Prepare for a release candidate

CONTRIBUTING.md

@@ -49,13 +49,13 @@ Getting Started
 ---------------
 
 + Make sure you have a [JIRA account](https://issues.apache.org/jira/).
-+ Make sure you have a [GitHub account](https://github.com/signup/free).
++ Make sure you have a [GitHub account](https://github.com/signup/free). This is not essential, but makes providing patches much easier.
 + If you're planning to implement a new feature it makes sense to discuss your changes on the [dev list](https://commons.apache.org/mail-lists.html) first. This way you can make sure you're not wasting your time on something that isn't considered to be in Apache Commons Logging's scope.
 + Submit a [Jira Ticket][jira] for your issue, assuming one does not already exist.
   + Clearly describe the issue including steps to reproduce when it is a bug.
   + Make sure you fill in the earliest version that you know has the issue.
 + Find the corresponding [repository on GitHub](https://github.com/apache/?query=commons-),
-[fork](https://help.github.com/articles/fork-a-repo/) and check out your forked repository.
+[fork](https://help.github.com/articles/fork-a-repo/) and check out your forked repository. If you don't have a GitHub account, you can still clone the Commons repository.
 
 Making Changes
 --------------
@@ -109,7 +109,6 @@ Additional Resources
 + [General GitHub documentation](https://help.github.com/)
 + [GitHub pull request documentation](https://help.github.com/articles/creating-a-pull-request/)
 + [Apache Commons Twitter Account](https://twitter.com/ApacheCommons)
-+ `#apache-commons` IRC channel on `irc.freenode.net`
 
 [cla]:https://www.apache.org/licenses/#clas
 [jira]:https://issues.apache.org/jira/browse/LOGGING

README.md

@@ -46,12 +46,12 @@ Apache Commons Logging
 [![Java CI](https://github.com/apache/commons-logging/actions/workflows/maven.yml/badge.svg)](https://github.com/apache/commons-logging/actions/workflows/maven.yml)
 [![Coverage Status](https://codecov.io/gh/apache/commons-logging/branch/master/graph/badge.svg)](https://app.codecov.io/gh/apache/commons-logging)
 [![Maven Central](https://maven-badges.herokuapp.com/maven-central/commons-logging/commons-logging/badge.svg?gav=true)](https://maven-badges.herokuapp.com/maven-central/commons-logging/commons-logging/?gav=true)
-[![Javadocs](https://javadoc.io/badge/commons-logging/commons-logging/1.3.0.svg)](https://javadoc.io/doc/commons-logging/commons-logging/1.3.0)
+[![Javadocs](https://javadoc.io/badge/commons-logging/commons-logging/1.4.0.svg)](https://javadoc.io/doc/commons-logging/commons-logging/1.4.0)
 [![CodeQL](https://github.com/apache/commons-logging/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/apache/commons-logging/actions/workflows/codeql-analysis.yml)
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/apache/commons-logging/badge)](https://api.securityscorecards.dev/projects/github.com/apache/commons-logging)
 
 Apache Commons Logging is a thin adapter allowing configurable bridging to other,
-    well known logging systems.
+    well-known logging systems.
 
 Documentation
 -------------
@@ -70,7 +70,7 @@ Alternatively, you can pull it from  the central Maven repositories:
 <dependency>
   <groupId>commons-logging</groupId>
   <artifactId>commons-logging</artifactId>
-  <version>1.3.0</version>
+  <version>1.4.0</version>
 </dependency>
 ```
 
@@ -112,7 +112,6 @@ Additional Resources
 + [Apache Issue Tracker (JIRA)](https://issues.apache.org/jira/browse/LOGGING)
 + [Apache Commons Slack Channel](https://the-asf.slack.com/archives/C60NVB8AD)
 + [Apache Commons Twitter Account](https://twitter.com/ApacheCommons)
-+ `#apache-commons` IRC channel on `irc.freenode.org`
 
 Apache Commons Components
 -------------------------

RELEASE-NOTES.txt

@@ -1,3 +1,50 @@
+Apache Commons Logging
+Version 1.4.0
+RELEASE NOTES
+
+The Apache Commons Logging team is pleased to announce the release of Apache Commons Logging 1.4.0
+
+Apache Commons Logging is a thin adapter allowing configurable bridging to other,
+well-known logging systems.
