[
https://issues.apache.org/jira/browse/HADOOP-20049?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18137939#comment-18137939
]
ASF GitHub Bot commented on HADOOP-20049:
-----------------------------------------
joseluisll commented on PR #8903:
URL: https://github.com/apache/hadoop/pull/8903#issuecomment-6629176121
Sorry, I misread your first comment as asking for exclusions.
**On overriding in `dependencyManagement`:** `hadoop-project/pom.xml`
already manages `slf4j-api` at `${slf4j.version}` (1.7.36). That's why Hadoop's
own build, tests and distribution resolve 1.7.36 on Jetty 12 even without this
patch. But it doesn't reach a downstream project: with Maven 3, when a consumer
resolves `hadoop-hdfs`, only the consumer's own `dependencyManagement` applies
to `hadoop-hdfs`'s transitive dependencies, not the one in `hadoop-hdfs`'s
parent.
**The risk:** For example a downstream test setup for `MiniDFSCluster` that
lists `hadoop-hdfs` before `hadoop-client`.
slf4j 2 ignores the 1.7 binding, so all logging goes to NOP, Hadoop's
included. The only sign is an `SLF4J(W): No SLF4J providers were found` warning
on stderr. Because `hadoop-client` needs `slf4j-api` at compile scope, the
2.0.17 version reaches the consumer's main classpath too, not only its tests.
On trunk the same project resolves 1.7.36.
The risk is narrow. Only `hadoop-hdfs`, `hadoop-hdfs-nfs` and
`hadoop-yarn-client` are affected, and only in consumers that list one of them
before `hadoop-client` and don't manage slf4j themselves.
`hadoop-minicluster`, `hadoop-client-minicluster` and the shaded clients are
unaffected.
I also checked the published artifacts of downstram projects: they declare
`slf4j-api` directly, the same thing this patch does, so neither their builds
nor their users are affected.
So, minimal risk, your call.
> Keep slf4j-api at the managed version for consumers once Jetty 12 is in
> -----------------------------------------------------------------------
>
> Key: HADOOP-20049
> URL: https://issues.apache.org/jira/browse/HADOOP-20049
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: build, common
> Reporter: Jose Luis López
> Assignee: Jose Luis López
> Priority: Major
> Labels: pull-request-available
>
> Jetty 12.1.14 declares {{org.slf4j:slf4j-api:2.0.17}} at compile scope; in
> Jetty 9.4 it is provided and optional. It runs correctly on Hadoop's 1.7.36,
> but the declaration reaches Maven consumers of the non-shaded artifacts.
> {{hadoop-yarn-client}}, {{hadoop-hdfs}} and {{hadoop-hdfs-nfs}} depend on
> Jetty directly, do not declare {{slf4j-api}}, and keep {{hadoop-common}} at
> provided. A consumer declaring one of them before {{hadoop-client}} then
> resolves {{slf4j-api:2.0.17}} with {{slf4j-reload4j:1.7.36}}. slf4j 2 ignores
> that binding, so all logging goes to NOP, with only a warning on stderr.
> Shaded clients are not affected.
> This must land before HADOOP-19972 or together with it. Hadoop stays on slf4j
> 1.7.36. Moving to slf4j 2 is out of scope.
> *Verification:* with the fix, no published artifact resolves {{slf4j-api}}
> 2.0.17 through Jetty, alone or declared before {{hadoop-client}}.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
