[fix][sec] Bump log4j2 from 2.26.0 to 2.26.1

[dependabot]

Bumps log4j2 from 2.26.0 to 2.26.1.
Updates org.apache.logging.log4j:log4j-bom from 2.26.0 to 2.26.1

Release notes

Sourced from org.apache.logging.log4j:log4j-bom's releases.

2.26.1

This patch release delivers certain fixes on top of 2.26.0.

Changed

• Improve logging for LinkageError scenarios involving the LMAX Disruptor library (#2250, #4124)

Fixed

• Fix the createOnDemand behavior of RollingFileAppender to correctly defer file and directory creation until the first log event, while preserving eager creation when disabled. (#2006, #4072)
• Improve documentation for locale handling in the Pattern Layout date pattern converter (#4129, #4130)
• Fix handling of non-finite numbers while encoding MapMessage to JSON (#4163)
• Fix encoding of MSGID and SD-ID fields of StructuredDataMessage to XML (#4136)
• Fix stack trace rendering for exceptions with identity malfunction (e.g., colliding equals() and/or hashCode() implementations) (#3933, #4133)
• Fix resource leaks in ConfigurationSource when loading configuration via URL fails (#4127)
• Fix KafkaAppender reporting error to error handler even after a successful retry (#4125)

Commits

• dd0f9d2 Release changelog for version 2.26.1
• efbb638 Update the project.build.outputTimestamp property
• c9332be Fix handling of non-finite numbers while encoding MapMessage to JSON (#4163)
• bd8eca1 Fix AsciiDoc typo in pattern-layout.adoc
• df1c753 tidy up changelogs
• 0592cff fix version in pom.xml
• e320257 Release changelog for version 2.26.1
• 5755541 Update the project.build.outputTimestamp property
• 6c2d931 Set version to 2.26.1
• 69d6641 add patch release/2.26.1 liked commits and moved changelog the release/2.26.1...
• Additional commits viewable in compare view

Updates org.apache.logging.log4j:log4j-api from 2.26.0 to 2.26.1

Updates org.apache.logging.log4j:log4j-core from 2.26.0 to 2.26.1

Updates org.apache.logging.log4j:log4j-web from 2.26.0 to 2.26.1

Updates org.apache.logging.log4j:log4j-layout-template-json from 2.26.0 to 2.26.1

Updates org.apache.logging.log4j:log4j-slf4j2-impl from 2.26.0 to 2.26.1

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[lhotari]

Security note

This upgrade addresses CVE-2026-49844 (CWE-116, Improper Encoding or Escaping of Output) in the Apache Log4j API.

When a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, -Infinity), MapMessage.asJson() emitted the bare token, producing output that is not valid JSON. It is reachable when the application uses the message resolver of JsonTemplateLayout (or another layout relying on MapMessage.asJson()) and logs a MapMessage containing an attacker-controlled floating-point value. The resulting malformed JSON can corrupt the enclosing log record and disrupt downstream log ingestion and parsing.

Affected: Log4j API 2.13.1 through 2.25.4, and 2.26.0. Fixed in 2.25.5 and 2.26.1 (upstream apache/logging-log4j2#4163), which emit RFC 8259-compliant JSON for non-finite values.

Additional change

Pushed 58d9c8d on top of the Dependabot commit to update the bundled jar names in distribution/server/src/assemble/LICENSE.bin.txt and distribution/shell/src/assemble/LICENSE.bin.txt. Without it, ./gradlew checkBinaryLicense fails with 10 issues per distribution (5 × 2.26.1 unaccounted for, 5 × 2.26.0 mentioned but not bundled). Verified green locally after the fix.