Re: Decoupling Turbine from log4j-core - Turbine.configureLogging forces log4j2-core onto classpath

Hi David,

I pushed the change to the trunk, check it out, as for the points you mention=
ed and it is very consistent with our recent decoupling of logging.=20

Hopefully it helps migrating Turbine in your context!

Best regards, Georg

On 2026/07/06 15:18:21 David Maffitt wrote:
> Hi Georg,
>=20
> It turns out that the actual code dependency on log4j is in version 5.1. (v=
ersion 5.1 is an intermediate step in our migration, allowing us to separate =
major Turbine changes from other changes required by migrating to jakarta EE =
namespace.) This was solved by version 7.0 so log4j is truely optional. The o=
nly issue with 7.0 is that these dependencies aren't marked as optional. User=
's can always exclude these in their own poms however, there is still value i=
n doing this in Turbine itself.=20
>=20
> 1. Default posture. <optional>true</optional> upstream flips the default so=
 every consumer gets a Turbine that doesn't drag in log4j-core unless they op=
t in. An exclusion requires each consumer to know log4j-core is there, know i=
t's swappable, and remember to exclude it =E2=80=94 plus the 3=E2=80=934 comp=
anion artifacts (log4j-jpl, log4j-slf4j2-impl, log4j-jakarta-web). Most won't.
> 2. Transitive fan-out. Exclusions are per-declaration. Anything that pulls =
Turbine transitively (a plugin, a BOM, another dependency) re-introduces log4=
j-core, and you have to hunt down each path. <optional> stops the propagation=
 at the source.
> 3. Security surface. log4j-core is the Log4Shell artifact. Making it non-de=
fault shrinks the attack surface for the whole ecosystem, not just builds tha=
t thought to exclude it.
> 4. Correct expression of intent. The pom change documents that 7.0 no longe=
r needs log4j-core =E2=80=94 an exclusion is a workaround that says nothing a=
bout upstream intent.
>=20
> I can still submit a PR, but it is actually just adding 4 <optional> tags
>=20
>     <dependency>
>       <groupId>org.apache.logging.log4j</groupId>
>       <artifactId>log4j-core</artifactId>
>       <version>${turbine.log4j2.version}</version>
>       <optional>true</optional>
>     </dependency>
>     <dependency>
>       <groupId>org.apache.logging.log4j</groupId>
>       <artifactId>log4j-jpl</artifactId>
>       <version>${turbine.log4j2.version}</version>
>       <scope>runtime</scope>
>       <optional>true</optional>
>     </dependency>
>=20
>     <dependency>
>       <groupId>org.apache.logging.log4j</groupId>
>       <artifactId>log4j-jakarta-web</artifactId>
>       <version>${turbine.log4j2.version}</version>
>       <scope>runtime</scope>
>       <optional>true</optional>
>     </dependency>
>=20
>     <dependency>
>       <artifactId>log4j-slf4j2-impl</artifactId>
>       <version>${turbine.log4j2.version}</version>
>       <scope>runtime</scope>
>       <optional>true</optional>
>     </dependency>
>=20
> Thanks,
>=20
> Dave
>=20
>=20
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>=20
>=20