[Snyk] Security upgrade org.apache.logging.log4j:log4j-core from 2.12.2 to 2.25.4

[snyk-io]

Snyk has created this PR to fix 3 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• todolist-goof/todolist-web-struts/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Improper Validation of Certificate with Host Mismatch SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727	113	org.apache.logging.log4j:log4j-core: 2.12.2 -> 2.25.4 No Path Found No Known Exploit
	Improper Encoding or Escaping of Output SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769	67	org.apache.logging.log4j:log4j-core: 2.12.2 -> 2.25.4 No Path Found No Known Exploit
	Improper Encoding or Escaping of Output SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804	67	org.apache.logging.log4j:log4j-core: 2.12.2 -> 2.25.4 No Path Found No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Encoding or Escaping of Output

[snyk-io]

This upgrade from version 2.12.2 to 2.25.4 spans several years of development and includes significant breaking changes, security hardening, and a Java version bump.

Key Breaking Changes:

• Java 8 Required: Support for Java 7 was dropped in version 2.13.0. Log4j 2.12.x was the last series to support Java 7, so this upgrade requires a move to Java 8 or later. [1, 7, 20]
• JNDI Disabled by Default: In response to the critical "Log4Shell" vulnerability (CVE-2021-44228), JNDI functionality is now disabled by default starting in version 2.16.0. [1, 19] Applications relying on JNDI for configuration will require changes, such as setting system properties (e.g., log4j2.enableJndiLookup) to re-enable it. [1]
• Removed Modules: Starting with version 2.24.0, several modules were removed from the main distribution and must be managed as separate dependencies. [3, 11] This includes:
  • log4j-mongodb3 (migrate to log4j-mongodb4 or log4j-mongodb)
  • log4j-kubernetes (moved to the Fabric8.io project)
  • log4j-flume-ng
• JMX Disabled by Default: As of version 2.24.0, JMX is no longer enabled by default. It must be explicitly re-enabled by setting the system property log4j2.disableJmx to false. [1, 11]
• Behavioral Changes:
  • Pattern Layout: In v2.25.0, exception handling in Pattern Layout was rewritten, and the default exception converter was changed from extended to plain. [9, 16]
  • MongoDB: Support for MongoDB v2 was removed in version 2.14

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[ily-snyk]

⚠️ Snyk checks are incomplete.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
⚠️	Open Source Security	0	0	0	0	See details
⚠️	Licenses	0	0	0	0	See details
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[ily-snyk]

⛔ Snyk checks have failed. 244 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (244)
⛔	Open Source Security	33	211	0	0	244 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.