+
+This is a feature and maintenance release. Java 8 or later is required.
+
+Changes in this version
+-----------------------
+
+New features
+------------
+
+*               Add Maven property project.build.outputTimestamp for build reproducibility. Thanks to Gary Gregory.
+
+Fixed Bugs
+----------
+
+*               Remove references to very old JDK and Commons Logging versions #201. Thanks to Elliotte Rusty Harold.
+*               Update from Logj 1 to the Log4j 2 API compatibility layer #231. Thanks to Gary Gregory, Piotr P. Karwasz.
+
+Changes
+-------
+
+*               Bump org.apache.commons:commons-parent from 65 to 67. Thanks to Dependabot.
+*               Bump log4j2.version from 2.21.1 to 2.23.1 #187, #230. Thanks to Dependabot, Piotr P. Karwasz.
+*               Bump org.slf4j:slf4j-api from 2.0.9 to 2.0.12 #207. Thanks to Dependabot.
+*               Bump ch.qos.logback:logback-classic from 1.3.11 to 1.3.14 #212. Thanks to Dependabot, Gary Gregory.
+*               Bump ch.qos.logback:logback-core from 1.3.11 to 1.3.14 #211. Thanks to Dependabot, Gary Gregory.
+*               Bump com.h3xstream.findsecbugs:findsecbugs-plugin from 1.12.0 to 1.13.0. Thanks to Dependabot.
+
+
+Historical list of changes: https://commons.apache.org/proper/commons-logging/changes-report.html
+
+Download it from https://commons.apache.org/proper/commons-logging/download_logging.cgi
+
+For complete information on Apache Commons Logging, including instructions on how to submit bug reports,
+patches, or suggestions for improvement, see the Apache Commons Logging website:
+
+https://commons.apache.org/proper/commons-logging/
+
+-----------------------------------------------------------------------------
+
               Apache Commons Logging
                   Version 1.3.0
                   RELEASE NOTES
@@ -11,49 +58,54 @@ This is a feature and maintenance release. Java 8 or later is required.
 
 Changes in this version include:
 
-New features:
+New features
-o               Add support for Log4j API and SLF4J #177. Thanks to Piotr P. Karwasz.
+------------
-o               Deprecate org.apache.commons.logging.impl.WeakHashtable without replacement. Thanks to Piotr P. Karwasz.
+*               Add support for Log4j API and SLF4J #177. Thanks to Piotr P. Karwasz.
-o LOGGING-188:  Deprecate and disable `Jdk13LumberjackLogger` and `Log4JLogger`. Thanks to Piotr P. Karwasz.
+*               Deprecate org.apache.commons.logging.impl.WeakHashtable without replacement. Thanks to Piotr P. Karwasz.
-o LOGGING-173:  Deprecate and disable `AvalonLogger` and `LogKitLogger`. Thanks to SingingBush.
+* LOGGING-188:  Deprecate and disable `Jdk13LumberjackLogger` and `Log4JLogger`. Thanks to Piotr P. Karwasz.
-o LOGGING-165:  Add Automatic-Module-Name Manifest Header for Java 9 compatibility.
+* LOGGING-173:  Deprecate and disable `AvalonLogger` and `LogKitLogger`. Thanks to SingingBush.
+* LOGGING-165:  Add Automatic-Module-Name Manifest Header for Java 9 compatibility.
 
-Fixed Bugs:
+Fixed Bugs
-o LOGGING-163:  BufferedReader is not closed properly. Thanks to Kaloyan Spiridonov.
+----------
-o LOGGING-177:  Remove redundant initializer #46 Thanks to Arturo Bernal.
-o               Use a weak reference for the cached class loader #71. Thanks to Jakob van Kruijssen, Bruno P. Kinoshita, Gary Gregory.
-o               Add more entries to .gitignore file #25. Thanks to xiaozhiliaoo.
-o               Minor Improvements #34. Thanks to Arturo Bernal.
-o               [StepSecurity] ci: Harden GitHub Actions #145. Thanks to step-security-bot, Gary Gregory.
