Fix factory loading from context class loader #280, #281. Bump org.apache.commons:commons-parent from 71 to 72. Bump org.slf4j:slf4j-api from 2.0.13 to 2.0.16 #276, #282. Update Log4j 2 OSGi imports #268. Fix PMD UnnecessaryFullyQualifiedName in SimpleLog. Fix NullPointerException in SimpleLog#write(Object) on null input. Fix NullPointerException in SimpleLog#write(StringBuffer) on null input. Bump org.apache.commons:commons-parent from 69 to 71 #267. Add OSGi metadata to enable Service Loader Mediator #234. Apache commons logging shows 1.4 as latest release instead of 1.3.1. Deprecate org.apache.commons.logging.LogSource.jdk14IsAvailable. Bump org.apache.commons:commons-parent from 67 to 69 #240. Bump org.slf4j:slf4j-api from 2.0.12 to 2.0.13 #248. Add Maven property project.build.outputTimestamp for build reproducibility. Remove references to very old JDK and Commons Logging versions #201. Update from Logj 1 to the Log4j 2 API compatibility layer #231. Allow Servlet 4 in OSGi environment #191. Fix generics warnings #213. Fix Import-Package entry for org.slf4j #188. Bump org.apache.commons:commons-parent from 65 to 67. Bump log4j2.version from 2.21.1 to 2.23.1 #187, #230. Bump org.slf4j:slf4j-api from 2.0.9 to 2.0.12 #207. Bump ch.qos.logback:logback-classic from 1.3.11 to 1.3.14 #212. Bump ch.qos.logback:logback-core from 1.3.11 to 1.3.14 #211. Bump com.h3xstream.findsecbugs:findsecbugs-plugin from 1.12.0 to 1.13.0. Bump logkit from 1.0.1 to 2.0 #32. Add support for Log4j API and SLF4J #177. Deprecate org.apache.commons.logging.impl.WeakHashtable without replacement. Deprecate and disable `Jdk13LumberjackLogger` and `Log4JLogger`. Deprecate and disable `AvalonLogger` and `LogKitLogger`. Add Automatic-Module-Name Manifest Header for Java 9 compatibility. BufferedReader is not closed properly. Remove redundant initializer #46 Use a weak reference for the cached class loader #71. Add more entries to .gitignore file #25. Minor Improvements #34. [StepSecurity] ci: Harden GitHub Actions #145. Replace custom code with `ServiceLoader` call. Fix possible NPEs in LogFactoryImpl. Fix failing tests #180. Deprecate LogConfigurationException.cause in favor of getCause(). Fix SpotBugs [ERROR] High: Found reliance on default encoding in org.apache.commons.logging.LogFactory.initDiagnostics(): new java.io.PrintStream(OutputStream) [org.apache.commons.logging.LogFactory] At LogFactory.java:[line 1205] DM_DEFAULT_ENCODING. Fix SpotBugs [ERROR] Medium: Class org.apache.commons.logging.impl.WeakHashtable defines non-transient non-serializable instance field queue [org.apache.commons.logging.impl.WeakHashtable] In WeakHashtable.java SE_BAD_FIELD. Set java.logging as optional module #183. Fix SpotBugs [ERROR] Medium: Switch statement found in org.apache.commons.logging.impl.SimpleLog.log(int, Object, Throwable) where default case is missing [org.apache.commons.logging.impl.SimpleLog] At SimpleLog.java:[lines 505-522] SF_SWITCH_NO_DEFAULT. Deprecate org.apache.commons.logging.impl.Jdk13LumberjackLogger.dummyLevel without replacement. Bump Java from 6 to 8. Bump actions/cache from 2 to 3.0.10 #50, #77, #95, #98, #107, #110. Bump actions/checkout from 2.3.1 to 3.1.0, #24, #63, #75, #109. Bump actions/setup-java from 1.4.0 to 3.5.1 #21. Bump junit from 3.8.1 to 5.9.1 Vintage #23, #38. Bump clirr-maven-plugin from 2.2.2 to 2.8 #14. Bump findbugs-maven-plugin from 2.5.2 to 3.0.5 #8. Bump maven-failsafe-plugin from 2.12 to 3.0.0-M7 #31, #91. Bump spotbugs-surefire-plugin from 2.22.2 to 3.0.0-M5. Bump maven-dependency-plugin from 2.4 to 3.5.0 #29, #79, #117, #131. Bump maven-pmd-plugin from 3.3 to 3.19.0 #28, #90, #100, #103. Bump maven-assembly-plugin from 2.5 to 3.4.2 #30, #94, #96. Bump servlet-api from 2.3 to 2.5 #27. Bump maven-checkstyle-plugin from 2.7 to 3.2.1 #35, #101, #130. Bump spotbugs-maven-plugin from 4.1.4 to 4.7.2.1 #33, #70, #78, #93, #97, #102, #112. Bump spotbugs from 4.5.3 to 4.7.3 #81, #87, #92, #104, #115. Bump commons-parent from 52 to 65 #82, #106, #122, #126, #143. Bump github/codeql-action from 1 to 2 #86. Improve performance of LogFactory#getFactory() by calling Thread#currentThread()#getContextClassLoader() directly instead of using reflection. As a consequence support for JDK 1.1 has been dropped. Fix SecurityAllowedTestCase when executed with OpenJDK 1.7 due to an additional required RuntimePermission. Fix javadoc to comply with javadoc tool from jdk 1.8. Use "org.apache.commons.logging" as bundle symbolic name. The jar manifest now contains proper OSGi-related metadata information. LogFactory and LogFactoryImpl will not swallow certain errors anymore (ThreadDeath and VirtualMachineError). Improved thread-safety for several log adapters, including AvalonLogger, SimpleLog, Log4JLogger, LogKitLogger. In case of a discovery failure now also the stacktrace of the cause will be added to the diagnostic message. Jdk14Logger now correctly uses the specified logger name. Change scope of Jdk14Logger.log(Level, String, Throwable) to protected, allowing subclasses to modify the logging output. Properly synchronize access to protected static field LogFactory.nullClassLoaderFactory. Prevent potential deadlock scenario in WeakHashtable. Potential missing privileged block for class loader. LogFactoryImpl.setAttribute - possible NPE. Log4JLogger uses deprecated static members of Priority such as INFO. Static analysis suggests a number of potential improvements. SimpleLog.log - unsafe update of shortLogName. LogFactory.diagnosticPrefix and diagnosticsStream could be final.