Scheduled Removal of Log4J 1 from ESAPI Code Base

[kwwall]

This is mostly a rehash of Scheduling removal of Log4J 1 from ESAPI 2.x that was posted to the "ESAPI Project Users" Google Groups on April 27, 2022. It is being repeated here to make it more visible since we are less than a month away:

The ESAPI deprecation policy (barring some critical or high vulnerability that has no workaround) is that we will leave the deprecated class or method around until either:

1. The next major release (which would be 3.0.0.0 and it not yet scheduled) OR
2. Two years after the release date in which it was first deprecated.

Since we officially deprecated Log4J 1 in ESAPI version 2.2.1.0 that was released on July 12, 2020, we will be scheduling it for complete removal on or shortly after July 12, 2022 even if it requires a special release to do so.

Please plan accordingly as July is not that far off. (And for us, it can't come too soon! :)

-kevin
--
Blog: https://off-the-wall-security.blogspot.com/ | Twitter: @KevinWWall | OWASP ESAPI Project co-lead
NSA: All your crypto bit are belong to us.

This ESAPI release will tentatively be 2.5.0.0 and the major update will be the long-planned removal of the Log4J 1 dependency. If this is the first that you are hearing about it, I apologize, but this follows our standard deprecation policy and has been mentioned in various posts to Google Groups as well as in some of the release notes.