We can do something about #3 (dependencies which bring Log4j 1 back in) by helping those downstream projects to upgrade. That’s why I took on Hadoop and Zookeeper as well (Spark depends on Hadoop and Hadoop depends on Zookeeper).
We should probably try to start from the bottom and work our way up in den dependency graph. It seems like most of the dependencis are Apache projects, but if we find an important non-Apache project we should consider helping that as well. On Aug 12, 2016 6:52 PM, "Mikael Ståldal" <[email protected]> wrote: > There seem to be quite some frustration in some other Apache projects > about migrating from Log4j 1. Especially around configration. Some seem to > consider dropping Log4j completely instead of going for Log4j 2. > > I have taken on Spark, Hadoop and Zookeeper; see links to their Jira > issues from LOG4J2-1473. I could need some help. >
