How Deep Is the Log4j Vulnerability in Maven Central? An In‑Depth Dependency Analysis
Google Open Source Insights researchers examined every Maven Central package version, revealing that over 8% of Java packages are affected by Log4j, most through transitive dependencies, and highlighting the complex, multi‑step remediation required across deep dependency trees.
