Issue
I created a new Spring app using Initialzr. After setting it up, I found out that the initial installation of the packages of log4j is not coming with the latest version (2.14.1 instead of 2.16.0 to combat the recent vulnerability attack). Checking the generated build.gradle also does not show the log4j package being mentioned.
Two questions regarding this:
- Why dit Spring Initialzr not picking up the latest version of log4j?
- To update this, do I need to specifically add the dependency in build.gradle itself?
Solution
New version will be released on Dec 23 according to Spring blog
https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot
Answered By - Luca Riccitelli
