////
    Licensed to the Apache Software Foundation (ASF) under one or more
    contributor license agreements.  See the NOTICE file distributed with
    this work for additional information regarding copyright ownership.
    The ASF licenses this file to You under the Apache License, Version 2.0
    (the "License"); you may not use this file except in compliance with
    the License.  You may obtain a copy of the License at

         https://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
////

[#release-notes-2-22-0]
== 2.22.0

Release date:: 2023-11-17

:cyclonedx-sbom-link: https://cyclonedx.org/capabilities/sbom/[CycloneDX Software Bill of Materials (SBOM)]
:cyclonedx-vdr-link: https://cyclonedx.org/capabilities/vdr[CycloneDX Vulnerability Disclosure Report (VDR)]

This releases provides a {cyclonedx-sbom-link} along with each artifact and contains bug fixes addressing issues in the JPMS & OSGi infrastructure overhauled in `2.21.0`, dependency updates, and some other minor fixes and improvements.

[#release-notes-2-22-0-sbom]
=== CycloneDX Software Bill of Materials (SBOM)

This is _the first Log4j release_ that provides a {cyclonedx-sbom-link} along with each artifact.
Generated SBOMs are attached as artifacts with `cyclonedx` classifier and XML extensions, that is, `<artifactId>-<version>-cyclonedx.xml`.
They contain `vulnerability-assertion` references to a {cyclonedx-vdr-link} that Apache Logging Services uses for all projects it maintains.
This VDR is accessible through the following URL: https://logging.apache.org/cyclonedx/vdr.xml[]

SBOM generation is streamlined by `logging-parent`, see https://logging.apache.org/logging-parent/latest/#cyclonedx-sbom[its website] for details.


[#release-notes-2-22-0-changed]
=== Changed

* Change the order of evaluation of `FormattedMessage` formatters. Messages are evaluated using `java.util.Format` only if they don't comply to the `java.text.MessageFormat` or `ParameterizedMessage` format. (https://github.com/apache/logging-log4j2/issues/1223[1223])
* Change default encoding of HTTP Basic Authentication to UTF-8 and add `log4j2.configurationAuthorizationEncoding` property to overwrite it. (https://github.com/apache/logging-log4j2/issues/1970[1970])

[#release-notes-2-22-0-fixed]
=== Fixed

* Harden deserialization process by requiring the usage of `FilteredObjectInputStream` on Java 8 and `ObjectInputFilter` on Java 9+ to deserialize custom classes. (https://github.com/apache/logging-log4j2/issues/1884[1906])
* Fix MDC pattern converter causing issues for `%notEmpty` (https://github.com/apache/logging-log4j2/issues/1922[1922])
* Export missing OSGi & JPMS modules in `log4j-layout-template-json` and `log4j-1.2-api` (https://github.com/apache/logging-log4j2/issues/1895[1895])
* Fix `spring-test` dependency scope change (https://issues.apache.org/jira/browse/LOG4J2-3675[LOG4J2-3675])
* Fix JPMS descriptors causing `jlink` issues (https://github.com/apache/logging-log4j2/issues/1896[1896])
* Add missing `Implementation-` and `Specification-` entries to `MANIFEST.MF` (implemented by `logging-parent` version `10.3.0` update) (https://github.com/apache/logging-log4j2/issues/1923[1923])
* Fix `NotSerializableException` thrown when `Logger` is serialized with a `ReusableMessageFactory` (https://github.com/apache/logging-log4j2/issues/1884[1884])

[#release-notes-2-22-0-removed]
=== Removed

* Removed unused `FastDateParser` which was causing unnecessary heap overhead (https://issues.apache.org/jira/browse/LOG4J2-3672[LOG4J2-3672], https://github.com/apache/logging-log4j2/pull/1848[1848])

[#release-notes-2-22-0-updated]
=== Updated

* Update `com.fasterxml.jackson:jackson-bom` to version `2.16.0` (https://github.com/apache/logging-log4j2/pull/1974[1974])
* Update `com.github.luben:zstd-jni` to version `1.5.5-10` (https://github.com/apache/logging-log4j2/pull/1940[1940])
* Update `com.google.guava:guava` to version `32.1.3-jre` (https://github.com/apache/logging-log4j2/pull/1875[1875])
* Update `io.netty:netty-bom` to version `4.1.101.Final` (https://github.com/apache/logging-log4j2/pull/1960[1960])
* Update `org.eclipse.persistence:org.eclipse.persistence.jpa` to version `2.7.13` (https://github.com/apache/logging-log4j2/pull/1900[1900])
* Update `org.fusesource.jansi:jansi` to version `2.4.1` (https://github.com/apache/logging-log4j2/pull/1907[1907])
* Update `org.mongodb:bson` to version `4.11.1` (https://github.com/apache/logging-log4j2/pull/1957[1957])
* Update `org.springframework:spring-framework-bom` to version `5.3.30`
* Update `org.springframework.boot:spring-boot` to version `2.7.17` (https://github.com/apache/logging-log4j2/pull/1874[1874])
* Update `org.springframework:spring-framework-bom` to version `5.3.31` (https://github.com/apache/logging-log4j2/pull/1973[1973])
* Update `org.zeromq:jeromq` to version `0.5.4` (https://github.com/apache/logging-log4j2/pull/1878[1878])
