Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[PF-2983, PF-2978] Remove logback override now that spring boot is updated. #156

Merged
merged 1 commit into from
Feb 27, 2024
Merged

[PF-2983, PF-2978] Remove logback override now that spring boot is updated. #156

merged 1 commit into from
Feb 27, 2024

Conversation

cahrens
Copy link
Contributor

@cahrens cahrens commented Feb 27, 2024 •
edited
Loading

Followup to #127, now that spring-boot is updated and is using the non-vulnerable version (1.4.14).

Output of ./gradlew dependencyInsight --dependency ch.qos.logback

> Task :dependencyInsight
ch.qos.logback:logback-classic:1.4.14
  Variant compile:
    | Attribute Name                 | Provided | Requested    |
    |--------------------------------|----------|--------------|
    | org.gradle.status              | release  |              |
    | org.gradle.category            | library  | library      |
    | org.gradle.libraryelements     | jar      | classes      |
    | org.gradle.usage               | java-api | java-api     |
    | org.gradle.dependency.bundling |          | external     |
    | org.gradle.jvm.environment     |          | standard-jvm |
    | org.gradle.jvm.version         |          | 17           |
   Selection reasons:
      - By conflict resolution: between versions 1.4.14 and 1.1.3

ch.qos.logback:logback-classic:1.4.14
\--- org.springframework.boot:spring-boot-starter-logging:3.2.3
     \--- org.springframework.boot:spring-boot-starter:3.2.3
          +--- org.springframework.boot:spring-boot-starter-web:3.2.3
          |    \--- compileClasspath
          +--- org.springframework.boot:spring-boot-starter-jdbc:3.2.3
          |    \--- org.springframework.boot:spring-boot-starter-data-jdbc:3.2.3
          |         \--- compileClasspath
          \--- org.springframework.boot:spring-boot-starter-json:3.2.3
               \--- org.springframework.boot:spring-boot-starter-web:3.2.3 (*)

ch.qos.logback:logback-classic:1.1.3 -> 1.4.14
\--- ch.qos.logback.contrib:logback-json-classic:0.1.5
     \--- compileClasspath

ch.qos.logback:logback-core:1.4.14
  Variant compile:
    | Attribute Name                 | Provided | Requested    |
    |--------------------------------|----------|--------------|
    | org.gradle.status              | release  |              |
    | org.gradle.category            | library  | library      |
    | org.gradle.libraryelements     | jar      | classes      |
    | org.gradle.usage               | java-api | java-api     |
    | org.gradle.dependency.bundling |          | external     |
    | org.gradle.jvm.environment     |          | standard-jvm |
    | org.gradle.jvm.version         |          | 17           |
   Selection reasons:
      - By conflict resolution: between versions 1.4.14 and 1.1.3

ch.qos.logback:logback-core:1.4.14
\--- ch.qos.logback:logback-classic:1.4.14
     +--- ch.qos.logback.contrib:logback-json-classic:0.1.5 (requested ch.qos.logback:logback-classic:1.1.3)
     |    \--- compileClasspath
     \--- org.springframework.boot:spring-boot-starter-logging:3.2.3
          \--- org.springframework.boot:spring-boot-starter:3.2.3
               +--- org.springframework.boot:spring-boot-starter-web:3.2.3
               |    \--- compileClasspath
               +--- org.springframework.boot:spring-boot-starter-jdbc:3.2.3
               |    \--- org.springframework.boot:spring-boot-starter-data-jdbc:3.2.3
               |         \--- compileClasspath
               \--- org.springframework.boot:spring-boot-starter-json:3.2.3
                    \--- org.springframework.boot:spring-boot-starter-web:3.2.3 (*)

ch.qos.logback:logback-core:1.1.3 -> 1.4.14
\--- ch.qos.logback.contrib:logback-json-core:0.1.5
     +--- ch.qos.logback.contrib:logback-json-classic:0.1.5
     |    \--- compileClasspath
     \--- ch.qos.logback.contrib:logback-jackson:0.1.5
          \--- compileClasspath

