3.2.0 New Relic Logback jar also contains commons-lang3

[dangymbol]

Description

com.newrelic.logging:logback:3.2.0 correctly contains the classes from New Relic for logback integration but also contains org.apache.commons:commons-lang3:3.13.0

This means that if commons-lang3 is also on the build path there could be classpath issues.

Expected Behavior

The com.newrelic.logging:logback jar should either shade, reference or remove the commons-lang3 component.

Troubleshooting results

It looks as though the version included is commons-lang3:3.13.0 - I have set the version the project is using to the same version to try and avoid conflicts.

Steps to Reproduce

I used jar -tvf to check the output of the duplicate classpath tool:

jar -tvf logback-3.2.0.jar
     0 Wed Sep 25 22:52:00 BST 2024 META-INF/
    25 Wed Sep 25 22:52:00 BST 2024 META-INF/MANIFEST.MF
     0 Wed Sep 25 22:52:00 BST 2024 com/
     0 Wed Sep 25 22:52:00 BST 2024 com/newrelic/
     0 Wed Sep 25 22:52:00 BST 2024 com/newrelic/logging/
     0 Wed Sep 25 22:52:00 BST 2024 com/newrelic/logging/logback/
   629 Wed Sep 25 22:52:00 BST 2024 com/newrelic/logging/logback/JsonFactoryProvider.class

   ... more com/newrelic/logging classes ...

       0 Sat May 20 13:25:22 BST 2023 org/
     0 Sat May 20 13:25:22 BST 2023 org/apache/
     0 Sat May 20 13:25:22 BST 2023 org/apache/commons/
     0 Sat May 20 13:25:22 BST 2023 org/apache/commons/lang3/
  3340 Sat May 20 13:25:22 BST 2023 org/apache/commons/lang3/AnnotationUtils$1.class
  6700 Sat May 20 13:25:22 BST 2023 org/apache/commons/lang3/AnnotationUtils.class
  4490 Sat May 20 13:25:22 BST 2023 org/apache/commons/lang3/ArchUtils.class

   ... all of commons-lang3 ...

Your Environment

I spotted this on a project building on JDK17 using Gradle 7.6.3. The project is using mavenCentral(). I suspect this will affect any build pulling version 3.2.0 though.

Additional context

This may also affect other version of the New Relic Logback appenders - I've not checked. Just from a quick file size check it looks as though the issue was introduced in 3.1.0 since the 3.0.0 jar is much smaller.

[workato-integration]

https://new-relic.atlassian.net/browse/NR-348993

[jtduffy]

@dangymbol
Thanks for the report. I'm opening a PR to resolve this and new set of extension jars should be released this afternoon or early Monday.

[jtduffy]

@dangymbol
v3.3.0 is now available