Bump apache-log4j from 2.26.0 to 2.26.1

[dependabot]

Bumps apache-log4j from 2.26.0 to 2.26.1.
Updates org.apache.logging.log4j:log4j-api from 2.26.0 to 2.26.1

Updates org.apache.logging.log4j:log4j-core from 2.26.0 to 2.26.1

Updates org.apache.logging.log4j:log4j-layout-template-json from 2.26.0 to 2.26.1

Updates org.apache.logging.log4j:log4j-slf4j2-impl from 2.26.0 to 2.26.1

Updates org.apache.logging.log4j:log4j-web from 2.26.0 to 2.26.1

Updates org.apache.logging.log4j:log4j-1.2-api from 2.26.0 to 2.26.1

[epugh]

@janhoy is this branch, main, not on the "clumping" routine of one big update per month?

[janhoy]

@janhoy is this branch, main, not on the "clumping" routine of one big update per month?

This is dependabot, not renovatebot. I think dependabot runs in a mode where it only bumps packages with known vulnerabilities in them, not any package with a newer version. So we could treat it as "more urgent" somehow? But I'd rather roll this feature into our solrbot - renovatebot has a feature where it can connect to dependency graph in github I think, but it is not setup.

[epugh]

@janhoy is this branch, main, not on the "clumping" routine of one big update per month?

This is dependabot, not renovatebot. I think dependabot runs in a mode where it only bumps packages with known vulnerabilities in them, not any package with a newer version. So we could treat it as "more urgent" somehow? But I'd rather roll this feature into our solrbot - renovatebot has a feature where it can connect to dependency graph in github I think, but it is not setup.

Yeah, I don't see value in this, I see another source of noise that will be ignored. Do we have to ahve dependabot? I would love to not see these and just see the same monthly updates.