Skip to content

[pixels-lambda] mitigate outdated Log4j2 pulled by Lambda shade transformer #1355

Description

@gengdy1545

Building pixels-worker-lambda downloads Log4j2 2.13.0 into the local Maven cache via the shade plugin dependency:
com.github.edwgiz:maven-shade-plugin.log4j2-cachefile-transformer:2.13.0. Log4j2 2.13.0 is an outdated open-source release with known security risks.

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions