)]}'
{
  "commit": "bcb875966dd0cceff9fd1e5c09b268f5ba49d19f",
  "tree": "ffd69e507bdbfa3db9c91936cb5a5f73ca4b8595",
  "parents": [
    "96c77914baf43cc274b69f2415a84529c6882974"
  ],
  "author": {
    "name": "David Ostrovsky",
    "email": "david@ostrovsky.org",
    "time": "Sat Oct 24 16:35:30 2026 +0200"
  },
  "committer": {
    "name": "David Ostrovsky",
    "email": "david@ostrovsky.org",
    "time": "Sat Oct 24 16:56:01 2026 +0200"
  },
  "message": "Exclude end-of-life log4j 1.x from the flogger backend\n\nAdding the CycloneDX SBOM scan for gitiles (//:gitiles_sbom_scan, Trivy\nover the generated SBOM) surfaced log4j:log4j 1.2.15 shipping in\ngitiles.war with six CVEs, three of them CRITICAL: CVE-2019-17571,\nCVE-2022-23305 and CVE-2022-23307, plus CVE-2021-4104, CVE-2022-23302 and\nCVE-2023-26464. This is end-of-life log4j 1.x with no fixed release.\n\nflogger-log4j-backend pulls log4j:log4j in transitively. reload4j, the\npatched drop-in fork, is already a direct dependency and provides the same\nclasses, so exclude log4j:log4j from the backend\u0027s transitive closure and\nre-pin. gitiles.war now ships reload4j-1.2.26.jar alone; the vulnerable\nlog4j-1.2.15.jar is gone. Gerrit keeps log4j 1.x out the same way.\n\nChange-Id: I09b20eb11cae70acec87cccf96b82acf1f0eb3c6\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "bd118b4ebb69e16159edfec5aa11e065c8a75021",
      "old_mode": 33261,
      "old_path": "external_deps.lock.json",
      "new_id": "ae05010fc0eec5fc8e4ce88b07f72698b65d3fdb",
      "new_mode": 33261,
      "new_path": "external_deps.lock.json"
    },
    {
      "type": "modify",
      "old_id": "198558f17e89a587a696da570a99ece4c4831a18",
      "old_mode": 33188,
      "old_path": "tools/java_deps.MODULE.bazel",
      "new_id": "bbed0368984c8f3ac31e2f3ad611707e98f83bfa",
      "new_mode": 33188,
      "new_path": "tools/java_deps.MODULE.bazel"
    }
  ]
}