splunk-library-javalogging log4j2 vulnerability

[splunkuser61]

I can see that there is a new version of splunk-library-javalogging dependency released for the log4j2 vulnerability. Can we just override the log4j2 versions to the newer version(2.17.0) on the parent pom instead of updating the splunk-library-javalogging dependency to 1.11.*?

[vmalaviya]

It may not work so for security reasons we recommend you to upgrade the library version.