From 15f0b6332e682007377af4afda966dc66340159f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 22 Oct 2025 05:40:31 +0000
Subject: [PATCH 1/3] Bump log4j from 2.21.0 to 2.24.3

Bumps `log4j` from 2.21.0 to 2.24.3.

Updates `org.apache.logging.log4j:log4j-api` from 2.21.0 to 2.24.3

Updates `org.apache.logging.log4j:log4j-jul` from 2.21.0 to 2.24.3

Updates `org.apache.logging.log4j:log4j-core` from 2.21.0 to 2.24.3

Updates `org.apache.logging.log4j:log4j-slf4j-impl` from 2.21.0 to 2.24.3

---
updated-dependencies:
- dependency-name: org.apache.logging.log4j:log4j-api
  dependency-version: 2.24.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-jul
  dependency-version: 2.24.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-core
  dependency-version: 2.24.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.logging.log4j:log4j-slf4j-impl
  dependency-version: 2.24.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 gradle/libs.versions.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index e5caa7cb23666..30036ab9f895b 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -13,7 +13,7 @@ jackson_databind  = "2.18.2"
 snakeyaml         = "2.1"
 icu4j             = "77.1"
 supercsv          = "2.4.0"
-log4j             = "2.21.0"
+log4j             = "2.25.2"
 slf4j             = "2.0.17"
 asm               = "9.7"
 jettison          = "1.5.4"

From ccf85e8a00244baf2b8e201eff8cf41728943a4c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 22 Oct 2025 05:43:05 +0000
Subject: [PATCH 2/3] Updating SHAs

Signed-off-by: dependabot[bot] <support@github.com>
---
 libs/core/licenses/log4j-api-2.21.0.jar.sha1                     | 1 -
 libs/core/licenses/log4j-api-2.25.2.jar.sha1                     | 1 +
 plugins/crypto-kms/licenses/log4j-1.2-api-2.21.0.jar.sha1        | 1 -
 plugins/crypto-kms/licenses/log4j-1.2-api-2.25.2.jar.sha1        | 1 +
 .../licenses/log4j-1.2-api-2.21.0.jar.sha1                       | 1 -
 .../licenses/log4j-1.2-api-2.25.2.jar.sha1                       | 1 +
 plugins/discovery-ec2/licenses/log4j-1.2-api-2.21.0.jar.sha1     | 1 -
 plugins/discovery-ec2/licenses/log4j-1.2-api-2.25.2.jar.sha1     | 1 +
 plugins/discovery-gce/licenses/log4j-1.2-api-2.21.0.jar.sha1     | 1 -
 plugins/discovery-gce/licenses/log4j-1.2-api-2.25.2.jar.sha1     | 1 +
 .../repository-hdfs/licenses/log4j-slf4j-impl-2.21.0.jar.sha1    | 1 -
 .../repository-hdfs/licenses/log4j-slf4j-impl-2.25.2.jar.sha1    | 1 +
 plugins/repository-s3/licenses/log4j-1.2-api-2.21.0.jar.sha1     | 1 -
 plugins/repository-s3/licenses/log4j-1.2-api-2.25.2.jar.sha1     | 1 +
 plugins/repository-s3/licenses/log4j-slf4j-impl-2.21.0.jar.sha1  | 1 -
 plugins/repository-s3/licenses/log4j-slf4j-impl-2.25.2.jar.sha1  | 1 +
 server/licenses/log4j-api-2.21.0.jar.sha1                        | 1 -
 server/licenses/log4j-api-2.25.2.jar.sha1                        | 1 +
 server/licenses/log4j-core-2.21.0.jar.sha1                       | 1 -
 server/licenses/log4j-core-2.25.2.jar.sha1                       | 1 +
 server/licenses/log4j-jul-2.21.0.jar.sha1                        | 1 -
 server/licenses/log4j-jul-2.25.2.jar.sha1                        | 1 +
 22 files changed, 11 insertions(+), 11 deletions(-)
 delete mode 100644 libs/core/licenses/log4j-api-2.21.0.jar.sha1
 create mode 100644 libs/core/licenses/log4j-api-2.25.2.jar.sha1
 delete mode 100644 plugins/crypto-kms/licenses/log4j-1.2-api-2.21.0.jar.sha1
 create mode 100644 plugins/crypto-kms/licenses/log4j-1.2-api-2.25.2.jar.sha1
 delete mode 100644 plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.21.0.jar.sha1
 create mode 100644 plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.25.2.jar.sha1
 delete mode 100644 plugins/discovery-ec2/licenses/log4j-1.2-api-2.21.0.jar.sha1
 create mode 100644 plugins/discovery-ec2/licenses/log4j-1.2-api-2.25.2.jar.sha1
 delete mode 100644 plugins/discovery-gce/licenses/log4j-1.2-api-2.21.0.jar.sha1
 create mode 100644 plugins/discovery-gce/licenses/log4j-1.2-api-2.25.2.jar.sha1
 delete mode 100644 plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.21.0.jar.sha1
 create mode 100644 plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.25.2.jar.sha1
 delete mode 100644 plugins/repository-s3/licenses/log4j-1.2-api-2.21.0.jar.sha1
 create mode 100644 plugins/repository-s3/licenses/log4j-1.2-api-2.25.2.jar.sha1
 delete mode 100644 plugins/repository-s3/licenses/log4j-slf4j-impl-2.21.0.jar.sha1
 create mode 100644 plugins/repository-s3/licenses/log4j-slf4j-impl-2.25.2.jar.sha1
 delete mode 100644 server/licenses/log4j-api-2.21.0.jar.sha1
 create mode 100644 server/licenses/log4j-api-2.25.2.jar.sha1
 delete mode 100644 server/licenses/log4j-core-2.21.0.jar.sha1
 create mode 100644 server/licenses/log4j-core-2.25.2.jar.sha1
 delete mode 100644 server/licenses/log4j-jul-2.21.0.jar.sha1
 create mode 100644 server/licenses/log4j-jul-2.25.2.jar.sha1

