USPR-13877: force org.apache.logging.log4j minimum version to 2.25.5

[midnight-clue]

Context & Problem

GitHub Dependabot alert #133 flags org.apache.logging.log4j:log4j-api (pulled in transitively, not directly declared) for GHSA-qv9r-c865-cp47. The vulnerability affects improper encoding of non-finite floating-point values during MapMessage JSON serialization. The vulnerable range is >= 2.13.1, < 2.25.5, and the fix is to force >= 2.25.5.

See USPR-13877.

Solution

The fix adds a new resolutionStrategy override in the root build.gradle's subprojects { configurations.configureEach { resolutionStrategy.eachDependency { } } } block, following the established pattern used for jackson, logback, tomcat-embed-core, netty, and spring-core. The override forces org.apache.logging.log4j (group match, covers log4j-api, log4j-core, and log4j-to-slf4j) to >= 2.25.5.

Additionally, per the repo's Mechanism B lockstep requirement (Spring Boot BOM re-assertion in dependency-management-plugin modules), ext['log4j2.version'] = '2.25.5' is set in both example build files that apply the spring.dependency.management plugin:

• examples/example-spring-boot-starter-web/build.gradle
• examples/example-spring-boot-starter-webflux/build.gradle

This ensures the fix applies consistently across all modules.

Verification

• resolutionStrategy override added to root build.gradle for org.apache.logging.log4j >= 2.25.5 (manual inspection of build.gradle diff)
• because() message includes GHSA-qv9r-c865-cp47 and vulnerability description (manual inspection of build.gradle diff)
• ext['log4j2.version'] = '2.25.5' added to both example build files (manual inspection of diffs)
• log4j-api resolves to 2.25.5 in examples/example-spring-boot-starter-webflux (verified with ./gradlew :examples:example-spring-boot-starter-webflux:dependencyInsight --dependency log4j-api --configuration runtimeClasspath)
• log4j-api resolves to 2.25.5 in examples/example-spring-boot-starter-web (verified with ./gradlew :examples:example-spring-boot-starter-web:dependencyInsight --dependency log4j-api --configuration runtimeClasspath)
• Local checks pass: checkstyleMain, checkstyleTest, pmdMain, pmdTest, test

---

🔍 Braintrust trace