3 steps to migrating off vulnerable Log4j 1.x.
Log4j 1.x has been end-of-life since 2015. It still ships in production dependency trees everywhere, and unlike Log4j 2.x, it will never receive another security patch, including for vulnerabilities discovered years after support ended.
00felix automates the entire migration to Log4j 2.x. It rewrites the first-party code the new API actually requires, not just bumping a version number that won't compile.
Discover every call site the migration touches.
Understand exactly how deeply Log4j 1.x is wired into your first-party code before changing anything.
- Find every org.apache.log4j.* import across the codebase
- Flag direct use of the vulnerable SocketServer and SocketNode classes
- Detect custom Appender and Layout subclasses extending 1.x base classes
- Map log4j.properties and log4j.xml configuration files
- Build a complete migration plan ranked by call-site reachability
Migrate to Log4j 2.x automatically.
00felix rewrites the first-party code the new API requires. This isn't a dependency version bump, it's a different logging API entirely.
- log4j 1.2.17 → log4j2 2.23.1
- Rewrite every org.apache.log4j.* import to org.apache.logging.log4j.*
- Convert Logger.getLogger() call sites to LogManager.getLogger()
- Migrate MDC calls to the ThreadContext API
- Rebuild custom Appender/Layout classes against the 2.x builder pattern
- Translate log4j.properties / log4j.xml to log4j2.xml configuration
Validate the migration and eliminate risk.
A logging migration that breaks production logging is a worse outcome than the vulnerability it was meant to fix.
- Rebuild the application automatically
- Execute tests and confirm log output and levels are unchanged
- Verify log4j 1.x is fully removed, including transitive references
- Confirm the vulnerable SocketServer/SocketNode code paths no longer exist
- Generate a pull request automatically
- Measure CVE reduction before and after migration
Stop running EOL code.
Start shipping verified PRs.
Try Verified Upgrade on any Log4j 1.x repo in minutes.
No setup. No sales call. No credit card.
