Clean logging dependencies

[jhoeller]

The Spring Boot 2.0 starters seem to have a few oddities in master still:

• The core starter excludes commons-logging from spring-core (which isn't necessary anymore with Spring Framework 5.0's spring-jcl arrangement).

• spring-boot-starter-logging brings in log4j-over-slf4j which is a legacy Log4J 1.2 API binding (EOL'ed). Isn't it just meant to bring in log4j-to-slf4j for the Log4J 2.x API binding?

• spring-boot-starter-log4j2 brings in log4j-core as well as log4j-api but the latter is a transitive dependency of the former anyway, at least in all recent versions.

[wilkinsona]

The core starter excludes commons-logging from spring-core

Thanks. That's an oversight and we should tidy it up.

spring-boot-starter-logging brings in log4j-over-slf4j which is a legacy Log4J 1.2 API binding

This was intentional, but perhaps it's becoming unnecessary? The reason behind keeping the dependency was that we still want to be able to bridge the logging from libraries that use Log4J 1 into SLF4J.

spring-boot-starter-log4j2 brings in log4j-core as well as log4j-api

Thanks. We should tidy this up too.

[jhoeller]

Since Log4J 1.x has been EOL'ed in 2015, I doubt that there any relevant libraries using it still... in particular through its native API. There might just be the odd setup out there using it behind Commons Logging still. From that perspective, I would simply drop that Log4J 1.2 API bridge for good... also removing an inconsistency between the Logback vs Log4J 2 starters (where the similarly purposed log4j-1.2-api jar was never declared to begin with, as far as I can tell).

[wilkinsona]

We still have a number of Spring projects that depend upon it either directly or transitively. Those appear to be:

1. Spring Batch (BATCH-2656)
2. Spring Kafka (transitively, so out of our control)
3. Spring Retry (Drop use of Log4J 1.x spring-retry#95)

Spring Batch seems to be the most dependent on Log4J 1.x. Hopefully @mminella can tidy that up rather than carrying support into the new 4.x major line.

Spring Kafka's transitive dependency is via Kafka and, I think, a ZooKeeper client library that only affects spring-kafka-test. I don't think this should prevent us from dropping the bridge.

Spring Retry seems to build happily without its optional Log4j 1.2 dependency, so I think we're in the clear there.

[wilkinsona]

It was only a test that was actually using Log4j in Batch so I think we can go ahead and tidy all of this up in M7.

[wilkinsona]

I missed one in spring-boot-starter-parent.

[isopov]

@wilkinsona According to https://freemarker.apache.org/docs/pgui_misc_logging.html freemarker 2.3.* needs log4j-over-slf4j removed in this issue (still this version in https://github.com/spring-projects/spring-boot/blob/master/spring-boot-project/spring-boot-dependencies/pom.xml )
while 2.4.* does not. So this still library needs it also