analysis-kotlin-descriptors-1.9.10.jar is bundled with log4j:1.2.17.2

[theo-ritense]

Describe the bug
Similar to #2488

Seems that analysis-kotlin-descriptors-1.9.10.jar is bundled with log4j version 1.2.17.2. DependencyCheck is marking it CRITICAL via .gradle/caches/modules-2/files-2.1/org.jetbrains.dokka/analysis-kotlin-descriptors/1.9.10/.../analysis-kotlin-descriptors-1.9.10.jar/META-INF/maven/log4j/log4j/pom.xml

Expected behaviour
Upgrade to log4j version without security issues.

To Reproduce
Check the dependency tree

Installation

Operating system: Linux
Build tool: Gradle v8.5
Dokka version: 1.9.10 & 1.9.20

[snesm]

This appears to be an issue with Dokka 1.9.20 as well

[theo-ritense]

On a similar note, DependencyCheck also marks the following files/dependencies from 1.9.20 with a MEDIUM severity:

• org.apache.commons:commons-compress:1.21

  • .gradle/caches/modules-2/files-2.1/org.jetbrains.dokka/analysis-kotlin-descriptors/1.9.20/.../analysis-kotlin-descriptors-1.9.20.jar/META-INF/maven/org.apache.commons/commons-compress/pom.xml
  • CVE-2024-25710

• gfm-template-processing-plugin-1.9.20.jar

  • .gradle/caches/modules-2/files-2.1/org.jetbrains.dokka/gfm-template-processing-plugin/1.9.20/.../gfm-template-processing-plugin-1.9.20.jar
  • CVE-2018-1000840

[snesm]

These seem to stem from the distribution being a fat jar which is not considered best practice because they introduce issues like this.

[theo-ritense]

@whyoleg Thanks!