STABLE version (ACTIVELY DEVELOPED)

The current actively developed version of logback-core and logback-classic is 1.6.0. It requires JDK 11 or later and SLF4J version 2.0.1 or later at runtime. It was built with JDK 21 and SLF4J version 2.0.18. It contains few optional components such as SMTPAppender and LogbackServletContextListener which depend on Jakarta EE (jakarta.* namespace).

The 1.6.x series is a direct descendant of and a drop-in replacement for the 1.5.x series, with the notable exception of conditionals using Janino (see next section). The 1.6.x series differs from the 1.4.x series by the relocation of the logback-access module to its own separate GitHub repository.

Configuration files using conditionals need to be migrated

In version 1.5.37 and subsequently in 1.6.x, support for Janino-based conditional expressions was removed. Evaluating arbitrary Java expressions with the Janino library had led to numerous security vulnerabilities.

If you are upgrading from a version earlier than 1.5.37 and your configuration files still use those older Janino-style conditionals, you must migrate them to the new format using the <condition> element (available since version 1.5.20).

The <condition> element accepts implementations of the PropertyCondition interface to decide whether a branch of the configuration should apply. Logback-core ships with several implementations of said interface. See the documentation on conditional processing for details.

If you prefer a more mechanical approach for the migration, the online migration service can provide a step-by-step process.

Legacy version: the 1.5.x series

The 1.5.x series is now considered legacy. Migration to version 1.6.x should be straightforward. However, if you are migrating from version 1.5.36 or earlier and use conditionals in configuration files, you will need to migrate your logback.xml files. See the 1.6.x section above.

Older stale versions (END-OF-LIFE)

• The 1.2.x series has reached END-OF-LIFE.
• The 1.3.x series has reached END-OF-LIFE.
• The 1.4.x series has reached END-OF-LIFE.

END-OF-LIFE status means that we have officially ceased active support for the indicated versions. This implies:

• No further feature updates,
• No bug fixes,
• No security patches for newly discovered vulnerabilities.

For those using Spring-boot 2.7 or earlier, it is possible to upgrade to a more recent version of logback-classic by setting the org.springframework.boot.logging.LoggingSystem system property to none.

Logback-access

For logback-access please refer to its dedicated page.

Binaries in Maven central

Logback artifacts such as .jar, .sources.jar and javadoc.jar files can be downloaded from Maven central under the ch.qos.logback groupId.

Verifying contents

Since early 2022, all logback binaries are reproducible. To verify fidelity to the source code, check out the source code from github with the tag corresponding to the version you wish to verify. Build and compare.

All logback artifacts published on Maven central are signed. For each artifact, there is an associated signature file with the .asc suffix. See SECURITY.md for detailed instructions.