springboot 1.x升级log4j2漏洞遇到打包问题

springboot-1.5.9.RELEASE 环境配置的spring-boot-starter-log4j2依赖

log4j-core-2.7jar

log4j-api-2.7.jar

log4j-slf4j-impl-2.7.jar

需要升级到最新版本，目前已经是2.16.0,老系统升级基本都是如下配置

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-log4j2</artifactId>
 </dependency>

<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>2.16.0</version>
</dependency>

<dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-slf4j-impl</artifactId>
      <version>2.16.0</version>
</dependency>
<dependency>
     <groupId>org.apache.logging.log4j</groupId>
      <artifactId>log4j-api</artifactId>
      <version>2.16.0</version>
</dependency>

            

但是有个服务通过assembly插件打包后，发现lib文件夹下还是log4j2-2.7版本.......,折腾好久也没搞明白，仔细看了下

pom文件中有dependencyManagement配置,将log4j-core-2.16.0jar log4j-api-2.16.0.jar log4j-slf4j-impl-2.16.0.jar加入依赖管理问题解决,正确配置如下

<dependencyManagement>
		<dependencies>
			<dependency>
				<!-- Import dependency management from Spring Boot -->
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-dependencies</artifactId>
				<version>${spring.boot.version}</version>
				<type>pom</type>
				<scope>import</scope>
			</dependency>
			<dependency>
				<groupId>org.apache.logging.log4j</groupId>
				<artifactId>log4j-core</artifactId>
				<version>2.16.0</version>
			</dependency>
			<dependency>
				<groupId>org.apache.logging.log4j</groupId>
				<artifactId>log4j-slf4j-impl</artifactId>
				<version>2.16.0</version>
			</dependency>
			<dependency>
				<groupId>org.apache.logging.log4j</groupId>
				<artifactId>log4j-api</artifactId>
				<version>2.16.0</version>
			</dependency>
		</dependencies>
	</dependencyManagement>