diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml
index 1519c3e89b0..cc61f7fdabc 100644
--- a/.github/workflows/scorecards-analysis.yaml
+++ b/.github/workflows/scorecards-analysis.yaml
@@ -70,6 +70,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@47b3d888fe66b639e431abf22ebca059152f1eea    # 2.1.22
+        uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571    # 2.1.22
         with:
           sarif_file: results.sarif
diff --git a/log4j-parent/pom.xml b/log4j-parent/pom.xml
index d276e4a6178..5517c43c0c9 100644
--- a/log4j-parent/pom.xml
+++ b/log4j-parent/pom.xml
@@ -93,7 +93,7 @@
     <hsqldb.version>2.7.2</hsqldb.version>
     <jackson-bom.version>2.16.1</jackson-bom.version>
     <!-- Override the version in Jakarta EE 9 BOM: -->
-    <jakarta-activation.version>2.1.2</jakarta-activation.version>
+    <jakarta-activation.version>2.1.3</jakarta-activation.version>
     <jakarta-mail.version>2.1.2</jakarta-mail.version>
     <!-- BOM with Jakarta EE 9 APIs: -->
     <jakartaee-bom.version>9.1.0</jakartaee-bom.version>
diff --git a/src/changelog/.2.x.x/update_github_codeql_action.xml b/src/changelog/.2.x.x/update_github_codeql_action.xml
index efcbf4fbd60..70718fb54c3 100644
--- a/src/changelog/.2.x.x/update_github_codeql_action.xml
+++ b/src/changelog/.2.x.x/update_github_codeql_action.xml
@@ -3,6 +3,6 @@
        xmlns="http://logging.apache.org/log4j/changelog"
        xsi:schemaLocation="http://logging.apache.org/log4j/changelog https://logging.apache.org/log4j/changelog-0.1.3.xsd"
        type="updated">
-  <issue id="2317" link="https://github.com/apache/logging-log4j2/pull/2317"/>
-  <description format="asciidoc">Update `github/codeql-action` to version `3.24.5`</description>
+  <issue id="2332" link="https://github.com/apache/logging-log4j2/pull/2332"/>
+  <description format="asciidoc">Update `github/codeql-action` to version `3.24.6`</description>
 </entry>
diff --git a/src/changelog/.2.x.x/update_jakarta_activation_jakarta_activation_api.xml b/src/changelog/.2.x.x/update_jakarta_activation_jakarta_activation_api.xml
new file mode 100644
index 00000000000..89c3529e332
--- /dev/null
+++ b/src/changelog/.2.x.x/update_jakarta_activation_jakarta_activation_api.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="http://logging.apache.org/log4j/changelog"
+       xsi:schemaLocation="http://logging.apache.org/log4j/changelog https://logging.apache.org/log4j/changelog-0.1.3.xsd"
+       type="updated">
+  <issue id="2335" link="https://github.com/apache/logging-log4j2/pull/2335"/>
+  <description format="asciidoc">Update `jakarta.activation:jakarta.activation-api` to version `2.1.3`</description>
+</entry>
diff --git a/src/site/_release-notes/_2.x.x.adoc b/src/site/_release-notes/_2.x.x.adoc
index d0138e216b0..d7acc079e28 100644
--- a/src/site/_release-notes/_2.x.x.adoc
+++ b/src/site/_release-notes/_2.x.x.adoc
@@ -28,13 +28,20 @@ This releases contains ...
 
 * Improve performance of `CloseableThreadContext#closeMap()` (https://github.com/apache/logging-log4j2/pull/2296[2296])
 
+[#release-notes-2-x-x-fixed]
+=== Fixed
+
+* Add `log4j2.StatusLogger.DateFormatZone` system property to set the time-zone `StatusLogger` uses to format `java.time.Instant`. Without this formatting patterns accessing to time-zone-specific fields (e.g., year-of-era) cause failures.
+* Fix stack overflow in `StatusLogger`
+
 [#release-notes-2-x-x-updated]
 === Updated
 
 * Update `co.elastic.clients:elasticsearch-java` to version `8.12.2` (https://github.com/apache/logging-log4j2/pull/2315[2315])
 * Update `co.elastic.logging:log4j2-ecs-layout` to version `1.6.0` (https://github.com/apache/logging-log4j2/pull/2301[2301])
 * Update `com.github.tomakehurst:wiremock-jre8` to version `2.35.2` (https://github.com/apache/logging-log4j2/pull/2306[2306])
-* Update `github/codeql-action` to version `3.24.5` (https://github.com/apache/logging-log4j2/pull/2317[2317])
+* Update `github/codeql-action` to version `3.24.6` (https://github.com/apache/logging-log4j2/pull/2332[2332])
 * Update `io.fabric8:docker-maven-plugin` to version `0.44.0` (https://github.com/apache/logging-log4j2/pull/2299[2299])
+* Update `jakarta.activation:jakarta.activation-api` to version `2.1.3` (https://github.com/apache/logging-log4j2/pull/2335[2335])
 * Update `org.apache.commons:commons-compress` to version `1.26.0` (https://github.com/apache/logging-log4j2/pull/2304[2304])
 * Update `org.apache.kafka:kafka-clients` to version `3.7.0` (https://github.com/apache/logging-log4j2/pull/2326[2326])