ch.qos.logback.contrib:logback-jackson:0.1.5
  Variant compile:
    | Attribute Name                 | Provided | Requested    |
    |--------------------------------|----------|--------------|
    | org.gradle.status              | release  |              |
    | org.gradle.category            | library  | library      |
    | org.gradle.libraryelements     | jar      | classes      |
    | org.gradle.usage               | java-api | java-api     |
    | org.gradle.dependency.bundling |          | external     |
    | org.gradle.jvm.environment     |          | standard-jvm |
    | org.gradle.jvm.version         |          | 17           |

ch.qos.logback.contrib:logback-jackson:0.1.5
\--- compileClasspath

ch.qos.logback.contrib:logback-json-classic:0.1.5
  Variant compile:
    | Attribute Name                 | Provided | Requested    |
    |--------------------------------|----------|--------------|
    | org.gradle.status              | release  |              |
    | org.gradle.category            | library  | library      |
    | org.gradle.libraryelements     | jar      | classes      |
    | org.gradle.usage               | java-api | java-api     |
    | org.gradle.dependency.bundling |          | external     |
    | org.gradle.jvm.environment     |          | standard-jvm |
    | org.gradle.jvm.version         |          | 17           |

ch.qos.logback.contrib:logback-json-classic:0.1.5
\--- compileClasspath

ch.qos.logback.contrib:logback-json-core:0.1.5
  Variant compile:
    | Attribute Name                 | Provided | Requested    |
    |--------------------------------|----------|--------------|
    | org.gradle.status              | release  |              |
    | org.gradle.category            | library  | library      |
    | org.gradle.libraryelements     | jar      | classes      |
    | org.gradle.usage               | java-api | java-api     |
    | org.gradle.dependency.bundling |          | external     |
    | org.gradle.jvm.environment     |          | standard-jvm |
    | org.gradle.jvm.version         |          | 17           |

ch.qos.logback.contrib:logback-json-core:0.1.5
+--- ch.qos.logback.contrib:logback-jackson:0.1.5
|    \--- compileClasspath
\--- ch.qos.logback.contrib:logback-json-classic:0.1.5
     \--- compileClasspath

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

@cahrens cahrens mentioned this pull request Feb 27, 2024
Closed
@cahrens cahrens changed the title Remove logback override now that spring boot is updated. [PF-2983] Remove logback override now that spring boot is updated. Feb 27, 2024
@cahrens cahrens requested review from rtitle, a team and mmorgantaylor and removed request for a team February 27, 2024 14:10
cahrens
cahrens commented Feb 27, 2024
View reviewed changes
.github/dependabot.yml
@@ -22,5 +22,3 @@ updates:
- "gradle"
commit-message:
prefix: "[PF-2983]"
ignore:
- dependency-name: "org.springframework.boot:spring-boot-gradle-plugin"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This ignore was actually not doing what I hoped, and thus we did update spring-boot… which ended up working.

@cahrens cahrens marked this pull request as ready for review February 27, 2024 14:12
@cahrens cahrens changed the title [PF-2983] Remove logback override now that spring boot is updated. [PF-2983, PF-2978] Remove logback override now that spring boot is updated. Feb 27, 2024
rtitle
rtitle approved these changes Feb 27, 2024
View reviewed changes
Copy link
Contributor

@rtitle rtitle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, nice! LGTM, thanks for doing this.

mmorgantaylor
mmorgantaylor approved these changes Feb 27, 2024
View reviewed changes
Copy link
Contributor

@mmorgantaylor mmorgantaylor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

super, thank you!

@cahrens cahrens merged commit 10318de into develop Feb 27, 2024
2 checks passed
@cahrens cahrens deleted the remove-logback-override branch February 27, 2024 17:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rtitle rtitle rtitle approved these changes

@mmorgantaylor mmorgantaylor mmorgantaylor approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@cahrens @rtitle @mmorgantaylor