Improve release notes

src/changelog/.changelog.adoc.ftl

@@ -17,6 +17,7 @@
 <#if entriesByType?size gt 0>
 <#list entriesByType as entryType, entries>
 
+[#release-notes-${release.version?replace("[^a-zA-Z0-9]", "-", "r")}-${entryType?capitalize}]
 === ${entryType?capitalize}
 
 <#list entries as entry>

src/changelog/2.22.0/.release-notes.adoc.ftl

@@ -20,6 +20,19 @@
 
 <#if release.date?has_content>Release date:: ${release.date}</#if>
 
-This releases contains bug fixes addressing issues in the JPMS & OSGi infrastructure overhauled in `2.21.0`, dependency updates, and some other minor fixes and improvements.
+:cyclonedx-sbom-link: https://cyclonedx.org/capabilities/sbom/[CycloneDX Software Bill of Materials (SBOM)]
+:cyclonedx-vdr-link: https://cyclonedx.org/capabilities/vdr[CycloneDX Vulnerability Disclosure Report (VDR)]
+
+This releases provides a {cyclonedx-sbom-link} along with each artifact and contains bug fixes addressing issues in the JPMS & OSGi infrastructure overhauled in `2.21.0`, dependency updates, and some other minor fixes and improvements.
+
+[#release-notes-${release.version?replace("[^a-zA-Z0-9]", "-", "r")}-sbom]
+=== CycloneDX Software Bill of Materials (SBOM)
+
+This is _the first Log4j release_ that provides a {cyclonedx-sbom-link} along with each artifact.
+Generated SBOMs are attached as artifacts with `cyclonedx` classifier and XML extensions, that is, `<artifactId>-<version>-cyclonedx.xml`.
+They contain `vulnerability-assertion` references to a {cyclonedx-vdr-link} that Apache Logging Services uses for all projects it maintains.
+This VDR is accessible through the following URL: https://logging.apache.org/cyclonedx/vdr.xml[]
+
+SBOM generation is streamlined by `logging-parent`, see https://logging.apache.org/logging-parent/latest/#cyclonedx-sbom[its website] for details.
 
 <#include "../.changelog.adoc.ftl">

src/site/_release-notes/_2.0-alpha1.adoc

@@ -39,10 +39,12 @@
 Release date:: 2012-07-29
 
 
+[#release-notes-2-0-alpha1-Added]
 === Added
 
 * Added ability to filter on the AppenderRef by adding either a level or a filter. (https://issues.apache.org/jira/browse/LOG4J2-60[LOG4J2-60])
 
+[#release-notes-2-0-alpha1-Fixed]
 === Fixed
 
 * Make sure all application facing log methods use their own FQCN. This patch resolves a unit test failure for the %C pattern when using the Category logger. (https://issues.apache.org/jira/browse/LOG4J2-50[LOG4J2-50])

src/site/_release-notes/_2.0-alpha2.adoc

@@ -39,13 +39,15 @@
 Release date:: 2012-08-24
 
 
+[#release-notes-2-0-alpha2-Added]
 === Added
 
 * Allow components besides core to create a PluginMap for faster plugin loading and not having to specify the plugin package in the configuration. (https://issues.apache.org/jira/browse/LOG4J2-67[LOG4J2-67])
 * Add support for formatting using String.format(). (https://issues.apache.org/jira/browse/LOG4J2-68[LOG4J2-68])
 * Allow Flume agents to be embedded into the Flume Appender. (https://issues.apache.org/jira/browse/LOG4J2-69[LOG4J2-69])
 * Add getLogger(Class) to LogManager. (https://issues.apache.org/jira/browse/LOG4J2-70[LOG4J2-70])
 
+[#release-notes-2-0-alpha2-Fixed]
 === Fixed
 
 * Fix compilation problems in Java 7. (https://issues.apache.org/jira/browse/LOG4J2-64[LOG4J2-64])

src/site/_release-notes/_2.0-beta1.adoc

@@ -39,14 +39,17 @@
 Release date:: 2012-09-18
 
 
+[#release-notes-2-0-beta1-Added]
 === Added
 
 * Added AsynchAppender.
 
