1.1.2
This patch release prevents transitive dependency on Log4j 1.2 through Jena which contains known security vulnerabilities.
You might still have to import Log4j 1.2 in your final project, and we suggest using the Log4j 1.2 compatibility API provided by Log4j 2 to that end:
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-1.2-api</artifactId>
<version>${log4j2.version}</version>
</dependency>