Merge pull request #463 from CDOT-CV/bug/log4j_removal

Adding explicit exclusions for log4j to remove from dependency tree
usdot-jpo-ode · Dec 17, 2021 · 10e84bc · 10e84bc
2 parents 8c2708b + 27701d8
commit 10e84bc
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 1 deletion.
diff --git a/jpo-ode-core/pom.xml b/jpo-ode-core/pom.xml
@@ -70,6 +70,10 @@
           <groupId>org.slf4j</groupId>
           <artifactId>slf4j-log4j12</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>log4j</groupId>
+          <artifactId>log4j</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
     <dependency>
@@ -88,4 +92,4 @@
     </dependency>
   </dependencies>
 
-</project>
+</project>
diff --git a/jpo-ode-svcs/pom.xml b/jpo-ode-svcs/pom.xml
@@ -19,6 +19,12 @@
     <dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter</artifactId>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.logging.log4j</groupId>
+          <artifactId>log4j-to-slf4j</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>

diff --git a/pom.xml b/pom.xml
@@ -50,6 +50,12 @@
     <dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter</artifactId>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.logging.log4j</groupId>
+          <artifactId>log4j-to-slf4j</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>