From e10ad882b49609c59d8f7162b298c101f398a0f2 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 4 Sep 2026 08:21:06 +0000 Subject: [PATCH] fix(deps): bump org.apache.logging.log4j minimum version to 2.25.5 (GHSA-qv9r-c865-cp47) Force log4j-api and log4j-core to >= 2.25.5 to resolve Dependabot alert #133. Adds resolutionStrategy override in root build.gradle and ext[] lockstep in both Spring Boot example modules to account for BOM re-assertion. Co-Authored-By: Catarina Pinheiro Correia --- build.gradle | 5 +++++ examples/example-spring-boot-starter-web/build.gradle | 1 + examples/example-spring-boot-starter-webflux/build.gradle | 1 + 3 files changed, 7 insertions(+) diff --git a/build.gradle b/build.gradle index 39b6051..4f1914d 100644 --- a/build.gradle +++ b/build.gradle @@ -63,6 +63,11 @@ subprojects { useVersion('7.0.8') because('GHSA-659m-px2c-25wj: Denial of Service in spring-core via AntPathMatcher, fixed in 7.0.8') } + if (requested.group == 'org.apache.logging.log4j' + && requested.version != null && requested.version < '2.25.5') { + useVersion('2.25.5') + because('GHSA-qv9r-c865-cp47: improper encoding of non-finite floating-point values during MapMessage JSON serialization, fixed in 2.25.5') + } } } diff --git a/examples/example-spring-boot-starter-web/build.gradle b/examples/example-spring-boot-starter-web/build.gradle index 9611808..0e7eb29 100644 --- a/examples/example-spring-boot-starter-web/build.gradle +++ b/examples/example-spring-boot-starter-web/build.gradle @@ -8,6 +8,7 @@ plugins { ext['jackson-bom.version'] = '3.1.4' ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' +ext['log4j2.version'] = '2.25.5' ext['netty.version'] = '4.2.17.Final' ext['tomcat.version'] = '11.0.22' ext['spring-framework.version'] = '7.0.8' diff --git a/examples/example-spring-boot-starter-webflux/build.gradle b/examples/example-spring-boot-starter-webflux/build.gradle index b6f22db..67223bf 100644 --- a/examples/example-spring-boot-starter-webflux/build.gradle +++ b/examples/example-spring-boot-starter-webflux/build.gradle @@ -8,6 +8,7 @@ plugins { ext['jackson-bom.version'] = '3.1.4' ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' +ext['log4j2.version'] = '2.25.5' ext['netty.version'] = '4.2.17.Final' ext['tomcat.version'] = '11.0.22' ext['spring-framework.version'] = '7.0.8'