John Interrante created DAFFODIL-2602:
-----------------------------------------
Summary: Daffodil uses different versions of log4j-api and
log4j-core
Key: DAFFODIL-2602
URL: https://issues.apache.org/jira/browse/DAFFODIL-2602
Project: Daffodil
Issue Type: Bug
Components: Libraries
Affects Versions: 3.2.0
Reporter: John Interrante
Inspected daffodil 3.2.0 zip. Libs have log4j-api-2.13.2 and
log4j-core-2.14.1. Checked why they aren't the same version. Checked how we
add these libs,
{noformat}
project/Dependencies.scala
33: "org.apache.logging.log4j" %% "log4j-api-scala" % "12.0",
34: "org.apache.logging.log4j" % "log4j-core" % "2.14.1" % "it,test",
48: "org.apache.logging.log4j" % "log4j-core" % "2.14.1",{noformat}
We specify version for jars in project/Dependencies.scala. Adding
log4j-api-scala 12.0 also adds log4j-api 2.13.2 2.13.2 transitively but
log4j-core 2.13.2 is a runtime dependency, meaning it isn't added
[transitively|https://github.com/apache/logging-log4j-scala/blob/master/project/Dependencies.scala].
We added all these three lines to project/Dependencies.scala in PR #605 but we
didn't add log4j-api for some reason even though log4j-scala's
[README|https://github.com/apache/logging-log4j-scala] suggests adding both
log4j-api and log4j-core to our dependencies. We should add the same version
of log4j-api for consistency, which will allow Scala Steward to bump both of
them to even later versions (note log4j-api-scala 12.0 bases its API on
log4j-api 2.13.2, but there should be no backward API incompatibilities in
future log4j 2.x releases).
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