diff --git a/libs/core/licenses/log4j-api-2.21.0.jar.sha1 b/libs/core/licenses/log4j-api-2.21.0.jar.sha1
deleted file mode 100644
index 51446052594aa..0000000000000
--- a/libs/core/licenses/log4j-api-2.21.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-760192f2b69eacf4a4afc78e5a1d7a8de054fcbd
\ No newline at end of file
diff --git a/libs/core/licenses/log4j-api-2.25.2.jar.sha1 b/libs/core/licenses/log4j-api-2.25.2.jar.sha1
new file mode 100644
index 0000000000000..ddb785e8123ea
--- /dev/null
+++ b/libs/core/licenses/log4j-api-2.25.2.jar.sha1
@@ -0,0 +1 @@
+292c1a2b1702f1e1e3adb13e1c57e5bff60335ff
\ No newline at end of file
diff --git a/plugins/crypto-kms/licenses/log4j-1.2-api-2.21.0.jar.sha1 b/plugins/crypto-kms/licenses/log4j-1.2-api-2.21.0.jar.sha1
deleted file mode 100644
index 39d9177cb2fac..0000000000000
--- a/plugins/crypto-kms/licenses/log4j-1.2-api-2.21.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-12bad3819a9570807f3c97315930699584c12152
\ No newline at end of file
diff --git a/plugins/crypto-kms/licenses/log4j-1.2-api-2.25.2.jar.sha1 b/plugins/crypto-kms/licenses/log4j-1.2-api-2.25.2.jar.sha1
new file mode 100644
index 0000000000000..87451c0aff361
--- /dev/null
+++ b/plugins/crypto-kms/licenses/log4j-1.2-api-2.25.2.jar.sha1
@@ -0,0 +1 @@
+d937f5ea23f027563332126b3c96f970ed9536bb
\ No newline at end of file
diff --git a/plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.21.0.jar.sha1 b/plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.21.0.jar.sha1
deleted file mode 100644
index 39d9177cb2fac..0000000000000
--- a/plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.21.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-12bad3819a9570807f3c97315930699584c12152
\ No newline at end of file
diff --git a/plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.25.2.jar.sha1 b/plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.25.2.jar.sha1
new file mode 100644
index 0000000000000..87451c0aff361
--- /dev/null
+++ b/plugins/discovery-azure-classic/licenses/log4j-1.2-api-2.25.2.jar.sha1
@@ -0,0 +1 @@
+d937f5ea23f027563332126b3c96f970ed9536bb
\ No newline at end of file
diff --git a/plugins/discovery-ec2/licenses/log4j-1.2-api-2.21.0.jar.sha1 b/plugins/discovery-ec2/licenses/log4j-1.2-api-2.21.0.jar.sha1
deleted file mode 100644
index 39d9177cb2fac..0000000000000
--- a/plugins/discovery-ec2/licenses/log4j-1.2-api-2.21.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-12bad3819a9570807f3c97315930699584c12152
\ No newline at end of file
diff --git a/plugins/discovery-ec2/licenses/log4j-1.2-api-2.25.2.jar.sha1 b/plugins/discovery-ec2/licenses/log4j-1.2-api-2.25.2.jar.sha1
new file mode 100644
index 0000000000000..87451c0aff361
--- /dev/null
+++ b/plugins/discovery-ec2/licenses/log4j-1.2-api-2.25.2.jar.sha1
@@ -0,0 +1 @@
+d937f5ea23f027563332126b3c96f970ed9536bb
\ No newline at end of file
