From 99d98f297ea5242e88bc57727e7c32bfa4b51760 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Apr 2026 19:01:44 +0000
Subject: [PATCH 1/3] build: bump version.log4j from 2.12.4 to 2.25.4

Bumps `version.log4j` from 2.12.4 to 2.25.4.

Updates `org.apache.logging.log4j:log4j-core` from 2.12.4 to 2.25.4

Updates `org.apache.logging.log4j:log4j-slf4j-impl` from 2.12.4 to 2.25.4

---
updated-dependencies:
- dependency-name: org.apache.logging.log4j:log4j-core
  dependency-version: 2.25.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-slf4j-impl
  dependency-version: 2.25.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 apm-agent-plugins/apm-logging-plugin/apm-log4j2-plugin/pom.xml | 2 +-
 pom.xml                                                        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/apm-agent-plugins/apm-logging-plugin/apm-log4j2-plugin/pom.xml b/apm-agent-plugins/apm-logging-plugin/apm-log4j2-plugin/pom.xml
index b80fdb1dbc..d98d5b190b 100644
--- a/apm-agent-plugins/apm-logging-plugin/apm-log4j2-plugin/pom.xml
+++ b/apm-agent-plugins/apm-logging-plugin/apm-log4j2-plugin/pom.xml
@@ -24,7 +24,7 @@
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
-            <version>2.25.3</version>
+            <version>2.25.4</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
diff --git a/pom.xml b/pom.xml
index c1791936d8..25cb4f41a5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -93,7 +93,7 @@
         <!-- this is the last version of log4j that is compatible with Java 7. Due to a known vulnerability
         (https://nvd.nist.gov/vuln/detail/CVE-2020-9488#vulnCurrentDescriptionTitle), the SMTP appender is
          excluded from the build and not packaged into the agent artifacts -->
-        <version.log4j>2.12.4</version.log4j>
+        <version.log4j>2.25.4</version.log4j>
         <version.ecs.logging>1.7.0</version.ecs.logging>
         <version.spring>5.0.15.RELEASE</version.spring>
         <version.jetty-server>9.4.11.v20180605</version.jetty-server>

From 2542cc8ba99a0a2586f699493586387ec5a86c1b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar?=
 <56847527+LikeTheSalad@users.noreply.github.com>
Date: Tue, 14 Apr 2026 15:16:41 +0200
Subject: [PATCH 2/3] Reverting version from root pom file

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 25cb4f41a5..c1791936d8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -93,7 +93,7 @@
         <!-- this is the last version of log4j that is compatible with Java 7. Due to a known vulnerability
         (https://nvd.nist.gov/vuln/detail/CVE-2020-9488#vulnCurrentDescriptionTitle), the SMTP appender is
          excluded from the build and not packaged into the agent artifacts -->
-        <version.log4j>2.25.4</version.log4j>
+        <version.log4j>2.12.4</version.log4j>
         <version.ecs.logging>1.7.0</version.ecs.logging>
         <version.spring>5.0.15.RELEASE</version.spring>
         <version.jetty-server>9.4.11.v20180605</version.jetty-server>

From 4d61299935b88836d93fc0741f3d9e926dd1a459 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar?=
 <56847527+LikeTheSalad@users.noreply.github.com>
Date: Tue, 14 Apr 2026 16:59:07 +0200
Subject: [PATCH 3/3] Update java8 pom.xml

---
 apm-agent-builds/apm-agent-java8/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apm-agent-builds/apm-agent-java8/pom.xml b/apm-agent-builds/apm-agent-java8/pom.xml
index d613074a35..4734b1107f 100644
--- a/apm-agent-builds/apm-agent-java8/pom.xml
+++ b/apm-agent-builds/apm-agent-java8/pom.xml
@@ -21,7 +21,7 @@
                 <!-- Upgrade log4j2 to non vulnerable version -->
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-bom</artifactId>
-                <version>2.25.3</version>
+                <version>2.25.4</version>
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>