build(deps): bump ch.qos.logback:logback-core from 1.5.34 to 1.5.35 in /subclass-sandbox

[dependabot]

Bumps ch.qos.logback:logback-core from 1.5.34 to 1.5.35.

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.5.35

026-06-23 Release of logback version 1.5.35

• The 'condition' attribute in <if> elements now rejects unicode escape sequences (\u and \U). This closes a bypass of the existing prohibition on the new operator in Janino-evaluated conditions. This issue was reported by IcySun (icysun@qq.com) and registered as CVE-2026-13006. Please note that version 1.5.37 provides the full fix to this vulnerability.

• Added ConfiguratorRank.AUTHENTICATING (rank 100), the highest configurator rank, for certified/authenticating configurators discovered via the ServiceLoader mechanism. ContextInitializer now requires that at most one such configurator exist on the classpath; if more than one is found, initialization aborts with an error.

• ConsoleCharsetPropertyDefiner is no longer shipped. The Java 21 multi-release compilation of logback-core has been disabled, which removes this class from the published artifact. Configurations that referenced ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner will need an alternative approach for console charset detection.

• The logback-examples module is now included in artifacts published to Maven Central.

• JoranConfigurator.makeAnotherInstance() and DefaultJoranConfigurator.performMultiStepConfigurationFileSearch() are now protected, allowing derived configurators to override these methods.

• A bitwise identical binary of this version can be reproduced by building from source code at commit 08bd1598d565d83444f72983935e7da4746783b7 associated with the tag v_1.5.35. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

• 08bd159 preapre release 1.5.35
• 37d256b indentation changes only
• d3d7307 minor comment
• fa0411a radomize file location
• 834fdba disable consoleCharset test
• 42eabc3 fix messages in IfModelHandler
• 347efc8 add unicode escape prevention
• 1b6ba73 allow derived classes to override makeAnotherInstance
• 340e8be check for unicode escape codes in Janino conditions
• 4468f5e adding support for certifying configurators
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

PR Summary

Bumps the dependency ch.qos.logback:logback-core from 1.5.34 to 1.5.35 in the subclass-sandbox module by updating the logback.version property in subclass-sandbox/pom.xml. This change is limited to the pom.xml and does not modify code. The upstream 1.5.35 release includes several changes such as: (1) stricter handling of unicode escape sequences in <if> conditions, (2) addition of ConfiguratorRank.AUTHENTICATING, (3) removal of ConsoleCharsetPropertyDefiner, (4) inclusion of the logback-examples module in artifacts, and (5) protected methods for configurators and configuration search. See the release notes for full details.

Changes

File	Summary
subclass-sandbox/pom.xml	Bumped logback-core from 1.5.34 to 1.5.35 in subclass-sandbox by updating the logback.version property. Change limited to pom.xml; no code changes. Release notes for 1.5.35 describe unicode handling improvements in , new configurator rank, removal of ConsoleCharsetPropertyDefiner, publish of logback-examples, and method access changes.

---

autogenerated by presubmit.ai

[github-actions]

✅ LGTM!

Review Summary

Commits Considered (1)

• a0cfe9f: build(deps): bump ch.qos.logback:logback-core in /subclass-sandbox

Bumps ch.qos.logback:logback-core from 1.5.34 to 1.5.35.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.5.35
  dependency-type: direct:production
  ...

Signed-off-by: dependabot[bot] support@github.com

Files Processed (1)

• subclass-sandbox/pom.xml (1 hunk)

Actionable Comments (0)

Skipped Comments (1)

• subclass-sandbox/pom.xml [38-38]

  maintainability: "Align dependent Logback module versions"