[jira] [Updated] (LIVY-1090) Upgrade SLF4J from 1.7.36 to 2.0.17 (log4j-slf4j-impl -> log4j-slf4j2-impl)

["Gabor Roczei (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/LIVY-1090?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Gabor Roczei updated LIVY-1090:
-------------------------------
    Affects Version/s: 1.0.0

> Upgrade SLF4J from 1.7.36 to 2.0.17 (log4j-slf4j-impl -> log4j-slf4j2-impl)
> ---------------------------------------------------------------------------
>
>                 Key: LIVY-1090
>                 URL: https://issues.apache.org/jira/browse/LIVY-1090
>             Project: Livy
>          Issue Type: Improvement
>    Affects Versions: 1.0.0
>            Reporter: Gabor Roczei
>            Assignee: Gabor Roczei
>            Priority: Major
>
> h3. Problem
> Livy depends on SLF4J {{1.7.36}} and binds it to Log4j 2 via {{log4j-slf4j-impl}}, which targets the SLF4J *1.x* API. SLF4J 2.0.x changed its provider-discovery mechanism: the old {{StaticLoggerBinder}} lookup was replaced by a {{ServiceLoader}}-based {{org.slf4j.spi.SLF4JServiceProvider}}. Running on SLF4J 2.x therefore requires the matching Log4j binding, {{log4j-slf4j2-impl}}.
> h3. Change
> * {{pom.xml}}: {{slf4j.version}} {{1.7.36}} -> {{2.0.17}}
> * Swap the Log4j binding artifact {{log4j-slf4j-impl}} -> {{log4j-slf4j2-impl}} in the direct declarations we own:
> ** {{pom.xml}} ({{dependencyManagement}}; version stays {{${log4j.version}}})
> ** {{core/pom.xml}}
> ** {{repl/pom.xml}} ({{scope: provided}} unchanged)
> ** {{rsc/pom.xml}} ({{scope: provided}} unchanged)
> h3. Notes
> * No Log4j version bump is needed: Livy is already on Log4j {{2.26.0}}, which is newer than the {{2.23.0}} minimum required by {{log4j-slf4j2-impl}}.
> * The {{log4j-slf4j-impl}} references inside the {{<exclusions>}} on {{hive-jdbc}} ({{thriftserver/server/pom.xml}}, {{integration-test/pom.xml}}) are intentionally left unchanged — they exclude the SLF4J-1.x binding that Hive brings transitively (still named {{log4j-slf4j-impl}}); renaming them would make the exclusions no-ops.
> * Livy's own code has no references to {{org.slf4j.impl}} / {{StaticLoggerBinder}}, so this is a pure pom change with no source changes required.
> h3. Verification
> {{mvn dependency:tree}} on {{core}}, {{repl}}, {{rsc}}, and {{server}} confirms {{slf4j-api}} resolves to {{2.0.17}}, {{log4j-slf4j2-impl}} is present, and no {{log4j-slf4j-impl}} remains on the compile/runtime classpath. {{core}} builds and its tests pass with no SLF4J "multiple bindings" / "no providers" warnings.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)