log4j-jul-2.13.3.jar still included in v6.3.7.3 with cas-server-support-throttle-bucket4 and cas-server-support-reports

[Satnam Singh Sarai]

I am using v6.3.7.3, when I enable following two dependency in the WAR overlay, I see one older version log4j file log4j-jul-2.13.3.jar in web-inf/lib.  Rest of the files are 2.16.0 version.  If I remove those two dependency from war overlay file, then I don't see log4j-jul-2.13.3.jar file.  Are those two dependency need to be upgraded to log4j 2.16.0 version?

 

<dependency>

    <groupId>org.apereo.cas</groupId>

    <artifactId>cas-server-support-throttle-bucket4j</artifactId>

    <version>${cas.version}</version>

</dependency>

 

<dependency>

        <groupId>org.apereo.cas</groupId>

        <artifactId>cas-server-support-reports</artifactId>

        <version>${cas.version}</version> </dependency>