"On August 5, 2015 the Logging Services Project Management Committee announced that Log4j 1.x had reached end of life." The long-awaited log4j v2 is now released, and they recommend we upgrade.
This is an opportunity to review our logging infrastructure. Simply replacing log4j v1 with v2 is certainly reasonable, but we use a fair amount of slf4j in DSpace as well and have it shimmed onto log4j. We may want to consider things like logback, Commons Logging, etc.