Update log4j2 to 2.26.0 to address CVE-2026-49844

[Copilot]

CVE-2026-49844 (Medium) was detected in log4j-api-2.24.3.jar, pulled in as a transitive dependency via Spring Boot's BOM.

Changes

• Added log4j2.version property override in pom.xml to pin log4j to 2.26.0, superseding the Spring Boot-managed default of 2.24.3

<properties>
    ...
    <log4j2.version>2.26.0</log4j2.version>
</properties>

This upgrades all log4j artifacts (log4j-api, log4j-to-slf4j) to 2.26.0 using the standard Spring Boot version override mechanism.

[laffer1]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Pins Log4j2 to a newer version via the Spring Boot parent property override mechanism to remediate a reported transitive CVE finding.

Changes:

• Added a log4j2.version property override in pom.xml to force Log4j2 artifacts to 2.26.0 (overriding the Spring Boot-managed version).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.