+[#release-notes-2-0-beta1-Changed]
 === Changed
 
 * Update the versions of SLF4J and Logback.
 
+[#release-notes-2-0-beta1-Fixed]
 === Fixed
 
 * Created web module to allow web applications to include the Log4j context listener in WEB-INF/lib even if Log4j is in the container's class path. Allow locating the LoggerContext to include the ClassLoader. Updated the Loader utility to always choose the child ClassLoader. Verified in Jboss 5 and Tomcat.

src/site/_release-notes/_2.0-beta2.adoc

@@ -39,6 +39,7 @@
 Release date:: 2012-10-07
 
 
+[#release-notes-2-0-beta2-Added]
 === Added
 
 * Add getFormats to MultiformatMessage and allow StructuredDataMessage to format as XML.
@@ -49,10 +50,12 @@ Release date:: 2012-10-07
 * If system property "disableThreadContextMap" is set puts to the ThreadContext will be ignored. If system property "disableThreadContext" is set both puts and pushes will be ignored. (https://issues.apache.org/jira/browse/LOG4J2-83[LOG4J2-83])
 * If system property "disableThreadContextStack" is set pushes to the ThreadContext will be ignored. If system property "disableThreadContext" is set both puts and pushes will be ignored. (https://issues.apache.org/jira/browse/LOG4J2-84[LOG4J2-84])
 
+[#release-notes-2-0-beta2-Changed]
 === Changed
 
 * Made ParameterizedMessage, StringFormattedMessage and ThreadDumpMessage immutable. LocalizedMessage is immutable except that it will be updated with the logger name when it is added to the LogEvent.
 
+[#release-notes-2-0-beta2-Fixed]
 === Fixed
 
 * DefaultConfiguration was not starting the Console Appender.

src/site/_release-notes/_2.0-beta3.adoc

@@ -39,11 +39,13 @@
 Release date:: 2012-11-11
 
 
+[#release-notes-2-0-beta3-Added]
 === Added
 
 * Added PropertiesRewritePolicy and ability to define properties on a Logger. (https://issues.apache.org/jira/browse/LOG4J2-28[LOG4J2-28])
 * Added ability to configure from an InputSource. (https://issues.apache.org/jira/browse/LOG4J2-55[LOG4J2-55])
 
+[#release-notes-2-0-beta3-Changed]
 === Changed
 
 * Created combined jar to combine API and Core contents for users who only want the Log4j implementation.
@@ -52,6 +54,7 @@ Release date:: 2012-11-11
 * Add ThreadContext.push(String format, Object... args) (https://issues.apache.org/jira/browse/LOG4J2-85[LOG4J2-85])
 * Build pdf of user's guide. (https://issues.apache.org/jira/browse/LOG4J2-87[LOG4J2-87])
 
+[#release-notes-2-0-beta3-Fixed]
 === Fixed
 
 * Avoid NPE when duplicate LoggerContextFactorys are present. Allow factories to specify a weight to allow real implementations to outrank test implementations. Provide a simple default LoggerContextFactory.

src/site/_release-notes/_2.0-beta4.adoc

@@ -39,6 +39,7 @@
 Release date:: 2013-01-28
 
 
+[#release-notes-2-0-beta4-Added]
 === Added
 
 * Add MessageFormatMessage and FormattedMessage.
@@ -49,13 +50,15 @@ Release date:: 2013-01-28
 * Allow custom message creation via a message factory. (https://issues.apache.org/jira/browse/LOG4J2-133[LOG4J2-133])
 * Use %red, %white, %blue, and so on in the console appender. (https://issues.apache.org/jira/browse/LOG4J2-134[LOG4J2-134])
 
+[#release-notes-2-0-beta4-Changed]
 === Changed
 
 * Renamed log4j12-api to log4j-1.2-api. (https://issues.apache.org/jira/browse/LOG4J2-110[LOG4J2-110])
 * Add unit test to verify exceptions are thrown when the socket connection fails. (https://issues.apache.org/jira/browse/LOG4J2-122[LOG4J2-122])
 * Add follow attribute to Console Appender. (https://issues.apache.org/jira/browse/LOG4J2-128[LOG4J2-128])
 * Allow newlines to be escaped in Syslog and RFC5424 layouts. Allow Throwables to be included in the output from RFC5424Layout. (https://issues.apache.org/jira/browse/LOG4J2-136[LOG4J2-136])
 