-o LOGGING-185:  Replace custom code with `ServiceLoader` call. Thanks to Piotr P. Karwasz.
-o               Fix possible NPEs in LogFactoryImpl. Thanks to Gary Gregory.
-o LOGGING-185:  Fix failing tests #180. Thanks to Piotr P. Karwasz.
-o               Deprecate LogConfigurationException.cause in favor of getCause(). Thanks to Gary Gregory.
-o               Fix SpotBugs [ERROR] High: Found reliance on default encoding in org.apache.commons.logging.LogFactory.initDiagnostics(): new java.io.PrintStream(OutputStream) [org.apache.commons.logging.LogFactory] At LogFactory.java:[line 1205] DM_DEFAULT_ENCODING. Thanks to Gary Gregory.
-o               Fix SpotBugs [ERROR] Medium: Class org.apache.commons.logging.impl.WeakHashtable defines non-transient non-serializable instance field queue [org.apache.commons.logging.impl.WeakHashtable] In WeakHashtable.java SE_BAD_FIELD. Thanks to Gary Gregory.
-o               Set java.logging as optional module #183. Thanks to Piotr P. Karwasz.
-o               Fix SpotBugs [ERROR] Medium: Switch statement found in org.apache.commons.logging.impl.SimpleLog.log(int, Object, Throwable) where default case is missing [org.apache.commons.logging.impl.SimpleLog] At SimpleLog.java:[lines 505-522] SF_SWITCH_NO_DEFAULT. Thanks to Gary Gregory.
-o               Deprecate org.apache.commons.logging.impl.Jdk13LumberjackLogger.dummyLevel without replacement. Thanks to Gary Gregory.
 
-Changes:
+* LOGGING-163:  BufferedReader is not closed properly. Thanks to Kaloyan Spiridonov.
-o               Bump Java from 6 to 8. Thanks to Gary Gregory.
+* LOGGING-177:  Remove redundant initializer #46 Thanks to Arturo Bernal.
-o               Bump actions/cache from 2 to 3.0.10 #50, #77, #95, #98, #107, #110. Thanks to Dependabot, Gary Gregory.
+*               Use a weak reference for the cached class loader #71. Thanks to Jakob van Kruijssen, Bruno P. Kinoshita, Gary Gregory.
-o               Bump actions/checkout from 2.3.1 to 3.1.0, #24, #63, #75, #109. Thanks to Dependabot, Gary Gregory.
+*               Add more entries to .gitignore file #25. Thanks to xiaozhiliaoo.
-o               Bump actions/setup-java from 1.4.0 to 3.5.1 #21. Thanks to Dependabot, Gary Gregory.
+*               Minor Improvements #34. Thanks to Arturo Bernal.
-o               Bump junit from 3.8.1 to 5.9.1 Vintage #23, #38. Thanks to Dependabot, Gary Gregory.
+*               [StepSecurity] ci: Harden GitHub Actions #145. Thanks to step-security-bot, Gary Gregory.
-o               Bump clirr-maven-plugin from 2.2.2 to 2.8 #14. Thanks to Dependabot.
+* LOGGING-185:  Replace custom code with `ServiceLoader` call. Thanks to Piotr P. Karwasz.
-o               Bump findbugs-maven-plugin from 2.5.2 to 3.0.5 #8. Thanks to Dependabot.
+*               Fix possible NPEs in LogFactoryImpl. Thanks to Gary Gregory.
-o               Bump maven-failsafe-plugin from 2.12 to 3.0.0-M7 #31, #91. Thanks to Dependabot, Gary Gregory.
+* LOGGING-185:  Fix failing tests #180. Thanks to Piotr P. Karwasz.
-o               Bump spotbugs-surefire-plugin from 2.22.2 to 3.0.0-M5. Thanks to Gary Gregory.
+*               Deprecate LogConfigurationException.cause in favor of getCause(). Thanks to Gary Gregory.
-o               Bump maven-dependency-plugin from 2.4 to 3.5.0 #29, #79, #117, #131. Thanks to Dependabot.
