From 93f81673b17237be9acb1eb2a89b2cc4c42b611a Mon Sep 17 00:00:00 2001
From: Jan Werner <jwerner@confluent.io>
Date: Fri, 24 Apr 2026 16:25:21 -0400
Subject: [PATCH 1/3] add log4j2 version definition and update version in
 log4j2-extensions

---
 log4j2-extensions/pom.xml | 2 +-
 pom.xml                   | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/log4j2-extensions/pom.xml b/log4j2-extensions/pom.xml
index cfbe707793a..81b9e22db02 100644
--- a/log4j2-extensions/pom.xml
+++ b/log4j2-extensions/pom.xml
@@ -37,7 +37,7 @@
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
-            <version>2.25.3</version>
+            <version>${log4j2.version}</version>
         </dependency>
         <dependency>
             <groupId>io.confluent</groupId>
diff --git a/pom.xml b/pom.xml
index d51937b2c58..44b2b39268e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -101,6 +101,7 @@
         <!-- Potentially used by downstream projects -->
         <slf4j-api.version>${slf4j.version}</slf4j-api.version>
         <slf4j.version>1.7.36</slf4j.version>
+        <log4j2.version>2.25.4</log4j2.version>
         <slf4j-reload4j.version>1.7.36</slf4j-reload4j.version>
         <snakeyaml.version>2.0</snakeyaml.version>
         <snappy.version>1.1.10.5</snappy.version>

From a3b037e1ef04dceb2c333726ef86415a8ada2606 Mon Sep 17 00:00:00 2001
From: nlou9 <nlou@confluent.io>
Date: Mon, 27 Apr 2026 18:16:33 -0700
Subject: [PATCH 2/3] Bump snappy-java to 1.1.10.8

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 98147bff2e3..75b527d4fe6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@
         <slf4j-reload4j.version>1.7.36</slf4j-reload4j.version>
         <logback-core.version>1.5.27</logback-core.version>
         <snakeyaml.version>2.0</snakeyaml.version>
-        <snappy.version>1.1.10.7</snappy.version>
+        <snappy.version>1.1.10.8</snappy.version>
         <!-- https://mvnrepository.com/artifact/org.slf4j/slf4j-reload4j/1.7.36 -->
         <reload4j.version>1.2.25</reload4j.version>
         <logredactor.version>1.0.17</logredactor.version>

From feef7ef9c7e6152738b5bed8d49541277e6fbe46 Mon Sep 17 00:00:00 2001
From: Jan Werner <jwerner@confluent.io>
Date: Wed, 29 Apr 2026 11:33:03 -0400
Subject: [PATCH 3/3] Update bouncycastle to 1.84

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index bf34930e89c..236cf30b35c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -109,7 +109,7 @@
         <logredactor.version>1.0.17</logredactor.version>
         <zkclient.version>0.11</zkclient.version>
         <zookeeper.version>3.8.6</zookeeper.version>
-        <bouncycastle.jdk18.version>1.82</bouncycastle.jdk18.version>
+        <bouncycastle.jdk18.version>1.84</bouncycastle.jdk18.version>
         <!-- before updating bouncycastle.fips.version make sure
         that the library version you're updating to is FIPS certified e.g. 1.0.2.4 -> 1.0.2.5 is not OK -->
         <!-- BC should be upated to version 2.0 in Q1 2025, bcutil-fips is 2.0 only, so no change there -->