+[#release-notes-2-0-beta4-Fixed]
 === Fixed
 
 * Allow FlumeAvroManager to initialize even if it cannot connect to an agent.

src/site/_release-notes/_2.0-beta5.adoc

@@ -39,6 +39,7 @@
 Release date:: 2013-04-20
 
 
+[#release-notes-2-0-beta5-Added]
 === Added
 
 * Added FlumePersistentManager which writes to BerkeleyDB and then writes to Flume asynchronously.
@@ -49,6 +50,7 @@ Release date:: 2013-04-20
 * Add tag library. (https://issues.apache.org/jira/browse/LOG4J2-187[LOG4J2-187])
 * Add JMX support. (https://issues.apache.org/jira/browse/LOG4J2-207[LOG4J2-207])
 
+[#release-notes-2-0-beta5-Changed]
 === Changed
 
 * Allow Logger and LoggerContext to be subclassed. (https://issues.apache.org/jira/browse/LOG4J2-151[LOG4J2-151])
@@ -59,6 +61,7 @@ Release date:: 2013-04-20
 * Move async subproject into core. (https://issues.apache.org/jira/browse/LOG4J2-208[LOG4J2-208])
 * Async documentation update. (https://issues.apache.org/jira/browse/LOG4J2-214[LOG4J2-214])
 
+[#release-notes-2-0-beta5-Fixed]
 === Fixed
 
 * Add Fragment-Host to MANIFEST.MF for log4j-core. (https://issues.apache.org/jira/browse/LOG4J2-159[LOG4J2-159])

src/site/_release-notes/_2.0-beta6.adoc

@@ -39,6 +39,7 @@
 Release date:: 2013-05-05
 
 
+[#release-notes-2-0-beta6-Changed]
 === Changed
 
 * Documentation updates to clarify use and impact of location in pattern layouts. (https://issues.apache.org/jira/browse/LOG4J2-225[LOG4J2-225])
@@ -48,6 +49,7 @@ Release date:: 2013-05-05
 * Removed CheckStyle false positives for NewlineAtEndOfFile and whitespace following '*' at end of line in javadoc.
 * Renamed AsynchAppender to AsyncAppender. Plugin name became Async (was Asynch).
 
+[#release-notes-2-0-beta6-Fixed]
 === Fixed
 
 * Use OSGi version format in Fragment-Host (https://issues.apache.org/jira/browse/LOG4J2-159[LOG4J2-159])

src/site/_release-notes/_2.0-beta7.adoc

@@ -39,12 +39,14 @@
 Release date:: 2013-06-01
 
 
+[#release-notes-2-0-beta7-Added]
 === Added
 
 * Break up core into multiple osgi jars. (https://issues.apache.org/jira/browse/LOG4J2-10[LOG4J2-10])
 * New JDBC, JPA, and NoSQL database Appenders. (https://issues.apache.org/jira/browse/LOG4J2-229[LOG4J2-229])
 * Provide configuration information (location, content type, content if possible) via a registered Advertiser. (https://issues.apache.org/jira/browse/LOG4J2-251[LOG4J2-251])
 
+[#release-notes-2-0-beta7-Changed]
 === Changed
 
 * Improve ThreadContext performance with copy-on-write map and stack. (https://issues.apache.org/jira/browse/LOG4J2-154[LOG4J2-154])
@@ -53,6 +55,7 @@ Release date:: 2013-06-01
 * Add support for interceptors in the embedded Flume Appender. (https://issues.apache.org/jira/browse/LOG4J2-262[LOG4J2-262])
 * Method name changes in interface org.apache.logging.log4j.spi.ThreadContextMap: getContext() to getCopy(), get() to getImmutableMapOrNull().
 