+*               Fix SpotBugs [ERROR] High: Found reliance on default encoding in org.apache.commons.logging.LogFactory.initDiagnostics(): new java.io.PrintStream(OutputStream) [org.apache.commons.logging.LogFactory] At LogFactory.java:[line 1205] DM_DEFAULT_ENCODING. Thanks to Gary Gregory.
-o               Bump maven-pmd-plugin from 3.3 to 3.19.0 #28, #90, #100, #103. Thanks to Dependabot.
+*               Fix SpotBugs [ERROR] Medium: Class org.apache.commons.logging.impl.WeakHashtable defines non-transient non-serializable instance field queue [org.apache.commons.logging.impl.WeakHashtable] In WeakHashtable.java SE_BAD_FIELD. Thanks to Gary Gregory.
-o               Bump maven-assembly-plugin from 2.5 to 3.4.2 #30, #94, #96. Thanks to Dependabot.
+*               Set java.logging as optional module #183. Thanks to Piotr P. Karwasz.
-o               Bump servlet-api from 2.3 to 2.5 #27. Thanks to Dependabot.
+*               Fix SpotBugs [ERROR] Medium: Switch statement found in org.apache.commons.logging.impl.SimpleLog.log(int, Object, Throwable) where default case is missing [org.apache.commons.logging.impl.SimpleLog] At SimpleLog.java:[lines 505-522] SF_SWITCH_NO_DEFAULT. Thanks to Gary Gregory.
-o               Bump maven-checkstyle-plugin from 2.7 to 3.2.1 #35, #101, #130. Thanks to Gary Gregory, Dependabot.
+*               Deprecate org.apache.commons.logging.impl.Jdk13LumberjackLogger.dummyLevel without replacement. Thanks to Gary Gregory.
-o               Bump spotbugs-maven-plugin from 4.1.4 to 4.7.2.1 #33, #70, #78, #93, #97, #102, #112. Thanks to Dependabot.
+
-o               Bump spotbugs from 4.5.3 to 4.7.3 #81, #87, #92, #104, #115. Thanks to Dependabot.
+Changes
-o               Bump commons-parent from 52 to 65 #82, #106, #122, #126, #143. Thanks to Dependabot, Gary Gregory.
+-------
-o               Bump github/codeql-action from 1 to 2 #86. Thanks to Dependabot.
+
+*               Bump Java from 6 to 8. Thanks to Gary Gregory.
+*               Bump actions/cache from 2 to 3.0.10 #50, #77, #95, #98, #107, #110. Thanks to Dependabot, Gary Gregory.
+*               Bump actions/checkout from 2.3.1 to 3.1.0, #24, #63, #75, #109. Thanks to Dependabot, Gary Gregory.
+*               Bump actions/setup-java from 1.4.0 to 3.5.1 #21. Thanks to Dependabot, Gary Gregory.
+*               Bump junit from 3.8.1 to 5.9.1 Vintage #23, #38. Thanks to Dependabot, Gary Gregory.
+*               Bump clirr-maven-plugin from 2.2.2 to 2.8 #14. Thanks to Dependabot.
+*               Bump findbugs-maven-plugin from 2.5.2 to 3.0.5 #8. Thanks to Dependabot.
+*               Bump maven-failsafe-plugin from 2.12 to 3.0.0-M7 #31, #91. Thanks to Dependabot, Gary Gregory.
+*               Bump spotbugs-surefire-plugin from 2.22.2 to 3.0.0-M5. Thanks to Gary Gregory.
+*               Bump maven-dependency-plugin from 2.4 to 3.5.0 #29, #79, #117, #131. Thanks to Dependabot.
+*               Bump maven-pmd-plugin from 3.3 to 3.19.0 #28, #90, #100, #103. Thanks to Dependabot.
+*               Bump maven-assembly-plugin from 2.5 to 3.4.2 #30, #94, #96. Thanks to Dependabot.
+*               Bump servlet-api from 2.3 to 2.5 #27. Thanks to Dependabot.
+*               Bump maven-checkstyle-plugin from 2.7 to 3.2.1 #35, #101, #130. Thanks to Gary Gregory, Dependabot.
+*               Bump spotbugs-maven-plugin from 4.1.4 to 4.7.2.1 #33, #70, #78, #93, #97, #102, #112. Thanks to Dependabot.
