (#17697) (Titus Fortner) #17697
• 4c140e1: [build] Add update_cddl script to refresh pinned w3c/webref CDDL files (#17743) (Titus Fortner) #17743
• ee4057c: Add guidance for testing conventions in each language (#16734) (Titus Fortner) #16734
• 15ee583: [build] document .local customization and add PR review guidance (#17756) (Titus Fortner) #17756
• 185e626: [build] fix python linting in format.sh script (Titus Fortner)

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.405...7.21.0-rc.406

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.404...7.21.0-rc.405

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.403...7.21.0-rc.404

• #49524 - IllegalStateException: GlobalOpenTelemetry.set has already been called
• #54999 - Produce ServiceStartBuildItem for OTel
• #55134 - Add regression tests for QuteProcessor
• #55137 - Null boxed Integer and Boolean fields dropped from JSON by reflection-free serializers (Quarkus 3.37)
• #55142 - @JsonProperty is ignored or duplicated + 'visibility'-setting is ignored in 'ObjectMapperCustomizer' by reflection-free Jackson serializers
• #55183 - Fix typo
• #55214 - Reflection-free serializers break Kotlin boolean "is" properties and @JsonProperty annotations
• #55216 - Avoid duplicate fields when using @JsonProperty + improve Kotlin support + obey visibility defined in ObjectMapperCustomizer in reflection-free Jackson serializers
• #55229 - Bump com.ongres.scram:scram-client from 3.2 to 3.3 in /bom/application
• #55238 - Bump SmallRye GraphQL to 2.18.3
• #55254 - [3.37 Regression] quarkus-rest-jackson drops ObjectNode request body fields with reflection-free Jackson enabled
• #55255 - [Reflection-free Jackson deserialisers] Unknown field throws plain JsonMappingException instead of MismatchedInputException, bypassing custom exception mappers
• #55256 - Avoid generating reflection-free Jackson serializers for classes in the jackson.databind package
• #55261 - Reflection-free Jackson deserialisers: @JsonUnwrapped prefix/suffix not honored
• #55278 - Serialize null boxed primitives in reflection-free Jackson serializers
• #55279 - Fix exception thrown in case of unknown field in reflection-free Jackson serializer
• #55280 - Honor @JsonUnwrapped prefix/suffix in reflection-free Jackson serialisers
• #55302 - jackson-module-kotlin incompatible with reflection-free serializers
• #55304 - OIDC: include invalid_dpop_proof in AuthenticationFailedException to clarify why exception was thrown
• #55309 - Opt-out Kotlin classes from generation of reflection-free Jackson serializers
• #55318 - @JsonFormat with pattern on java.time types (e.g. ZonedDateTime, LocalDateTime) ignored by reflection-free Jackson serializers
• #55322 - Fix serialization of java.time fields with custom format in generated reflection-free Jackson serializers
• #55331 - Jackson Reflectionfree Serializer with Raw Types
• #55334 - Fix reflection-free Jackson serializers when using raw types