[KYLIN-5174] remove log4jv1 dependency

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Assignee: Unassigned
• Reporter: PJ Fanning
• Created: 06/Apr/22 10:21
• Updated: 06/Apr/22 10:21

Description

Log4j v1 is end of life and has multiple unfixed security issues.

Replacements include:

• log4j v2 (eg v2.17.1)
• logback
• reload4j (a drop in replacement for log4j v1)

This is an example line in kylin build:

https://github.com/apache/kylin/blob/main/pom.xml#L144