+*               Bump spotbugs from 4.5.3 to 4.7.3 #81, #87, #92, #104, #115. Thanks to Dependabot.
+*               Bump commons-parent from 52 to 65 #82, #106, #122, #126, #143. Thanks to Dependabot, Gary Gregory.
+*               Bump github/codeql-action from 1 to 2 #86. Thanks to Dependabot.
 
 
 Historical list of changes: https://commons.apache.org/proper/commons-logging/changes-report.html
@@ -65,7 +117,7 @@ patches, or suggestions for improvement, see the Apache Commons Logging website:
 
 https://commons.apache.org/proper/commons-logging/
 
-=============================================================================
+-----------------------------------------------------------------------------
 
 Apache Commons Logging
 Version 1.2
@@ -80,16 +132,19 @@ bridging to other, well-known logging systems.
 This is a maintenance release containing bug fixes.
 Java 1.2 or later is required.
 
-Changes in this version include:
+Changes in this version
+-----------------------
 
-Fixed Bugs:
+Fixed Bugs
-o LOGGING-37:   Improve performance of LogFactory#getFactory() by calling
+----------
+
+* LOGGING-37:   Improve performance of LogFactory#getFactory() by calling
                 Thread#currentThread()#getContextClassLoader() directly instead
                 of using reflection. As a consequence support for JDK 1.1 has
                 been dropped. Thanks to Matthias Ernst, Archie Cobbs.
-o LOGGING-156:  Fix SecurityAllowedTestCase when executed with OpenJDK 1.7 due
+* LOGGING-156:  Fix SecurityAllowedTestCase when executed with OpenJDK 1.7 due
                 to an additional required RuntimePermission. Thanks to Mikolaj Izdebski.
-o LOGGING-157:  Fix javadoc to comply with javadoc tool from jdk 1.8. Thanks to Ville Skyttä.
+* LOGGING-157:  Fix javadoc to comply with javadoc tool from jdk 1.8. Thanks to Ville Skyttä.
 
 
 Historical list of changes: http://commons.apache.org/proper/commons-logging/changes-report.html

src/changes/changes.xml

@@ -43,7 +43,7 @@ The <action> type attribute can be add,update,fix,remove.
     <title>Release Notes</title>
   </properties>
   <body>
-    <release version="1.4.0" date="YYYY-MM-DD" description="This is a feature and maintenance release. Java 8 or later is required.">
+    <release version="1.4.0" date="2024-03-16" description="This is a feature and maintenance release. Java 8 or later is required.">
       <!-- ADD -->
       <action type="add" dev="ggregory" due-to="Gary Gregory">Add Maven property project.build.outputTimestamp for build reproducibility.</action>
       <!-- FIX -->

src/changes/release-notes.vm

@@ -60,7 +60,7 @@ $release.description.replaceAll("  ", "
 #else
 #set($dueto="")
 #end
-o $issue ${action}$dueto
+* $issue ${action}$dueto
 #set($action="")
 #set($issue="")
 #set($dueto="")
@@ -69,24 +69,31 @@ o $issue ${action}$dueto
 #if ($release.getActions().size() == 0)
 No changes defined in this version.
 #else
-Changes in this version include:
+Changes in this version
+-----------------------
 
 #if ($release.getActions('add').size() !=0)
-New features:
+New features
+------------
+
 #foreach($actionItem in $release.getActions('add'))
 #processaction()
 #end 
 #end
 
 #if ($release.getActions('fix').size() !=0)
-Fixed Bugs:
+Fixed Bugs
+----------
+
 #foreach($actionItem in $release.getActions('fix'))
 #processaction()
 #end
 #end
 
 #if ($release.getActions('update').size() !=0)
-Changes:
+Changes
+-------
+
 #foreach($actionItem in $release.getActions('update'))
 #processaction()
 #end
@@ -110,5 +117,4 @@ patches, or suggestions for improvement, see the ${project.name} website:
 
 ${project.url}
 
-
+-----------------------------------------------------------------------------
-=============================================================================

src/site/xdoc/download_logging.xml

@@ -113,32 +113,32 @@ limitations under the License.
