From 3e7a8f56d5cfd637aacc61d7901a9217e4801e9b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Apr 2026 04:39:53 +0000
Subject: [PATCH] [tomee-10.x]: Bump version.log4j2 from 2.6.2 to 2.25.4

Bumps `version.log4j2` from 2.6.2 to 2.25.4.

Updates `org.apache.logging.log4j:log4j-api` from 2.6.2 to 2.25.4

Updates `org.apache.logging.log4j:log4j-core` from 2.25.3 to 2.25.4

---
updated-dependencies:
- dependency-name: org.apache.logging.log4j:log4j-api
  dependency-version: 2.25.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-core
  dependency-version: 2.25.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 maven/tomee-maven-plugin/pom.xml | 2 +-
 pom.xml                          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/maven/tomee-maven-plugin/pom.xml b/maven/tomee-maven-plugin/pom.xml
index 3822804ae75..72084639618 100644
--- a/maven/tomee-maven-plugin/pom.xml
+++ b/maven/tomee-maven-plugin/pom.xml
@@ -119,7 +119,7 @@
       <groupId>org.apache.logging.log4j</groupId>
       <artifactId>log4j-api</artifactId>
       <!-- These versions are intentionally old for ClasspathCustomizationTest -->
-      <version>2.6.2</version>
+      <version>2.25.4</version>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/pom.xml b/pom.xml
index 86b41987270..64d4c7c7c27 100644
--- a/pom.xml
+++ b/pom.xml
@@ -149,7 +149,7 @@
     <!-- Logging frameworks -->
     <version.slf4j>2.0.17</version.slf4j>
     <version.log4j>1.2.17</version.log4j>
-    <version.log4j2>2.25.3</version.log4j2>
+    <version.log4j2>2.25.4</version.log4j2>
     <version.commons-logging>1.3.5</version.commons-logging>
 
     <!-- Apache Commons -->