[STORM-3829] Remove log4j version 1 (1.2.17) from storm-core

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.3.0
• Fix Version/s: 2.4.0
• Component/s: storm-core
• Assignee: Bipin Prasad
• Reporter: Bipin Prasad
• Created: 03/Mar/22 20:14
• Updated: 09/Mar/22 23:14
• Resolved: 09/Mar/22 23:14

Description

storm-core/pom.xml has the following entry:

        <!--Hadoop Mini Cluster cannot use log4j2 bridge,
        Surefire has a way to exclude the conflicting log4j API jar
        from the classpath, classpathDependencyExcludes, but it didn't work in practice.
        This is here as a work around to place it at the beginning of the classpath
        even though maven does not officially support ordering of the classpath.-->
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
            <version>1.2.17</version>
            <scope>test</scope>
        </dependency>

This dependency can be removed. "mvn test" goes to success. And "mvn dependency:tree | grep log4j" shows no transitive dependency on log4j-1.2.17.

Issue Links

• links to: Pull Request