[MJAVADOC-724] Maven Java Doc Plug-in v3.4.0 downloads Log4j-1.2.12 dependency transitively

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Component/s: jar, javadoc
• Labels: Vulnerability
• Environment: Windows 10
• Flags: Important

Language

English

• Assignee: Unassigned
• Reporter: Yogesh Desai
• Created: 09/Aug/22 19:59
• Updated: 27/Sep/22 12:19
• Resolved: 27/Sep/22 12:19

Description

I have observed that Maven Java Doc Plug-in v3.4.0 downloads Log4j-1.2.12 dependency transitively in .m2 folder. Since Log4j-1.X is strictly prohibited for use in many organisations, we had no other option that not using the plugin. Please plan to fix this issue and get rid of the log4j-1.X dependency. Thanks!

Issue Links

• duplicates: MJAVADOC-726 Maven Java Doc Plugin downloads Log4j-1.2.12 dependency transitively
• is duplicated by: MJAVADOC-726 Maven Java Doc Plugin downloads Log4j-1.2.12 dependency transitively