[TH2-4231] Update dependencies with vulnerabilities (dev branch) #19
Conversation
fiodar-r
changed the title
OptimumCode
left a comment
OptimumCode
left a comment
There was a problem hiding this comment.
Did you check this version for vulnerabilities?
build.gradle
Outdated
| implementation "org.slf4j:slf4j-log4j12" | ||
| implementation "org.slf4j:slf4j-api" | ||
| implementation "org.apache.logging.log4j:log4j-slf4j-impl" | ||
| implementation "org.apache.logging.log4j:log4j-1.2-api" |
There was a problem hiding this comment.
We don't need this here. Please, return back the slf4j-api dependency
There was a problem hiding this comment.
In common, we moved to this logging implementation because we need support for the first and second versions of log4j. I removed the dependency with the implementation, leaving only the api. Nevertheless, when running tests, logging works as it should.
There was a problem hiding this comment.
And yes, this versions is fine in sense of vulnerabilities
There was a problem hiding this comment.
We don't need the dependency on the log4j-1.2 API. We are using slf4j for logging. log4j is one of the adapter implementations for slf4j. So, we need only dependency on the slf4j API. No dependencies on log4j should be declared in the dependencies block
There was a problem hiding this comment.
ok, I got the point, thanks
No description provided.