Hi, there are multiple versions of log4j:log4j in ussdgateway-master/core/domain. As shown in the following dependency tree, according to Maven "nearest wins" strategy, only log4j:log4j:1.2.12 can be loaded, log4j:log4j:1.2.8 and log4j:log4j:1.2.14 will be shadowed.
However, several methods defined in shadowed version log4j:log4j:1.2.14 are referenced by client project via log4j:log4j:1.2.12.
For instance, the following missing method(defined in log4j:log4j:1.2.14) are actually referenced by ussdgateway-master/core/domain, which will introduce a runtime error(i.e., "NoSuchMethodError") into ussdgateway-master/core/domain.
<org.apache.log4j.Category: void error(java.lang.Object,java.lang.Throwable)> is invoked by ussdgateway via the following path:
Upgrade direct dependency log4j:log4j from 1.2.12 to 1.2.14. Because version 1.2.14 includes the above missing methods and is compatible with other versions of log4j:log4j in the project.
Please let me know if you agree to this solution? I can submit a PR to fix it.
Thank you very much for your attention.
Best regards,
Dependency tree --
[INFO] | | | +- (org.jboss.logging:jboss-logging-spi:jar:2.1.0.GA:compile - version managed from 2.0.5.GA; omitted for duplicate)
[INFO] | | | +- (org.jboss.logging:jboss-logging-log4j:jar:2.1.0.GA:compile - version managed from 2.0.5.GA; omitted for duplicate)
[INFO] | | | +- (org.jboss:jboss-common-core:jar:2.2.14.GA:compile - version managed from 2.2.7.GA; omitted for duplicate)
[INFO] | | | +- jboss.profiler.jvmti:jboss-profiler-jvmti:jar:1.0.0.CR5:compile
[INFO] | | | +- (junit:junit:jar:4.1:compile - version managed from 3.8.2; omitted for duplicate)
[INFO] | | | +- (log4j:log4j:jar:1.2.14:compile - version managed from 1.2.8; omitted for conflict with 1.2.12)
[INFO] | | | \- org.jboss.jbossas:jboss-server-manager:jar:1.0.2.GA:compile
[INFO] | | | +- org.jboss.naming:jnp-client:jar:5.0.3.GA:compile (version managed from 5.0.1.GA)
[INFO] | | | | +- (org.jboss:jboss-common-core:jar:2.2.14.GA:compile - version managed from 2.2.10.GA; omitted for duplicate)
[INFO] | | | | \- (org.jboss.logging:jboss-logging-spi:jar:2.1.0.GA:compile - version managed from 2.0.5.GA; omitted for duplicate)
[INFO] | | | +- org.jboss.security:jbosssx-client:jar:2.0.3.SP1:compile
Issue Description:
Hi, there are multiple versions of log4j:log4j in ussdgateway-master/core/domain. As shown in the following dependency tree, according to Maven "nearest wins" strategy, only log4j:log4j:1.2.12 can be loaded, log4j:log4j:1.2.8 and log4j:log4j:1.2.14 will be shadowed.
However, several methods defined in shadowed version log4j:log4j:1.2.14 are referenced by client project via log4j:log4j:1.2.12.
For instance, the following missing method(defined in log4j:log4j:1.2.14) are actually referenced by ussdgateway-master/core/domain, which will introduce a runtime error(i.e., "NoSuchMethodError") into ussdgateway-master/core/domain.
<org.apache.log4j.Category: void error(java.lang.Object,java.lang.Throwable)> is invoked by ussdgateway via the following path:
<org.apache.log4j.Category: void warn(java.lang.Object)> is invoked by ussdgateway via the following path:
Suggested fixing solutions:
Please let me know if you agree to this solution? I can submit a PR to fix it.
Thank you very much for your attention. Best regards,
Dependency tree --