Bump org.apache.logging.log4j:log4j-bom from 2.20.0 to 2.22.0

[dependabot[bot]]

Bumps org.apache.logging.log4j:log4j-bom from 2.20.0 to 2.22.0.

Release notes

Sourced from org.apache.logging.log4j:log4j-bom's releases.

2.22.0

This releases provides a CycloneDX Software Bill of Materials (SBOM) along with each artifact and contains bug fixes addressing issues in the JPMS & OSGi infrastructure overhauled in 2.21.0, dependency updates, and some other minor fixes and improvements.

CycloneDX Software Bill of Materials (SBOM)

This is the first Log4j release that provides a CycloneDX Software Bill of Materials (SBOM) along with each artifact. Generated SBOMs are attached as artifacts with cyclonedx classifier and XML extensions, that is, <artifactId>-<version>-cyclonedx.xml. They contain vulnerability-assertion references to a CycloneDX Vulnerability Disclosure Report (VDR) that Apache Logging Services uses for all projects it maintains. This VDR is accessible through the following URL: https://logging.apache.org/cyclonedx/vdr.xml[]

SBOM generation is streamlined by logging-parent, see its website for details.

Changed

• Change the order of evaluation of FormattedMessage formatters. Messages are evaluated using java.util.Format only if they don't comply to the java.text.MessageFormat or ParameterizedMessage format. (#1223)
• Change default encoding of HTTP Basic Authentication to UTF-8 and add log4j2.configurationAuthorizationEncoding property to overwrite it. (#1970)
• Update com.fasterxml.jackson:jackson-bom to version 2.16.0 (#1974)
• Update com.github.luben:zstd-jni to version 1.5.5-10 (#1940)
• Update com.google.guava:guava to version 32.1.3-jre (#1875)
• Update io.netty:netty-bom to version 4.1.101.Final (#1960)
• Update org.eclipse.persistence:org.eclipse.persistence.jpa to version 2.7.13 (#1900)
• Update org.fusesource.jansi:jansi to version 2.4.1 (#1907)
• Update org.mongodb:bson to version 4.11.1 (#1957)
• Update org.springframework:spring-framework-bom to version 5.3.30
• Update org.springframework.boot:spring-boot to version 2.7.17 (#1874)
• Update org.springframework:spring-framework-bom to version 5.3.31 (#1973)
• Update org.zeromq:jeromq to version 0.5.4 (#1878)

Removed

• Removed unused FastDateParser which was causing unnecessary heap overhead (LOG4J2-3672, #1848)

Fixed

• Fix MDC pattern converter causing issues for %notEmpty (#1922)
• Export missing OSGi & JPMS modules in log4j-layout-template-json and log4j-1.2-api (#1895)
• Fix spring-test dependency scope change (LOG4J2-3675)
• Fix JPMS descriptors causing jlink issues (#1896)
• Add missing Implementation- and Specification- entries to MANIFEST.MF (implemented by logging-parent version 10.3.0 update) (#1923)
• Fix NotSerializableException thrown when Logger is serialized with a ReusableMessageFactory (#1884)

2.21.1

This patch release contains only the fix of a log4j-jcl bug that prevents it from connecting with commons-logging.

The Log4j 2.21.1 API, as well as the other artifacts, maintains binary compatibility with the previous release.

Apache Log4j 2.21.1 requires Java 8 to run. The build requires JDK 11 and generates reproducible binaries.

For complete information on Apache Log4j 2, including instructions on how to submit bug reports, patches, get support, or suggestions for improvement, see the Apache Log4j 2 website.

Fixed

... (truncated)

Commits

• a1634d6 Release changelog for version 2.22.0
• 4d27296 Update the project.build.outputTimestamp property
• d91092f Fix .changelog.adoc.ftl typo
• 5c41c01 Improve release notes
• d6d9626 Update the project.build.outputTimestamp property
• b382a65 Remove explicit distribution-attachment-* arguments to CI
• 9873b11 Update the project.build.outputTimestamp property
• 38e133f Release changelog
• 200909c Set the version to 2.22.0
• 819b738 Merge remote-tracking branch ppkarwasz/basic-auth into 2.x (#1970)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions[bot]]

Changes are applied by CI in f6c7db69f2d8de3579b41bee833132ac473df614

[dependabot[bot]]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.