[Snyk] Fix for 3 vulnerabilities

[atlan-it]

Snyk has created this PR to fix 3 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Improper Validation of Certificate with Host Mismatch SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727	85	org.apache.logging.log4j:log4j-core: 2.20.0 -> 2.25.4 org.apache.logging.log4j:log4j-slf4j-impl: 2.20.0 -> 2.25.4 No Path Found No Known Exploit
	Improper Encoding or Escaping of Output SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769	50	org.apache.logging.log4j:log4j-core: 2.20.0 -> 2.25.4 org.apache.logging.log4j:log4j-slf4j-impl: 2.20.0 -> 2.25.4 No Path Found No Known Exploit
	Improper Encoding or Escaping of Output SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804	50	org.apache.logging.log4j:log4j-core: 2.20.0 -> 2.25.4 org.apache.logging.log4j:log4j-slf4j-impl: 2.20.0 -> 2.25.4 No Path Found No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Encoding or Escaping of Output

[atlan-it]

This upgrade from version 2.20.0 to 2.25.4 introduces several breaking changes and significant behavioral modifications that require developer action and verification.

Key Breaking Changes:

• Removed Modules: Several modules are no longer included in the main Log4j distribution and must be managed as separate dependencies. [2, 6] If you use any of the following, your build will fail until you update your dependencies:
  • log4j-flume-ng
  • log4j-kubernetes (migrated to the Fabric8.io Kubernetes project)
  • log4j-mongodb3 (users must migrate to log4j-mongodb4 or log4j-mongodb for client versions 4.x or 5.x)
• JMX Disabled by Default: Starting in version 2.24.0, JMX support is disabled by default. [1, 6] Applications relying on JMX for monitoring Log4j will need to re-enable it by setting the system property log4j2.disableJmx to false.
• Pattern Layout and Exception Handling: Exception handling in the Pattern Layout was rewritten in version 2.25.0. [3, 5]
  • The default exception converter has changed from extended to plain, which may alter the format of your stack traces.
  • Support for the {ansi} option in exception converters has been removed. [3, 5]
• Stricter Configuration Properties: The configuration subsystem now only accepts official property names. [1, 2] Any configurations using unofficial names or typos may fail.

Recommendation:
Before merging, you must:

1. Check if your project uses the removed log4j-flume-ng, log4j-kubernetes, or log4j-mongodb3 modules and update your dependencies accordingly.
2. If you use JMX for monitoring, set the log4j2.disableJmx=false system property.
3. Thoroughly test your application's logging output to verify that exception

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.