[jira] [Work logged] (ARTEMIS-3453) exclude transitive log4j dep from zookeeper usage

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/ARTEMIS-3453?focusedWorklogId=643949&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-643949 ]

ASF GitHub Bot logged work on ARTEMIS-3453:
-------------------------------------------

                Author: ASF GitHub Bot
            Created on: 31/Aug/21 10:26
            Start Date: 31/Aug/21 10:26
    Worklog Time Spent: 10m 
      Work Description: gemmellr opened a new pull request #3712:
URL: https://github.com/apache/activemq-artemis/pull/3712


   https://issues.apache.org/jira/browse/ARTEMIS-3453
   
   Didnt test this at all yet other than seeing its effect on the main build. Seems the way to go though so raising for a PR run and any input from others.
   
   In particular, by excluding sl4fj-log4j and log4j across the board, it may be necessary to add other dependencies to some modules (examples?) if they lack a another means of output such as another slf4j bridge.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Issue Time Tracking
-------------------

            Worklog Id:     (was: 643949)
    Remaining Estimate: 0h
            Time Spent: 10m

> exclude transitive log4j dep from zookeeper usage
> -------------------------------------------------
>
>                 Key: ARTEMIS-3453
>                 URL: https://issues.apache.org/jira/browse/ARTEMIS-3453
>             Project: ActiveMQ Artemis
>          Issue Type: Task
>    Affects Versions: 2.18.0
>            Reporter: Robbie Gemmell
>            Priority: Major
>             Fix For: 2.19.0
>
>          Time Spent: 10m
>  Remaining Estimate: 0h
>
> The quorum bits introduced in ARTEMIS-2716 in 2.18.0 use Zookeeper, which brings a transitive dependency on log4j 1.2.17, which is end of life. Although log4j 1.2.17 was not included in the distribution archives, it still a transitive dependency of some of the modules that use these quorum bits.
> The original change does look to exclude slf4j-log4j12, but this doesnt exclude log4j itself which is also a direct dependency of zookeeper (ironically, it seems not for direct logging, but only some JMX feature, with slf4j used for the actual logging). It should also be excluded.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)