fix(Templates): Update aws-lambda-java-log4j2

[MarinaMeza]

Updated aws-lambda-java-log4j2 to 1.4.0 to address log4j vulnerability

Issue 10370

Addresses: #10370

[codecov]

Codecov Report

Merging #10383 (cbf7616) into master (2782ed4) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master   #10383   +/-   ##
=======================================
  Coverage   85.37%   85.37%           
=======================================
  Files         340      340           
  Lines       14005    14005           
=======================================
  Hits        11957    11957           
  Misses       2048     2048           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2782ed4...cbf7616. Read the comment docs.

[pgrzesik]

Thanks a lot @MarinaMeza 🙇 I've run a quick grep over the repo and it seems like there are some additional templates that use this package that could also use an upgrade:

• aws-scala-sbt
• aws-kotlin-jvm-gradle-kts
• aws-kotlin-jvm-maven
• aws-java-maven
• aws-java-gradle

Would you be interested in upgrading them too? It would be much appreciated to cover all of them as a single commit with an upgrade.

[MarinaMeza]

@pgrzesik Yes, no problem! I'll upgrade those too

[anwari666]

Hi @MarinaMeza, thanks for updating those.

I am having the same issue at my company and saw that this file

serverless/lib/plugins/aws/invokeLocal/runtimeWrappers/java/pom.xml

Line 25 in 7bf8f1b

<version>1.0.1</version>

has indirect reference to log4j.

I'm not sure how it will impact the repo, but if it's a simple update then perhaps it can be updated within this commit as well?
Thanks!

[pgrzesik]

Hey @MarinaMeza, thanks a lot for your PR, I think it needs to be rebased and updated a bit and we're good to go, please see my comments 🙇

[MarinaMeza]

I've updated all references to aws-lambda-java-log4j2.
I left aws-lambda-java-log4j as it was since i could not find a newer version

[pgrzesik]

Thank you @MarinaMeza, it looks great, but there seem to be a conflict - could you rebase your branch on top of current master branch?

[pgrzesik]

Thank you @MarinaMeza 🙇