Re: [wildfly-dev] wildfly and transitive dependency to log4j-v1, possibly via apache cxf

Hi Andrew, From reading your email I would think you should be looking at https://github.com/wildfly/wildfly rather than Brian's fork? Regarding the question, my guess (just based on the proximity of this dependency) is it comes from https://github.com/jbossws/jbossws-cxf/blob/jbossws-cxf-5.3.0.Final/pom.x... (but it might just be a coincidence that is the same version).

I think to enforce a version of log4j it would be added under https://github.com/wildfly/wildfly/blob/master/pom.xml#L422? Thanks, Tom On Sun, 1 Dec 2019 at 10:03, Andrew Marlow <marlow.agents(a)gmail.com <mailto:marlow.agents@gmail.com>> wrote: Hello everyone, I am trying to build the latest wildfly from a clone of the github repo at https://github.com/bstansberry/wildfly.git. I understand this is the latest and is from the principal maintainer, Brian Stansberry. I've changed the pom references to the old log4j-v1 to the new log4j-v2 but a pom dependency analysis reveals there is a still a dependency on v1. I am at a loss as to where exactly it is coming from. I hope someone here can shed some light please. The relevant part of the dependency tree is shown from the extract below: INFO [m] org.wildfly:wildfly-ts-integ-smoke:jar:19.0.0.Beta1-SNAPSHOT INFO [m] +- org.jboss.ws.cxf:jbossws-cxf-client:jar:5.3.0.Final:test    : INFO [m] |  +- log4j:log4j:jar:1.2.17:test Initially I thought it might be coming via an old version of apache CXF but I see from the top level pom that version 3.3.4 is being used, which is the latest. Any ideas? -- Regards, Andrew Marlow http://www.andrewpetermarlow.co.uk _______________________________________________ wildfly-dev mailing list wildfly-dev(a)lists.jboss.org <mailto:wildfly-dev@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/wildfly-dev