I can't import logging dependancy into my project - spring

The import statements aren't working
I am new to Maven so I'm not sure what to do (if I'm missing a dependancy or something)

Add this in the dependency section of your pom :
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1.1</version>
</dependency>
There are other logging libraries available ,refer :
https://www.baeldung.com/java-logging-intro

If you are using Spring, I'm not sure if need to add it. When I add the line
Log log = LogFactory.getLog(MYCLASS.class);
to a class & I choose "Import class" in IntelliJ, I can see that it refers to org.springframework:spring-jcl:5.0.5.RELEASE, so it seems to already be available through the Spring.jar .
If you want to try adding it you can add the following to your dependencies list in the pom:
<!-- https://mvnrepository.com/artifact/commons-logging/commons-logging -->
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.2</version>
</dependency>
I would also point you to Log4j which is very popular & efficient. If you want to use that you need to do two things:
Add the dependencies to the pom:
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.3</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.3</version>
</dependency>
Add a log4j.properties or log4j.xml file with configurations to the classpath (mine is in sr/main/resources).

Related

Spring boot parent log4j2 update - vulnerability fix

Trying to update log4j2 for legacy spring boot application (using Spring-boot-parent-1.5.6.RELEASE) - using multi module
Tried all the ways spring suggested in recent docs but none of them worked.
Options tried:
option 1 - Adding to properties
<properties>
<log4j2.version>2.17.0</log4j2.version>
</properties>
option 2 - adding starter-log4j2 and excluding core, later adding log4j core (latest)
<dependency>
<groupid>org.springframework.boot</groupid>
<artifactid>spring-boot-starter-log4j2</artifactid>
<version>2.6.1</version>
<exclusions>
<exclusion>
<groupid>org.apache.logging.log4j</groupid>
<artifactid>log4j-core</artifactid>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupid>org.apache.logging.log4j</groupid>
<artifactid>log4j-core</artifactid>
<version>2.15.0</version>
</dependency>
option 3 - just the above one along with log4j2 api
<dependency>
<groupid>org.springframework.boot</groupid>
<artifactid>spring-boot-starter-log4j2</artifactid>
<exclusions>
<exclusion>
<groupid>org.apache.logging.log4j</groupid>
<artifactid>log4j-core</artifactid>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupid>org.apache.logging.log4j</groupid>
<artifactid>log4j-api</artifactid>
<version>2.16.0</version>
</dependency>
<dependency>
<groupid>org.apache.logging.log4j</groupid>
<artifactid>log4j-core</artifactid>
<version>2.16.0</version>
</dependency>
But still the dependencies imported were slf4j-over-log4j(1.7.25), log4j(2.7, 2.11.1). Is there something else i could do.
Option 1 should work.
Build your project using mvn clean install
Check the contents of your jar file: go to your_project/target directory and run jar tf your-project.jarcommand. There should be only log4j-core-2.17.0.jar and no other versions of log4j-core
Edit: also update log4j-core version in your child modules

Why isn't maven including a needed transitive dependency?

I am converting our Jenkins Freestyle build to Declarative Pipeline mode. I am using the same POM files.
But whenever i run the pipeline build, i see that the desired war is missing a transitive dependency. The Freestyle build includes that missing dependency however.
The Main parent POM includes:
<dependencyManagement>
<dependencies>
<dependency>
<groupId>net.sf.dozer</groupId>
<artifactId>dozer</artifactId>
<version>5.5.1</version>
<exclusions>
<exclusion>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
</exclusion>
<exclusion>
<groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
</dependencyManagement>
The second parent includes section below, :
<dependencies>
<dependency>
<groupId>net.sf.dozer</groupId>
<artifactId>dozer</artifactId>
</dependency>
</dependencies>
For both build processes, the dozer artifact is contained in the war file. But dozer contains a dependency of its own:
<dependencies>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.9.1</version>
<exclusions>
<exclusion>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
It is this commons-beanutils that I am missing from my final war when i do the Pipeline build. Since I am using the same POM files for both build processes, how can this be possible?
Please help

