hotfix log4j (#269)

* hotfix log4j
qbicsoftware · Dec 13, 2021 · de091e8 · de091e8
1 parent 94e2815
commit de091e8
Show file tree

Hide file tree

Showing 5 changed files with 27 additions and 65 deletions.
diff --git a/.github/workflows/qube_lint.yml b/.github/workflows/qube_lint.yml
diff --git a/.qube.yml b/.qube.yml
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -4,6 +4,20 @@ Changelog
 
 This project adheres to `Semantic Versioning <https://semver.org/>`_.
 
+3.14.2 (2021-12-13)
+-------------------
+
+**Added**
+
+**Fixed**
+
+**Dependencies**
+
+* org.apache.logging.log4j 2.13.2 -> 2.15.0 (addresses CVE-2021-44228)
+
+**Deprecated**
+
+
 2.14.0 (2021-10-27)
 -------------------
 

diff --git a/pom.xml b/pom.xml
@@ -7,7 +7,7 @@
 
     <groupId>life.qbic</groupId>
 	<artifactId>data-model-lib</artifactId>
-	<version>2.14.0</version> <!-- <<QUBE_FORCE_BUMP>> -->
+	<version>2.14.1</version> <!-- <<QUBE_FORCE_BUMP>> -->
 	<name>data-model-lib</name>
 	<url>http://github.com/qbicsoftware/data-model-lib</url>
 	<description>Data models. A collection of QBiC's central data models and DTOs. </description>
@@ -113,6 +113,18 @@
         <version>1.6.0</version>
         <scope>${osgi.scope}</scope>
       </dependency>
+      		<dependency>
+			<groupId>org.apache.logging.log4j</groupId>
+			<artifactId>log4j-core</artifactId>
+			<version>2.15.0</version>
+			<scope>${osgi.scope}</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.logging.log4j</groupId>
+			<artifactId>log4j-api</artifactId>
+			<version>2.15.0</version>
+			<scope>${osgi.scope}</scope>
+		</dependency>
       <!-- https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-annotations -->
       <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>

diff --git a/qube.cfg b/qube.cfg