Upgrade log4j2 to 2.25.5 to remediate CVE-2026-49844

[Copilot]

CVE-2026-49844 (Medium, CVSS 5.8) affects log4j-api < 2.25.5. Bumps the shared log4j2.version property, which covers log4j-api, log4j-core, and log4j-slf4j2-impl.

Change

<!-- pom.xml -->
- <log4j2.version>2.25.4</log4j2.version>
+ <log4j2.version>2.25.5</log4j2.version>

[laffer1]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[deepsource-io]

DeepSource Code Review

We reviewed changes in ff141b6...94c0778 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Jul 12, 2026 7:08p.m.	Review ↗
Java		Jul 12, 2026 7:08p.m.	Review ↗
Shell		Jul 12, 2026 7:08p.m.	Review ↗
JavaScript		Jul 12, 2026 7:08p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.