security: update Jackson and logging coverage

Author: kevinten10

.github/workflows/build_and_test.yml

@@ -10,12 +10,18 @@ permissions:
 
 jobs:
   test:
-    name: Java ${{ matrix.java }}
+    name: Java ${{ matrix.java }} / Logback ${{ matrix.logback }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        java: ["8", "11"]
+        include:
+          - java: "8"
+            logback: "1.3.16"
+          - java: "11"
+            logback: "1.3.16"
+          - java: "11"
+            logback: "1.5.38"
     steps:
       - name: Check out source
         uses: actions/checkout@v7
@@ -32,5 +38,6 @@ jobs:
           -DskipTests=false
           -Dcheckstyle.skip=false
           -Drat.skip=false
+          -Dlogback.version=${{ matrix.logback }}
           -Dmaven.javadoc.skip=true
           -Dgpg.skip=true

README.md

@@ -16,6 +16,24 @@ Capa is a rich-SDK implementation of Cloud Application APIs for Java. Applicatio
 - Maven 3.8.1 or later
 - A Capa SPI implementation for every capability used by the application
 
+### Logging compatibility
+
+The Java 8-compatible build pins Logback `1.3.16`. Upstream classifies the
+entire Logback 1.3.x line as end-of-life; maintained Logback 1.5.x releases
+require Java 11 or later. Applications that use the Capa Logback integration
+should choose one of these paths:
+
+- On Java 11 or later, manage `logback-core` and `logback-classic` to `1.5.38`
+  or a later compatible 1.5.x release. CI verifies the repository with
+  `-Dlogback.version=1.5.38`.
+- On Java 8, use the actively maintained Log4j 2 integration where possible,
+  or plan a Java 11 migration before accepting untrusted logging
+  configuration.
+
+See the [Logback download and support status](https://logback.qos.ch/download.html)
+for the current runtime requirements. Do not load logging configuration from
+untrusted sources.
+
 ## Add the SDK
 
 Current repository version: `1.11.13.2.RELEASE`.

README_ZH.md

@@ -16,6 +16,21 @@ Capa 是面向 Java 应用的富 SDK 模式 Cloud Application API 实现。应
 - Maven 3.8.1 或更高版本
 - 为应用实际使用的每项能力提供对应的 Capa SPI 实现
 
+### 日志依赖兼容性
+
+兼容 Java 8 的构建固定使用 Logback `1.3.16`。Logback 上游已经将整个
+1.3.x 系列标记为停止维护，仍受维护的 1.5.x 系列要求 Java 11 或更高版本。
+使用 Capa Logback 集成的应用应选择以下路径之一：
+
+- Java 11 或更高版本：通过依赖管理将 `logback-core` 和
+  `logback-classic` 更新到 `1.5.38` 或之后兼容的 1.5.x 版本。CI 使用
+  `-Dlogback.version=1.5.38` 验证该组合。
+- Java 8：尽可能使用仍在维护的 Log4j 2 集成；如果应用会接收不可信的日志
+  配置，应先迁移到 Java 11。
+
+当前运行时要求以 [Logback 下载与支持状态](https://logback.qos.ch/download.html)
+为准。不要从不可信来源加载日志配置。
+
 ## 引入 SDK
 
 当前仓库版本为 `1.11.13.2.RELEASE`。

pom.xml

@@ -85,7 +85,7 @@
         <reactor-core.version>3.3.22.RELEASE</reactor-core.version>
         <slf4j.version>1.7.21</slf4j.version>
         <grpc.version>1.39.0</grpc.version>
-        <jackson.version>2.18.8</jackson.version>
+        <jackson.version>2.18.9</jackson.version>
         <open.telemetry.version>1.62.0</open.telemetry.version>
         <junit.version>5.3.1</junit.version>
         <mockito-core.version>3.6.0</mockito-core.version>

sdk-springboot/pom.xml

@@ -30,7 +30,7 @@
     <name>capa-sdk-springboot</name>
 
     <properties>
-        <jackson.version>2.18.8</jackson.version>
+        <jackson.version>2.18.9</jackson.version>
         <okhttp.version>4.12.0</okhttp.version>
         <spring-framework.version>5.3.39</spring-framework.version>
         <springboot.version>2.7.18</springboot.version>