+[#release-notes-2-0-beta7-Fixed]
 === Fixed
 
 * Remove LoggerContext when LoggerContext is stopped. (https://issues.apache.org/jira/browse/LOG4J2-223[LOG4J2-223])

src/site/_release-notes/_2.0-beta8.adoc

@@ -39,6 +39,7 @@
 Release date:: 2013-07-10
 
 
+[#release-notes-2-0-beta8-Changed]
 === Changed
 
 * Include arbitrary message fields in RFC-5424 structured data. (https://issues.apache.org/jira/browse/LOG4J2-168[LOG4J2-168])
@@ -56,6 +57,7 @@ Release date:: 2013-07-10
 * Add printf methods to Logger API. (https://issues.apache.org/jira/browse/LOG4J2-301[LOG4J2-301])
 * Update NoSQL dependencies: lightcouch 0.0.6 from 0.0.5, mongodb 2.11.2 from 2.11.1. (https://issues.apache.org/jira/browse/LOG4J2-386[LOG4J2-386])
 
+[#release-notes-2-0-beta8-Fixed]
 === Fixed
 
 * Fix NullPointerException (regression due to fix for LOG4J2-228) (https://issues.apache.org/jira/browse/LOG4J2-139[LOG4J2-139])

src/site/_release-notes/_2.0-beta9.adoc

@@ -39,6 +39,7 @@
 Release date:: 2013-09-14
 
 
+[#release-notes-2-0-beta9-Added]
 === Added
 
 * Added FAQ page to the site. (https://issues.apache.org/jira/browse/LOG4J2-253[LOG4J2-253])
@@ -55,6 +56,7 @@ Release date:: 2013-09-14
 * [Pattern Layout] Customize level names to lower-case. (https://issues.apache.org/jira/browse/LOG4J2-384[LOG4J2-384])
 * Allow the default file rollover strategy to define the compression level. (https://issues.apache.org/jira/browse/LOG4J2-399[LOG4J2-399])
 
+[#release-notes-2-0-beta9-Changed]
 === Changed
 
 * Changed the (relatively new) PatternLayout configuration attribute "suppressExceptions" to "alwaysWriteExceptions" to more correctly indicate what it does. As such, the meaning of this attribute has reversed (previous "true"s should become "false"s, and vice versa). Since this was an undocumented attribute up until now, it's unlikely this change will affect any users.
@@ -74,6 +76,7 @@ Release date:: 2013-09-14
 * Update Java Mail dependency to 1.5.0 from 1.4.7. (https://issues.apache.org/jira/browse/LOG4J2-388[LOG4J2-388])
 * Update HSQLDB dependency to 2.3.0 from 2.2.9. (https://issues.apache.org/jira/browse/LOG4J2-390[LOG4J2-390])
 
+[#release-notes-2-0-beta9-Fixed]
 === Fixed
 
 * The slf4j-ext jar is now an optional dependency of the SLF4J bridge. (https://issues.apache.org/jira/browse/LOG4J2-165[LOG4J2-165])

src/site/_release-notes/_2.0-rc1.adoc

@@ -39,6 +39,7 @@
 Release date:: 2014-02-16
 
 
+[#release-notes-2-0-rc1-Added]
 === Added
 
 * Configure FileAppender buffer size. (https://issues.apache.org/jira/browse/LOG4J2-401[LOG4J2-401])
@@ -52,6 +53,7 @@ Release date:: 2014-02-16
 * Documentation fix: The attribute of Route to refer to an appender is "ref" not "AppenderRef". (https://issues.apache.org/jira/browse/LOG4J2-482[LOG4J2-482])
 * (JMX) JMX Client GUI should dynamically update when LoggerContext MBeans are registered/unregistered in MBean server. (https://issues.apache.org/jira/browse/LOG4J2-530[LOG4J2-530])
 
+[#release-notes-2-0-rc1-Changed]
 === Changed
 
 * PatternLayout option to not output ANSI escape codes if no Console is available. (https://issues.apache.org/jira/browse/LOG4J2-413[LOG4J2-413])
@@ -63,10 +65,12 @@ Release date:: 2014-02-16
 * Resource leak in Flume appender when it cannot create a BerkeleyDB db. (https://issues.apache.org/jira/browse/LOG4J2-532[LOG4J2-532])
 * Renamed the org.apache.logging.log4j.core.appender.db.nosql.couch package to org.apache.logging.log4j.core.appender.db.nosql.couchdb.
 
