[ARTEMIS-3453] exclude transitive log4j dep from zookeeper usage

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.18.0
• Fix Version/s: 2.19.0
• Assignee: Robbie Gemmell
• Reporter: Robbie Gemmell
• Created: 31/Aug/21 10:17
• Updated: 01/Sep/21 12:00
• Resolved: 01/Sep/21 12:00

Description

The quorum bits introduced in ARTEMIS-2716 in 2.18.0 use Zookeeper, which brings a transitive dependency on log4j 1.2.17, which is end of life. Although log4j 1.2.17 was not included in the distribution archives, it still a transitive dependency of some of the modules that use these quorum bits.

The original change does look to exclude slf4j-log4j12, but this doesnt exclude log4j itself which is also a direct dependency of zookeeper (ironically, it seems not for direct logging, but only some JMX feature, with slf4j used for the actual logging). It should also be excluded.

Issue Links

• links to: GitHub Pull Request #3712