       </p>
     </subsection>
     </section>
-    <section name="Apache Commons Logging 1.3.0 ">
+    <section name="Apache Commons Logging 1.4.0 ">
       <subsection name="Binaries">
         <table>
           <tr>
-              <td><a href="[preferred]/commons/logging/binaries/commons-logging-1.3.0-bin.tar.gz">commons-logging-1.3.0-bin.tar.gz</a></td>
+              <td><a href="[preferred]/commons/logging/binaries/commons-logging-1.4.0-bin.tar.gz">commons-logging-1.4.0-bin.tar.gz</a></td>
-              <td><a href="https://downloads.apache.org/commons/logging/binaries/commons-logging-1.3.0-bin.tar.gz.sha512">sha512</a></td>
+              <td><a href="https://downloads.apache.org/commons/logging/binaries/commons-logging-1.4.0-bin.tar.gz.sha512">sha512</a></td>
-              <td><a href="https://downloads.apache.org/commons/logging/binaries/commons-logging-1.3.0-bin.tar.gz.asc">pgp</a></td>
+              <td><a href="https://downloads.apache.org/commons/logging/binaries/commons-logging-1.4.0-bin.tar.gz.asc">pgp</a></td>
           </tr>
           <tr>
-              <td><a href="[preferred]/commons/logging/binaries/commons-logging-1.3.0-bin.zip">commons-logging-1.3.0-bin.zip</a></td>
+              <td><a href="[preferred]/commons/logging/binaries/commons-logging-1.4.0-bin.zip">commons-logging-1.4.0-bin.zip</a></td>
-              <td><a href="https://downloads.apache.org/commons/logging/binaries/commons-logging-1.3.0-bin.zip.sha512">sha512</a></td>
+              <td><a href="https://downloads.apache.org/commons/logging/binaries/commons-logging-1.4.0-bin.zip.sha512">sha512</a></td>
-              <td><a href="https://downloads.apache.org/commons/logging/binaries/commons-logging-1.3.0-bin.zip.asc">pgp</a></td>
+              <td><a href="https://downloads.apache.org/commons/logging/binaries/commons-logging-1.4.0-bin.zip.asc">pgp</a></td>
           </tr>
         </table>
       </subsection>
       <subsection name="Source">
         <table>
           <tr>
-              <td><a href="[preferred]/commons/logging/source/commons-logging-1.3.0-src.tar.gz">commons-logging-1.3.0-src.tar.gz</a></td>
+              <td><a href="[preferred]/commons/logging/source/commons-logging-1.4.0-src.tar.gz">commons-logging-1.4.0-src.tar.gz</a></td>
-              <td><a href="https://downloads.apache.org/commons/logging/source/commons-logging-1.3.0-src.tar.gz.sha512">sha512</a></td>
+              <td><a href="https://downloads.apache.org/commons/logging/source/commons-logging-1.4.0-src.tar.gz.sha512">sha512</a></td>
-              <td><a href="https://downloads.apache.org/commons/logging/source/commons-logging-1.3.0-src.tar.gz.asc">pgp</a></td>
+              <td><a href="https://downloads.apache.org/commons/logging/source/commons-logging-1.4.0-src.tar.gz.asc">pgp</a></td>
           </tr>
           <tr>
-              <td><a href="[preferred]/commons/logging/source/commons-logging-1.3.0-src.zip">commons-logging-1.3.0-src.zip</a></td>
+              <td><a href="[preferred]/commons/logging/source/commons-logging-1.4.0-src.zip">commons-logging-1.4.0-src.zip</a></td>
-              <td><a href="https://downloads.apache.org/commons/logging/source/commons-logging-1.3.0-src.zip.sha512">sha512</a></td>
+              <td><a href="https://downloads.apache.org/commons/logging/source/commons-logging-1.4.0-src.zip.sha512">sha512</a></td>
-              <td><a href="https://downloads.apache.org/commons/logging/source/commons-logging-1.3.0-src.zip.asc">pgp</a></td>
+              <td><a href="https://downloads.apache.org/commons/logging/source/commons-logging-1.4.0-src.zip.asc">pgp</a></td>
           </tr>
         </table>
       </subsection>