SONARJAVA-6250 Bump org.apache.logging.log4j:log4j-core from 2.17.1 to 2.25.4 in /java-checks-test-sources/default

[dependabot]

Bumps org.apache.logging.log4j:log4j-core from 2.17.1 to 2.25.4.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[sonar-review-alpha]

Summary

This PR updates the Apache Log4j Core dependency in the test sources module from 2.17.1 to 2.25.4. The change is minimal—a single version number update in the pom.xml file for a provided scope dependency, meaning it's used only for testing and doesn't affect runtime behavior of the tool itself.

The version jump from 2.17.1 to 2.25.4 includes nearly 8 years of maintenance, bug fixes, and security patches. Since this dependency is scoped as "provided," reviewers should primarily verify that no tests break due to API changes in Log4j.

What reviewers should know

What to check:

• Verify the test build still passes (this is the critical check for a provided-scope test dependency)
• The change is isolated to java-checks-test-sources/default/pom.xml—no code changes required
• Since Log4j is only used for testing via the provided scope, there's no risk to the main artifact

Notes for reviewers:

• This is a Dependabot-generated PR, so the update methodology is automated
• The version jump is large but safe in the test context; focus on whether tests run cleanly with the newer version

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[hashicorp-vault-sonar-prod]

SONARJAVA-6250

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[sonar-review-alpha]

LGTM! ✅

Clean, minimal change — a single version bump in a test-only provided-scope dependency with no logic changes.

🗣️ Give feedback

[github-actions]

This PR is stale because it has been open 7 days with no activity. If there is no activity in the next 7 days it will be closed automatically