[jira] [Work logged] (ARTEMIS-3453) exclude transitive log4j dep from zookeeper usage

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/ARTEMIS-3453?focusedWorklogId=644904&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-644904 ]

ASF GitHub Bot logged work on ARTEMIS-3453:
-------------------------------------------

                Author: ASF GitHub Bot
            Created on: 01/Sep/21 09:15
            Start Date: 01/Sep/21 09:15
    Worklog Time Spent: 10m 
      Work Description: gtully commented on pull request #3712:
URL: https://github.com/apache/activemq-artemis/pull/3712#issuecomment-909108580


   +1 it is the way to go


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Issue Time Tracking
-------------------

    Worklog Id:     (was: 644904)
    Time Spent: 1h 10m  (was: 1h)

> exclude transitive log4j dep from zookeeper usage
> -------------------------------------------------
>
>                 Key: ARTEMIS-3453
>                 URL: https://issues.apache.org/jira/browse/ARTEMIS-3453
>             Project: ActiveMQ Artemis
>          Issue Type: Task
>    Affects Versions: 2.18.0
>            Reporter: Robbie Gemmell
>            Priority: Major
>             Fix For: 2.19.0
>
>          Time Spent: 1h 10m
>  Remaining Estimate: 0h
>
> The quorum bits introduced in ARTEMIS-2716 in 2.18.0 use Zookeeper, which brings a transitive dependency on log4j 1.2.17, which is end of life. Although log4j 1.2.17 was not included in the distribution archives, it still a transitive dependency of some of the modules that use these quorum bits.
> The original change does look to exclude slf4j-log4j12, but this doesnt exclude log4j itself which is also a direct dependency of zookeeper (ironically, it seems not for direct logging, but only some JMX feature, with slf4j used for the actual logging). It should also be excluded.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)