security(deps): bump org.apache.logging.log4j:log4j-slf4j-impl from 2.25.2 to 2.26.1 - #128
Conversation
Bumps org.apache.logging.log4j:log4j-slf4j-impl from 2.25.2 to 2.26.1. --- updated-dependencies: - dependency-name: org.apache.logging.log4j:log4j-slf4j-impl dependency-version: 2.26.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit c0be108. Configure here.
| <groupId>org.apache.logging.log4j</groupId> | ||
| <artifactId>log4j-slf4j-impl</artifactId> | ||
| <version>2.25.2</version> | ||
| <version>2.26.1</version> |
There was a problem hiding this comment.
Mismatched Log4j dependency versions
Medium Severity
Mismatched Log4j versions are present on the classpath, with log4j-slf4j-impl at 2.26.1 and log4j-core/log4j-api at 2.25.2. Log4j expects all its artifacts to be on the same version, which can cause runtime logging failures in modules like aperture-layout and ensemble-clustering.
Reviewed by Cursor Bugbot for commit c0be108. Configure here.
Bumps org.apache.logging.log4j:log4j-slf4j-impl from 2.25.2 to 2.26.1.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Patch-level logging dependency bump with no application code changes; minor runtime/test logging behavior risk only in modules that bind SLF4j at compile scope.
Overview
Bumps the pinned
log4j-slf4j-implversion from 2.25.2 to 2.26.1 in six Maven modules:aperture-capture-phantom,aperture-cms,aperture-geo,aperture-layout,aperture-server-core, andensemble-clustering. Only the explicit<version>on that artifact changes; pairedlog4j-coreentries are unchanged.In four modules the bridge stays test-scoped;
aperture-layoutandensemble-clusteringstill use it at compile/runtime for SLF4J → Log4j 2 binding. No Java or config changes.Reviewed by Cursor Bugbot for commit c0be108. Bugbot is set up for automated code reviews on this repo. Configure here.