diff --git a/plugins/discovery-gce/licenses/log4j-1.2-api-2.21.0.jar.sha1 b/plugins/discovery-gce/licenses/log4j-1.2-api-2.21.0.jar.sha1
deleted file mode 100644
index 39d9177cb2fac..0000000000000
--- a/plugins/discovery-gce/licenses/log4j-1.2-api-2.21.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-12bad3819a9570807f3c97315930699584c12152
\ No newline at end of file
diff --git a/plugins/discovery-gce/licenses/log4j-1.2-api-2.25.2.jar.sha1 b/plugins/discovery-gce/licenses/log4j-1.2-api-2.25.2.jar.sha1
new file mode 100644
index 0000000000000..87451c0aff361
--- /dev/null
+++ b/plugins/discovery-gce/licenses/log4j-1.2-api-2.25.2.jar.sha1
@@ -0,0 +1 @@
+d937f5ea23f027563332126b3c96f970ed9536bb
\ No newline at end of file
diff --git a/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.21.0.jar.sha1 b/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.21.0.jar.sha1
deleted file mode 100644
index 0e22f98daa61c..0000000000000
--- a/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.21.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-911fdb5b1a1df36719c579ecc6f2957b88bce1ab
\ No newline at end of file
diff --git a/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.25.2.jar.sha1 b/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.25.2.jar.sha1
new file mode 100644
index 0000000000000..3d7a5663e78e3
--- /dev/null
+++ b/plugins/repository-hdfs/licenses/log4j-slf4j-impl-2.25.2.jar.sha1
@@ -0,0 +1 @@
+e1f9b977b021cdc37e874076f4f400913ff6aba2
\ No newline at end of file
diff --git a/plugins/repository-s3/licenses/log4j-1.2-api-2.21.0.jar.sha1 b/plugins/repository-s3/licenses/log4j-1.2-api-2.21.0.jar.sha1
deleted file mode 100644
index 39d9177cb2fac..0000000000000
--- a/plugins/repository-s3/licenses/log4j-1.2-api-2.21.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-12bad3819a9570807f3c97315930699584c12152
\ No newline at end of file
diff --git a/plugins/repository-s3/licenses/log4j-1.2-api-2.25.2.jar.sha1 b/plugins/repository-s3/licenses/log4j-1.2-api-2.25.2.jar.sha1
new file mode 100644
index 0000000000000..87451c0aff361
--- /dev/null
+++ b/plugins/repository-s3/licenses/log4j-1.2-api-2.25.2.jar.sha1
@@ -0,0 +1 @@
+d937f5ea23f027563332126b3c96f970ed9536bb
\ No newline at end of file
diff --git a/plugins/repository-s3/licenses/log4j-slf4j-impl-2.21.0.jar.sha1 b/plugins/repository-s3/licenses/log4j-slf4j-impl-2.21.0.jar.sha1
deleted file mode 100644
index 0e22f98daa61c..0000000000000
--- a/plugins/repository-s3/licenses/log4j-slf4j-impl-2.21.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-911fdb5b1a1df36719c579ecc6f2957b88bce1ab
\ No newline at end of file
diff --git a/plugins/repository-s3/licenses/log4j-slf4j-impl-2.25.2.jar.sha1 b/plugins/repository-s3/licenses/log4j-slf4j-impl-2.25.2.jar.sha1
new file mode 100644
index 0000000000000..3d7a5663e78e3
--- /dev/null
+++ b/plugins/repository-s3/licenses/log4j-slf4j-impl-2.25.2.jar.sha1
@@ -0,0 +1 @@
+e1f9b977b021cdc37e874076f4f400913ff6aba2
\ No newline at end of file
