Re: [turbine-parent] 02/02: Update parent for release, set dependency scan for profile apache-release only

Hi Georg,

> Am 15.12.2021 um 09:05 schrieb Georg Kallidis <[email protected]>:
> 
> The fast fix for everyone is just to replace the log4j libs, we are in 
> each module at version above 2.14 (> 2.12, which is Java 7 and has a 
> separate fix), that means it the new ones are binary compatible IMO.
Actually, Fulcrum components are Avalon components which have their own log framework. I already tried to fix this a couple of times but the alternative log frameworks keep sneaking in. In a perfect world, Avalon components should not have a dependency on any logging framework implementation at all.

> Might be there are better ideas or suggestions or I am missing some 
> important information? 
dependencyManagement in Turbine Parent POM?

Bye, Thomas