+[#release-notes-2-0-rc1-Removed]
 === Removed
 
 * Removed the DataSourceConnectionSource and the <DriverManager> plugin for the JDBC Appender. It is not safe to use. Please use the DataSource or factory connection sources backed by a connection pool.
 
+[#release-notes-2-0-rc1-Fixed]
 === Fixed
 
 * Resolved memory leak by releasing reference to ThreadLocal when AsyncLogger is stopped. (https://issues.apache.org/jira/browse/LOG4J2-323[LOG4J2-323])

src/site/_release-notes/_2.0-rc2.adoc

@@ -39,6 +39,7 @@
 Release date:: 2014-06-21
 
 
+[#release-notes-2-0-rc2-Added]
 === Added
 
 * Add support for configuration via YAML. (https://issues.apache.org/jira/browse/LOG4J2-427[LOG4J2-427])
@@ -55,6 +56,7 @@ Release date:: 2014-06-21
 * Made RollingFileAppender buffer size configurable. (https://issues.apache.org/jira/browse/LOG4J2-674[LOG4J2-674])
 * RollingFile and RollingRandomAccessFile now write the layout footer before rollover. (https://issues.apache.org/jira/browse/LOG4J2-675[LOG4J2-675])
 
+[#release-notes-2-0-rc2-Changed]
 === Changed
 
 * Refactor Log4jLogEvent to lazily create ThrowableProxy. (https://issues.apache.org/jira/browse/LOG4J2-250[LOG4J2-250])
@@ -78,6 +80,7 @@ Release date:: 2014-06-21
 * Merge the TLS Syslog appender into the Syslog appender. (https://issues.apache.org/jira/browse/LOG4J2-646[LOG4J2-646])
 * Upgrade to Flume 1.5.0. (https://issues.apache.org/jira/browse/LOG4J2-647[LOG4J2-647])
 
+[#release-notes-2-0-rc2-Fixed]
 === Fixed
 
 * Improved documentation regarding log4j status logger. (https://issues.apache.org/jira/browse/LOG4J2-141[LOG4J2-141])

src/site/_release-notes/_2.0.1.adoc

@@ -48,16 +48,19 @@ The package names and Maven `groupId` have been changed to `org.apache.logging.l
 For complete information on Apache Log4j 2, including instructions on how to submit bug reports, patches, or suggestions for improvement, see http://logging.apache.org/log4j/2.x/[the Apache Log4j 2 website].
 
 
+[#release-notes-2-0-1-Added]
 === Added
 
 * Added documentation for Custom Levels and Custom Loggers. (https://issues.apache.org/jira/browse/LOG4J2-710[LOG4J2-710])
 * Added WebLoggerContextUtils class to log4j-web for helper methods useful for asynchronous servlets. (https://issues.apache.org/jira/browse/LOG4J2-725[LOG4J2-725])
 
+[#release-notes-2-0-1-Changed]
 === Changed
 
 * Update to LMAX Disruptor 3.3.0 from 3.2.1. (https://issues.apache.org/jira/browse/LOG4J2-732[LOG4J2-732])
 * Update to latest Jackson jars from the 2.4.1.X line. (https://issues.apache.org/jira/browse/LOG4J2-733[LOG4J2-733])
 
+[#release-notes-2-0-1-Fixed]
 === Fixed
 
 * Fixed ClassLoader issues in loading Log4j providers in an OSGi environment. (https://issues.apache.org/jira/browse/LOG4J2-373[LOG4J2-373])

src/site/_release-notes/_2.0.2.adoc

@@ -48,11 +48,13 @@ The package names and Maven `groupId` have been changed to `org.apache.logging.l
 For complete information on Apache Log4j 2, including instructions on how to submit bug reports, patches, or suggestions for improvement, see http://logging.apache.org/log4j/2.x/[the Apache Log4j 2 website].
 