diff --git a/server/licenses/log4j-api-2.21.0.jar.sha1 b/server/licenses/log4j-api-2.21.0.jar.sha1
deleted file mode 100644
index 51446052594aa..0000000000000
--- a/server/licenses/log4j-api-2.21.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-760192f2b69eacf4a4afc78e5a1d7a8de054fcbd
\ No newline at end of file
diff --git a/server/licenses/log4j-api-2.25.2.jar.sha1 b/server/licenses/log4j-api-2.25.2.jar.sha1
new file mode 100644
index 0000000000000..ddb785e8123ea
--- /dev/null
+++ b/server/licenses/log4j-api-2.25.2.jar.sha1
@@ -0,0 +1 @@
+292c1a2b1702f1e1e3adb13e1c57e5bff60335ff
\ No newline at end of file
diff --git a/server/licenses/log4j-core-2.21.0.jar.sha1 b/server/licenses/log4j-core-2.21.0.jar.sha1
deleted file mode 100644
index c88e6f7a25ca9..0000000000000
--- a/server/licenses/log4j-core-2.21.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-122e1a9e0603cc9eae07b0846a6ff01f2454bc49
\ No newline at end of file
diff --git a/server/licenses/log4j-core-2.25.2.jar.sha1 b/server/licenses/log4j-core-2.25.2.jar.sha1
new file mode 100644
index 0000000000000..597ae652bb29a
--- /dev/null
+++ b/server/licenses/log4j-core-2.25.2.jar.sha1
@@ -0,0 +1 @@
+d4d0ad2e51e03e531f784891fbfff1bae1e13a12
\ No newline at end of file
diff --git a/server/licenses/log4j-jul-2.21.0.jar.sha1 b/server/licenses/log4j-jul-2.21.0.jar.sha1
deleted file mode 100644
index 480010840abca..0000000000000
--- a/server/licenses/log4j-jul-2.21.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-f0da61113f4a47654677e6a98b1e13ca7de2483d
\ No newline at end of file
diff --git a/server/licenses/log4j-jul-2.25.2.jar.sha1 b/server/licenses/log4j-jul-2.25.2.jar.sha1
new file mode 100644
index 0000000000000..213da0eadf15c
--- /dev/null
+++ b/server/licenses/log4j-jul-2.25.2.jar.sha1
@@ -0,0 +1 @@
+1ddec1b88940975f67a83fcd65306cd0602a74bd
\ No newline at end of file

From c75b89b1aa5f8fe05383aea0c33dba016a33b57f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 22 Oct 2025 05:43:56 +0000
Subject: [PATCH 3/3] Update changelog

Signed-off-by: dependabot[bot] <support@github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6b0c25ec65903..d43a64772e0a1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -45,6 +45,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `org.apache.avro:avro` from 1.12.0 to 1.12.1 ([#19692](https://github.com/opensearch-project/OpenSearch/pull/19692))
 - Bump `com.github.spotbugs:spotbugs-annotations` from 4.9.6 to 4.9.8 ([#19691](https://github.com/opensearch-project/OpenSearch/pull/19691))
 - Bump `stefanzweifel/git-auto-commit-action` from 6 to 7 ([#19689](https://github.com/opensearch-project/OpenSearch/pull/19689))
+- Bump `log4j` from 2.21.0 to 2.24.3 ([#17812](https://github.com/opensearch-project/OpenSearch/pull/17812))
 
 ### Deprecated
 - Deprecated existing constructors in ThreadPoolStats.Stats in favor of the new Builder ([#19306](https://github.com/opensearch-project/OpenSearch/pull/19306))