[TINKERPOP-2715] remove log4jv1 dependency

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Done
• Affects Version/s: 3.5.2
• Fix Version/s: 3.7.0, 3.6.1
• Component/s: build-release
• Assignee: Stephen Mallette
• Reporter: PJ Fanning
• Created: 03/Mar/22 13:37
• Updated: 16/Jun/22 10:46
• Resolved: 16/Jun/22 10:46

Description

Can this be reconsidered? Log4jv1 has even more open CVEs now.

https://repo1.maven.org/maven2/org/apache/tinkerpop/gremlin-driver/3.5.2/gremlin-driver-3.5.2.pom

https://issues.apache.org/jira/browse/TINKERPOP-1983

Issue Links

• relates to: TINKERPOP-1983 Update Log4j to Log4j2