 
+[#release-notes-2-0-2-Changed]
 === Changed
 
 * Allow Log4jContextFactory subclasses to specify a custom ContextSelector. (https://issues.apache.org/jira/browse/LOG4J2-730[LOG4J2-730])
 * Update Apache Flume to 1.5.0.1 from 1.5.0. (https://issues.apache.org/jira/browse/LOG4J2-775[LOG4J2-775])
 
+[#release-notes-2-0-2-Fixed]
 === Fixed
 
 * Resolved race condition that caused log file rotation to fail with error: "Unable to create directory ..." (https://issues.apache.org/jira/browse/LOG4J2-679[LOG4J2-679])

src/site/_release-notes/_2.0.adoc

@@ -48,17 +48,20 @@ For complete information on Apache Log4j 2, including instructions on how to sub
 patches, or suggestions for improvement, see http://logging.apache.org/log4j/2.x/[the Apache Log4j 2 website].
 
 
+[#release-notes-2-0-Added]
 === Added
 
 * Added support for generating custom logger wrappers that replace the existing log levels and extended logger wrappers that add custom log levels to the existing ones. (https://issues.apache.org/jira/browse/LOG4J2-519[LOG4J2-519])
 * RegexFilter does not match multiline log messages. (https://issues.apache.org/jira/browse/LOG4J2-696[LOG4J2-696])
 
+[#release-notes-2-0-Changed]
 === Changed
 
 * Make org.apache.logging.log4j.core.layout.AbstractLayout immutable. (https://issues.apache.org/jira/browse/LOG4J2-685[LOG4J2-685])
 * Update Jackson to 2.4.1. (https://issues.apache.org/jira/browse/LOG4J2-689[LOG4J2-689])
 * Update Apache Commons Logging to 1.2 from 1.1.3. (https://issues.apache.org/jira/browse/LOG4J2-709[LOG4J2-709])
 
+[#release-notes-2-0-Fixed]
 === Fixed
 
 * LoggerConfigs with no Level now inherit the Level from their parent. (https://issues.apache.org/jira/browse/LOG4J2-441[LOG4J2-441])

src/site/_release-notes/_2.1.adoc

@@ -50,6 +50,7 @@ The package names and Maven `groupId` have been changed to `org.apache.logging.l
 For complete information on Apache Log4j 2, including instructions on how to submit bug reports, patches, or suggestions for improvement, see http://logging.apache.org/log4j/2.x/[the Apache Log4j 2 website].
 
 
+[#release-notes-2-1-Added]
 === Added
 
 * Implement a GELF layout. (https://issues.apache.org/jira/browse/LOG4J2-428[LOG4J2-428])
@@ -69,6 +70,7 @@ For complete information on Apache Log4j 2, including instructions on how to sub
 * Documentation: add sections on the JUL Adapter, IO Streams and NoSQL Appenders to the Maven and Ivy page. (https://issues.apache.org/jira/browse/LOG4J2-856[LOG4J2-856])
 * Add ShutdownCallbackRegistry interface for customizable shutdown callback handling. This is particularly useful for application servers that wish to integrate with Log4j 2. (https://issues.apache.org/jira/browse/LOG4J2-868[LOG4J2-868])
 
+[#release-notes-2-1-Changed]
 === Changed
 
 * Incomplete documentation for JSONLayout. (https://issues.apache.org/jira/browse/LOG4J2-766[LOG4J2-766])
@@ -84,6 +86,7 @@ For complete information on Apache Log4j 2, including instructions on how to sub
 * Add 2.1.0 to compatible versions in Log4j API ProviderUtil and update Log4jAPIVersion to 2.1.0 in core META-INF/log4j-provider.properties. (https://issues.apache.org/jira/browse/LOG4J2-845[LOG4J2-845])
 * FlumeAppender: maxDelay not in seconds, but milliseconds. Add time scale to some settings, for example maxDelayMillis instead of maxDelay. The old names are aliased for compatibility. (https://issues.apache.org/jira/browse/LOG4J2-867[LOG4J2-867])
 
+[#release-notes-2-1-Fixed]
 === Fixed
 
 * FlumePersistentManager now handles LockConflictExceptions in Berkeley Db when sending a batch. (https://issues.apache.org/jira/browse/LOG4J2-391[LOG4J2-391])