The current version of log4j (as of 2.2.6) is 2.12.1.
We would need to bump it to 2.13.1 regarding this issue: https://issues.apache.org/jira/browse/LOG4J2-2677
Comment From: snicoll
Thanks but there is no need to open an issue for a dependency upgrade as indicated in the template for new issues:
You DO NOT need to raise an issue for a managed dependency version upgrade as there's a semi-automatic process for checking managed dependencies for new versions before a release.
You can override the Log4J version using the log4j2.version
property, check the documentation for the build system you're using.