zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-04-29 19:47:51 +02:00
Code Issues Projects Releases Packages Wiki Activity

Completely remove log4j (#1466)

Browse source 
* Completely remove log4j

Prevent Gradle plugin from using log4j.
This commit is contained in:
Weimin Yu 2021-12-13 14:18:31 -05:00 • committed by GitHub
parent 25e23ceef9
commit 69d06989c0
3 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
build.gradle
View file

@ -20,6 +20,9 @@ buildscript {
// Lock buildscript dependencies.
configurations.classpath {
resolutionStrategy.activateDependencyLocking()
// See java_common.gradle for explanation.
exclude group: 'org.apache.logging.log4j'
}
}

2
gradle/dependency-locks/buildscript-classpath.lockfile
View file

@ -40,8 +40,6 @@ org.apache.ant:ant-launcher:1.9.7
org.apache.ant:ant:1.9.7
org.apache.commons:commons-compress:1.20
org.apache.commons:commons-lang3:3.8.1
org.apache.logging.log4j:log4j-api:2.11.0
org.apache.logging.log4j:log4j-core:2.11.0
org.apache.maven:maven-artifact:3.6.2
org.apache.maven:maven-builder-support:3.6.2
org.apache.maven:maven-model-builder:3.6.2

2
java_common.gradle
View file

@ -64,6 +64,8 @@ configurations {
it.exclude group: 'org.mockito', module: 'mockito-core'
}
all.each {
// log4j has high-profile security vulnerabilities. It's a transitive dependency used by some
// Apache Beam packages. Excluding it does not impact our troubleshooting needs.
it.exclude group: 'org.apache.logging.log4j'
}
}