Re: Decoupling Turbine from log4j-core - Turbine.configureLogging forces log4j2-core onto classpath

Hi Georg,

It turns out that the actual code dependency on log4j is in version 5.1. =
(version 5.1 is an intermediate step in our migration, allowing us to =
separate major Turbine changes from other changes required by migrating =
to jakarta EE namespace.) This was solved by version 7.0 so log4j is =
truely optional. The only issue with 7.0 is that these dependencies =
aren't marked as optional. User's can always exclude these in their own =
poms however, there is still value in doing this in Turbine itself.=20

1. Default posture. <optional>true</optional> upstream flips the default =
so every consumer gets a Turbine that doesn't drag in log4j-core unless =
they opt in. An exclusion requires each consumer to know log4j-core is =
there, know it's swappable, and remember to exclude it =E2=80=94 plus =
the 3=E2=80=934 companion artifacts (log4j-jpl, log4j-slf4j2-impl, =
log4j-jakarta-web). Most won't.
2. Transitive fan-out. Exclusions are per-declaration. Anything that =
pulls Turbine transitively (a plugin, a BOM, another dependency) =
re-introduces log4j-core, and you have to hunt down each path. =
<optional> stops the propagation at the source.
3. Security surface. log4j-core is the Log4Shell artifact. Making it =
non-default shrinks the attack surface for the whole ecosystem, not just =
builds that thought to exclude it.
4. Correct expression of intent. The pom change documents that 7.0 no =
longer needs log4j-core =E2=80=94 an exclusion is a workaround that says =
nothing about upstream intent.

I can still submit a PR, but it is actually just adding 4 <optional> =
tags

    <dependency>
      <groupId>org.apache.logging.log4j</groupId>
      <artifactId>log4j-core</artifactId>
      <version>${turbine.log4j2.version}</version>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.apache.logging.log4j</groupId>
      <artifactId>log4j-jpl</artifactId>
      <version>${turbine.log4j2.version}</version>
      <scope>runtime</scope>
      <optional>true</optional>
    </dependency>

    <dependency>
      <groupId>org.apache.logging.log4j</groupId>
      <artifactId>log4j-jakarta-web</artifactId>
      <version>${turbine.log4j2.version}</version>
      <scope>runtime</scope>
      <optional>true</optional>
    </dependency>

    <dependency>
      <artifactId>log4j-slf4j2-impl</artifactId>
      <version>${turbine.log4j2.version}</version>
      <scope>runtime</scope>
      <optional>true</optional>
    </dependency>

Thanks,

Dave