ppkarwasz commented on issue #3754: URL: https://github.com/apache/logging-log4j2/issues/3754#issuecomment-2993626146
@EliasZ, Great question — thank you for bringing it up. This issue went undetected for a few key reasons: * `spotbugs-annotations` is a compile-time–only dependency. As long as the JDK used to build Log4j matches or exceeds the major version targeted by `spotbugs-annotations`, no compilation errors occur. We build all artifacts using JDK 17 to take advantage of its improved bytecode generation and because several of our Maven plugins require JRE 17. * We run all our tests on JRE 8 to ensure runtime compatibility across our dependencies. Since `spotbugs-annotations` are not retained at runtime, they do not cause any issues during testing. * This is a Gradle-specific issue (see gradle/gradle#33964). We don’t use Gradle in our build pipeline, so we didn’t encounter the problem directly. Gradle includes a heuristic that attempts to detect Java version mismatches in dependencies, but in this case, it is overly aggressive and flags a **false positive**. Without that heuristic, `spotbugs-annotations` 4.9.x would not cause any problems in most projects. Our integration suite does include a Gradle example, [`log4j-samples-gradle-metadata`](https://github.com/apache/logging-log4j-samples/tree/main/log4j-samples-gradle-metadata), which was added during the development of `2.25.0`. However, this example did not target Java 8, so the compatibility issue went unnoticed. This oversight will be addressed in apache/logging-log4j-samples#339. As we primarily use Maven in our own development, we rely on our Gradle user community to help identify and troubleshoot Gradle-specific issues. Your feedback is invaluable in ensuring compatibility across different build tools. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notifications-unsubscr...@logging.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
