Skip to content

Conversation

@ppkarwasz
Copy link
Contributor

This PR adds information about the support status of various Apache Log4j releases.

Related to #1867

This PR introduces a new `versioning` page under *Support* that summarizes the support status of Apache Log4j releases and documents the long-standing project policy:

* Log4j follows semantic versioning.
* Only the latest minor of the latest major receives patch releases for bug and security fixes.
* Vulnerability reports are accepted for **all** `2.x` releases.
* Log4j `1.x` is EOL and no longer accepts vulnerability reports.

Related to #1867
Fixes #3988
@ppkarwasz
Copy link
Contributor Author

Closes #3988

@vy, sorry for the force push, but this PR has been opened for so long that I totally forgot it was already submitted.

@ppkarwasz ppkarwasz requested a review from vy December 5, 2025 13:00
Copy link

@FreeAndNil FreeAndNil left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Member

@vy vy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't reviewed the most recent changes yet. But in its current state, it creates yet another page that needs to be updated during a release, and we should not merge this without reflecting this on the release instructions.

Can we programmatically populate this content? Reuse some existing properties in pom.xml? (Adding yet another property to pom.xml that needs to be manually updated during a release is not a better option.)

@ppkarwasz
Copy link
Contributor Author

I added more precise release instructions in apache/logging-parent#453, but lifecycle documentation can’t really be automated today. Lifecycle events (endOfDevelopment, endOfSupport, endOfLife) depend on PMC policy decisions and must be applied manually by the release manager.

ATR will simplify this in the future (see apache/tooling-trusted-releases#183), so adding project-specific automation now doesn’t seem worthwhile.

The Log4j release automation you built has saved days of work across a dozen releases and is finally paying off. Automating lifecycle information would offer far smaller benefits.

Copy link
Member

@vy vy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've tried to shorten the content (e.g., no need to list versions in the policy page) and fixed/improved some typesetting. I still think this is a maintenance burden for a feature that no user has asked for. If it happens to be forgotten during a release, I trust that @FreeAndNil and @ppkarwasz will volunteer to fix it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: To triage

Development

Successfully merging this pull request may close these issues.

3 participants