log4j in the classpath #753

Activity

1. bsideup

   added

   type/bug

   resolution/acknowledged

   on Jun 15, 2018
2. rnorth commented on Jun 15, 2018

   

   rnorth

   on Jun 15, 2018

   Member

   More actions

   Hmm, I went to exclude this and saw that there's already an exclusion... 🤔

       compile ('org.rnorth:tcp-unix-socket-proxy:1.0.2') {
           exclude(group: "log4j", module: "log4j")
       }
   

   (in core/build.gradle)

   Will investigate...
3. kiview commented on Jun 22, 2018

   

   kiview

   on Jun 22, 2018

   Member

   More actions

   When I'm running ./gradlew :testcontainers:dependencies everything looks fine btw.:

   +--- org.rnorth:tcp-unix-socket-proxy:1.0.2
   |    +--- com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
   |    |    +--- com.kohlschutter.junixsocket:junixsocket-common:2.0.4
   |    |    \--- org.scijava:native-lib-loader:2.0.2
   |    +--- com.kohlschutter.junixsocket:junixsocket-common:2.0.4
   |    \--- org.slf4j:slf4j-api:1.7.21 -> 1.7.25
   
4. dbyron0 commented on Jun 22, 2018

   

   dbyron0

   on Jun 22, 2018

   ContributorAuthor

   More actions

   I think the struggle is that the published pom (e.g. http://central.maven.org/maven2/org/testcontainers/testcontainers/1.8.0/testcontainers-1.8.0.pom) doesn't exclude it. I see the same thing in ~/.m2/repositories when I run: $ ./gradlew testcontainers:publishToMavenLocal (though the version there shows up as unspecified...different issue).

   I think the struggle is in the custom way the pom gets built....here. This doesn't take into account the exclusions. Changing to a configuration-wide exclusion:

   configurations {
       compile.exclude group: 'log4j', module: 'log4j'
   }
   

   didn't help.

   I took a crack at the more vanilla way of building a pom (by specifying from components.java as the docs say, and commenting out the code that adds dependencies to the xml directly), and the exclusions show up in the pom, but it's messy.

   👍React with 👍2Reacted by Kevin Wittek and Myroslav Papirkovskyi
5. bsideup commented on Jun 22, 2018

   

   bsideup

   on Jun 22, 2018 via email

   Member

   More actions

   Yes, we will need to handle the exclusion of public deps, thanks for reporting! I

   …

   On Fri, 22 Jun 2018 at 18:49, David Byron ***@***.***> wrote: I think the struggle is that the published pom (e.g. http://central.maven.org/maven2/org/testcontainers/testcontainers/1.8.0/testcontainers-1.8.0.pom) doesn't exclude it. I see the same thing in ~/.m2/repositories when I run: $ ./gradlew testcontainers:publishToMavenLocal (though the version there shows up as unspecified...different issue). I think the struggle is in the custom way the pom gets built....here <https://github.com/testcontainers/testcontainers-java/blob/master/gradle/publishing.gradle#L64>. This doesn't take into account the exclusions. Changing to a configuration-wide exclusion: configurations { compile.exclude group: 'log4j', module: 'log4j' } didn't help. I took a crack at the more vanilla way of building a pom (by specifying from components.java as the docs <https://docs.gradle.org/current/userguide/publishing_maven.html#sec:publishing_component_to_maven> say, and commenting out the code that adds dependencies to the xml directly), and the exclusions show up in the pom, but it's messy. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#753 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABAIiiX6N1CULM3ClLt-dCyfBhofkDmMks5t_SAngaJpZM4Uou1N> .
6. dbyron0 commented on Jun 22, 2018

   

   dbyron0

   on Jun 22, 2018

   ContributorAuthor

   More actions

   There's been a lot of activity on the gradle side around publishing...It's likely worth upgrading to 4.8.1 at least for https://docs.gradle.org/4.8/release-notes.html#customizing-the-generated-pom, though I don't see a silver bullet for this issue.
7. rnorth commented on Jul 12, 2018

   

   rnorth

   on Jul 12, 2018

   Member

   More actions

   Released in 1.8.1! 🎉
8. rnorth

   closed this as completedon Jul 12, 2018