log4j: 2.19.0
Apache projects don't consider git tags as the final release, only maven publishes. This applies for tomcat/zookeeper primarily.