use log4j to slf4j bridge and use 2.15.0 for log4j

.metals/metals.lock.db

@@ -0,0 +1,6 @@
+#FileLock
+#Mon Dec 13 08:06:58 EST 2021
+server=localhost\:64340
+hostName=localhost
+method=file
+id=17d76d0d61a5d2caa91cc16efdfbff2103d0fdd3cf6

build.sbt

@@ -3,7 +3,7 @@ import BuildSettings._
 import sbtassembly.AssemblyPlugin.autoImport.assemblyMergeStrategy
 import com.typesafe.sbt.packager.docker._
 
-lazy val commonDeps = Seq(logback, scalaTest, scalaCheck, akkaHttpSprayJson, embeddedPg, embeddedPgSupport, apacheCommonsIO, s3Mock)
+lazy val commonDeps = Seq(logback, scalaTest, scalaCheck, akkaHttpSprayJson, embeddedPg, embeddedPgSupport, apacheCommonsIO, s3Mock,log4jToSlf4j)
 
 lazy val sparkDeps =
   Seq(

project/Dependencies.scala

@@ -81,4 +81,8 @@ object Dependencies {
   lazy val alpakkaFile           = "com.lightbend.akka"         %% "akka-stream-alpakka-file"   % Version.alpkakkaFile
   lazy val scalacheckShapeless   = "com.github.alexarchambault" %% "scalacheck-shapeless_1.14"  % Version.scalacheckShapeless % Test
   lazy val diffx                 = "com.softwaremill.diffx"     %% "diffx-core"                 % Version.diffx % Test
+
+  // overriding the log4j-slf4j bridge used by spring, transitively brought in by s3mock
+  // this is needed because of CVE-2021-44228 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
+  lazy val log4jToSlf4j          = "org.apache.logging.log4j"   % "log4j-to-slf4j"              % Version.log4j % Test
 }

project/Version.scala

@@ -39,5 +39,6 @@ object Version {
   val cormorant              = "0.3.0"
   val kantantCsv             = "0.6.1"
   val scalacheckShapeless    = "1.2.3"
-  val diffx    = "0.4.0"
+  val diffx                  = "0.4.0"
+  val log4j                  = "2.15.0"
 }

project/build.properties

@@ -1 +1 @@
-sbt.version=1.3.10
+sbt.version=1.5.6