Bump org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4 - #50158
Conversation
Bumps org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4. --- updated-dependencies: - dependency-name: org.apache.logging.log4j:log4j-core dependency-version: 2.25.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
I think this is entirely safe as I didn't find any usage of log4j stuff in Keycloak at all. Not even transitive dependencies. Quarkus explicitly bans any usage of log4j https://github.com/quarkusio/quarkus/blob/fce786ca6c162068589be9508802a281b5fef308/independent-projects/enforcer-rules/src/main/resources/enforcer-rules/quarkus-banned-dependencies.xml#L62. Log4j deps is actively excluded from all deps. I also didn't find any explanation why @vmuzikar actually added this, so I assume it is a defensive mechanism in case some other dependency brings log4j in and we don't know about it. Another reason is probably what Quarkus does - we explicitly manage it to avoid security scanners from reporting false positives.
Unlike us, Quarkus only manages log4j-api, not log4j-core, so they are not affected, I am not going to propose bump there.
LGTM.
…oak#50158) Bumps org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4. --- updated-dependencies: - dependency-name: org.apache.logging.log4j:log4j-core dependency-version: 2.25.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.