We are using spring boot 2.1.5 and starter parent as pom dependency.

Spring boot is using default logback for logging and we haven't explicitly switched to Log4j2 or changes any configurations. Below is our project dependency tree.

We have lot of lombok @log4j2 annotations in our project. But, we find in dependency tree we do not have any log4j2-core jar dependency (that has been found vulnerable to recent issues with log4j).

@Log4j2
@Service
@DependsOn("applicationDependencyCheck")

Is lombok @log4j2 not dependent on log4j2-core.jar. Is it correct to assume this would show up in maven dependency tree or are we missing something.

This is our lombok entry -

<dependency>
    <groupId>org.projectlombok</groupId>
    <artifactId>lombok</artifactId>
    <optional>true</optional>
</dependency>

Please share some insights.

thanks