The current version of log4j (as of 2.2.6) is 2.12.1.

We would need to bump it to 2.13.1 regarding this issue: https://issues.apache.org/jira/browse/LOG4J2-2677

Comment From: snicoll

Thanks but there is no need to open an issue for a dependency upgrade as indicated in the template for new issues:

You DO NOT need to raise an issue for a managed dependency version upgrade as there's a semi-automatic process for checking managed dependencies for new versions before a release.

You can override the Log4J version using the log4j2.version property, check the documentation for the build system you're using.