Maven dependencies are added automatically to my pom.xml

Is it possible that my pom.xml adds by himself dependencies and exclusions ?
For example : almost this part was been added automatically !!
<dependency>
<groupId>org.opensaml</groupId>
<artifactId>opensaml</artifactId>
<version>2.6.0</version>
<exclusions>
<exclusion>
<groupId>org.apache.xerces</groupId>
<artifactId>xercesImpl</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
<version>2.10.0</version>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-core</artifactId>
<version>1.0.13</version>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>1.0.13</version>
</dependency>
Any idea ? thanks
I think the answer of my question is that IDEA IntelliJ is adding the dependencies to my pom.xml.
Intellij asked me in the past to authorize it to update the dependencies automatically and I've agreed.
So thanks to every one helped me :)
Maven has a feature called 'Transitive Dependencies'. When an application has a dependency that has it's own dependencies, Maven will add those dependencies to your project automatically. You can read more about transitive dependencies on the Maven website here.

Including log4j2 into Maven project: how to get the YamlConfigurationFactory to see its dependencies

I wanted to experiment with using the YAML configuration file with log4j2, but log4j2 cannot load the configuration because the YamlConfigurationFactory cannot find its dependencies from the classpath.
The relevant section of my pom.xml:
<dependencies>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.1</version>
</dependency>
</dependencies>
After that didn't work, I tried adding the <dependencyManagement> section to the pom:
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-bom</artifactId>
<version>2.1</version>
<scope>import</scope>
<type>pom</type>
</dependency>
</dependencies>
</dependencyManagement>
but that didn't help either. Anyone know what's wrong?
Also, if someone can point me to an example of YAML log4j2 config, that would be very much appreciated. (I just thought I would do a "quick" experiment with this, and of course, it became a time sink...)
Including the jackson-dataformat-yaml dependency is not enough. You also need to include jackson-core and jackson-databind.
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>2.4.2</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.4.2</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-yaml</artifactId>
<version>2.4.2</version>
</dependency>
You can see these dependencies are hardcoded in the YAML configuration factory implementation (org.apache.logging.log4j.core.config.yaml.YamlConfigurationFactory)
private static final String[] dependencies = new String[] {
"com.fasterxml.jackson.databind.ObjectMapper",
"com.fasterxml.jackson.databind.JsonNode",
"com.fasterxml.jackson.core.JsonParser",
"com.fasterxml.jackson.dataformat.yaml.YAMLFactory"
};
I'm not really a maven user, but I think the issue here is that the YAML support is an optional feature, so it doesn't get pulled in automatically by specifying the log4j dependency. The Log4j Runtime Dependencies page lists the Jackson YAML data format as the (only) dependency required for YAML configuration support. Quoting the maven dependency snippet from there:
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-yaml</artifactId>
<version>2.4.0</version>
</dependency>

dependency mechanism ( overriding transitive version )

I am trying to explicitly override a transitive dependencies version, but doesn't seem to work.
I have this in my projects pom
<!-- use no-commons-logging -->
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>99.0-does-not-exist</version>
</dependency>
<!-- no-commons-logging-api, if you need it -->
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging-api</artifactId>
<version>99.0-does-not-exist</version>
</dependency>
But, the first one doesn't seem to override the transitive dependencies version. I am not sure why ?
Here is the full POM
http://pastebin.com/TBP0YTZs
Here is the dependency tree
http://pastebin.com/VBdjiVcL
PS:
a) This is what I am trying to do
http://day-to-day-stuff.blogspot.com/2007/10/announcement-version-99-does-not-exist.html
Actually, there is much cleaner method to get rid of commons-logging once and for all:
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1.1</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId>
<version>1.6.1</version>
</dependency>
Based on: http://www.slf4j.org/faq.html#excludingJCL

Resources