Piotr P. Karwasz

Man kann halt nicht vorsichtig genug sein

Jackson 3.0.0 (GA) release now starting! github.com/FasterXML/ja... #java #json #xml #csv #cbor #csv

🚀 Log4j 2.25.0 is out! Highlights include native GraalVM support and improved stack trace control and datetime formatting. Check out the full release notes: logging.apache.org/log4j/2.x/re...

We're teaming up with Open Source Economy to learn what users expect from critical Java libraries like #apache-commons, #httpclient, #log4j, #jackson and more—especially around version support, issues and security. Help us improve support by filling out this short survey: forms.gle/5Ad81MMcL7sy...

I just released version `0.2.0` of SBOM Enforcer Maven Plugin. This plugin does for (CycloneDX) SBOMs what the Maven Enforcer Plugin does for POM files. Although the current number of built-in rules is small, the plugin is extensible and other built-in rules are on their way!

A coalition of CVE Board members launched a new CVE Foundation "to ensure the long-term viability, stability, and independence of the Common Vulnerabilities and Exposures (CVE) Program." www.thecvefoundation.org

Backward compatible alternative to CVE:

"CVE Foundation Launched to Secure the Future of the CVE Program" Please note this is not an official CVE Board action, but the action of a rogue group within the CVE Board to try and save the CVE Program. www.linkedin.com/in/... bsky.app/profile/cve...

Let us analyze the exploitability of vulnerabilities in OSS together. In collaboration with OpenRefactory, we developed a prototype to analyze the exploitability of CVEs all along the dependency chain and submit that data to the OSS projects themselves. More info soon at: github.com/copernik-eu/...

BREAKING. From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.

@apache.org Kafka has released version 4.0.0 and is now using Log4j Core 2 as logging backend! @logging.apache.org

See all the talks of ASF contributors at FOSDEM

Unfortunately AI is not limited to e-mails. We are receiving an increasing number of AI-generated issue reports and we would need an AI to close those reports automatically… 😀

On 11 June, OFE will be in Warsaw to host the next edition of the Capital Series. We would like to extend our sincere gratitude to our sponsor and partners: APELL, Apache Software Foundation, Linux Professional Institute, PIIT, Red Hat. Register: openforumeurope.org/event/capita... #Poland25EU

We’re excited to announce that our upcoming Capital Series Poland will be hosted under the auspices of the Polish presidency of the Council of the European Union on 11 June in Warsaw. Register here to secure a spot and read more: openforumeurope.org/event/capita... #Poland25EU

Did you miss my talk at FOSDEM? Are you wondering what you should do when Log5Shell comes out? The video has been published: video.fosdem.org/2025/ub4132/...

Jan Kowalleck, Sarah Hoffmann, @hugovk.dev, @mklu.bsky.social, Stefan Eissing und Denis Ovsienko sind der erste Jahrgang des Sovereign Tech Fellowship. Wir heißen die sechs Maintainer*innen willkommen, die am einjährigen Pilotprogramm 1/2

This is gold! An AI pretends to be an old confused lady and wastes scammers time. www.theguardian.com/technology/v...

Outlier AI. You are doing it wrong. Hiring people to post completely nonsenese or copy&pasted issues in reputable open-source repositories - and make maintainers train your AI on it ? not good. There are 50 such issues in last few days in @airflow repo [1] and counting. More details in [2] […]

Capital Series is heading to Warsaw on June 11th! 🌍 Join us to explore how #OpenSource can drive Poland's digitalization & security goals during its EU Presidency. 🤝 In partnership with Red Hat Poland, APELL, PIIT, LPI & Apache Software Foundation. More to come! 👉 lnkd.in/e8SeArqb #Poland25eu

Nice guide to navigate through all the events of the EU Open Source week.

Happy New Year to everyone! Now we have less than 1074 days until the Cyber Resilience Act obligations will apply.

After another round of (automatically tested and merged) Dependabot upgrades, my thoughts return to the eternal question: How to inform `libfoo` users that `libfoo` only requires `libbar` 1.0.0 (or later), but I have successfully tested it with `libbar` version 1.23.45?

Had a really good meeting with the #SCITT community today. I keep using their open meetings to get input for the #OWASP Transparency Exchange API - how to add transparency logs and monitor for abuse, changes and manipulation. Software transparency is a lot about trust. #SBOM #TEA

@logging.apache.org, we have just released Apache Log4j `2.24.3`. Log4j API 2.24.3 will be used at the same time by future Log4j Core 2.x and Log4j Core 3.x releases.

#Maven #Java

The release candidate for Apache Log4j 2.24.3 is ready. Plug it into your test environment (Maven repository: repository.apache.org/content/repo...), run your tests and vote on the `dev@logging.apache.org` mailing list. Unless issues are discovered the release will reach GA in 72 hours.

Here are the most important #apache projects by OSSF criticality score: 67. #airflow 92. #arrow 95. #flink 129. #hadoop 153. #camel 160. #kafka 213. #cloudstack 276. #netbeans 313. #shardingsphere 315. #doris 325. #lucene 331. #log4j 360. #solr 423. #pulsar 549. #cassandra 579. #tvm 655. #groovy

And the first KoalaCon is out! Please join us in the effort to build a distributed web of security-related information. TEA will allow you to make well-informed security decisions faster.