scala build: upgrade to log4j 2.17.0

scalableminds / webknossos-wrap

Efficient 3D volume storage format for webKnossos and analyses

MIT License

8 stars 3 forks source link

scala build: upgrade to log4j 2.17.0 #72

Closed jstriebel closed 2 years ago

jstriebel commented 2 years ago

We should bump log4j to the newest version to guard against further vulnerabilities. Not sure how scala/version.sbt should be bumped and I don't have anything installed for the release process. Do you, @normanrz?

fm3 commented 2 years ago

For compiling and releasing you need sbt and sbt-pgp – the readme at https://github.com/scalableminds/webknossos-wrap/tree/master/scala lists the process. Sonatype credentials should be available in slack.
Could you attempt to remove log4j from the dependencies altogether, does it still compile? I think the wkw scala library does not actually log anything.
If you don’t have the resources to do this release, please ping me again, I can probably do it this evening or tomorrow.

jstriebel commented 2 years ago

If you don’t have the resources to do this release, please ping me again, I can probably do it this evening or tomorrow.

I don't have anything set up for this. If this is a matter of a couple of minutes for you, it'd be great if you could do the release for now @fm3 :pray:

PS: @normanrz I guess we should automate this in the CI at some point.

fm3 commented 2 years ago

superseded by #74