Exclude jcl-over-slf4j in favor of Spring Framework's spring-jcl

[wilkinsona]

To avoid having two different variants of the org.apache.commons.logging classes on the classpath, jcl-over-slf4j should be excluded as a transitive dependency. It's present at the moment as it's a transitive dependency of com.datastax.oss:java-driver-core.

[mp911de]

Thanks for bringing this up. We have also other places like MongoDB and JPA that use mixed logging strategies and we need to clean up all of these to use Spring's JCL.

[mp911de]

Care to help me understand which dependency you want to exclude? According to mvn dependency:tree, there's no jcl-over-slf4j:

[INFO] org.example:untitled:jar:1.0-SNAPSHOT
[INFO] \- org.springframework.data:spring-data-cassandra:jar:3.3.0:compile
[INFO]    +- org.springframework:spring-context:jar:5.3.13:compile
[INFO]    |  \- org.springframework:spring-aop:jar:5.3.13:compile
[INFO]    +- org.springframework:spring-beans:jar:5.3.13:compile
[INFO]    +- org.springframework:spring-core:jar:5.3.13:compile
[INFO]    |  \- org.springframework:spring-jcl:jar:5.3.13:compile
[INFO]    +- org.springframework:spring-tx:jar:5.3.13:compile
[INFO]    +- org.springframework:spring-expression:jar:5.3.13:compile
[INFO]    +- org.springframework.data:spring-data-commons:jar:2.6.0:compile
[INFO]    +- com.datastax.oss:java-driver-core:jar:4.13.0:compile
[INFO]    |  +- com.datastax.oss:native-protocol:jar:1.5.0:compile
[INFO]    |  +- io.netty:netty-handler:jar:4.1.60.Final:compile
[INFO]    |  |  +- io.netty:netty-common:jar:4.1.60.Final:compile
[INFO]    |  |  +- io.netty:netty-resolver:jar:4.1.60.Final:compile
[INFO]    |  |  +- io.netty:netty-buffer:jar:4.1.60.Final:compile
[INFO]    |  |  +- io.netty:netty-transport:jar:4.1.60.Final:compile
[INFO]    |  |  \- io.netty:netty-codec:jar:4.1.60.Final:compile
[INFO]    |  +- com.datastax.oss:java-driver-shaded-guava:jar:25.1-jre-graal-sub-1:compile
[INFO]    |  +- com.typesafe:config:jar:1.4.1:compile
[INFO]    |  +- com.github.jnr:jnr-posix:jar:3.1.5:compile
[INFO]    |  |  +- com.github.jnr:jnr-ffi:jar:2.2.2:compile
[INFO]    |  |  |  +- com.github.jnr:jffi:jar:1.3.1:compile
[INFO]    |  |  |  +- com.github.jnr:jffi:jar:native:1.3.1:runtime
[INFO]    |  |  |  +- org.ow2.asm:asm:jar:9.1:compile
[INFO]    |  |  |  +- org.ow2.asm:asm-commons:jar:9.1:compile
[INFO]    |  |  |  +- org.ow2.asm:asm-analysis:jar:9.1:compile
[INFO]    |  |  |  +- org.ow2.asm:asm-tree:jar:9.1:compile
[INFO]    |  |  |  +- org.ow2.asm:asm-util:jar:9.1:compile
[INFO]    |  |  |  +- com.github.jnr:jnr-a64asm:jar:1.0.0:compile
[INFO]    |  |  |  \- com.github.jnr:jnr-x86asm:jar:1.0.2:compile
[INFO]    |  |  \- com.github.jnr:jnr-constants:jar:0.10.1:compile
[INFO]    |  +- io.dropwizard.metrics:metrics-core:jar:4.1.18:compile
[INFO]    |  +- org.hdrhistogram:HdrHistogram:jar:2.1.12:compile
[INFO]    |  +- com.esri.geometry:esri-geometry-api:jar:1.2.1:compile
[INFO]    |  |  +- org.json:json:jar:20090211:compile
[INFO]    |  |  \- org.codehaus.jackson:jackson-core-asl:jar:1.9.12:compile
[INFO]    |  +- com.fasterxml.jackson.core:jackson-core:jar:2.12.2:compile
[INFO]    |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.12.2:compile
[INFO]    |  |  \- com.fasterxml.jackson.core:jackson-annotations:jar:2.12.2:compile
[INFO]    |  +- org.reactivestreams:reactive-streams:jar:1.0.3:compile
[INFO]    |  +- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile
[INFO]    |  \- com.github.spotbugs:spotbugs-annotations:jar:3.1.12:compile
[INFO]    |     \- com.google.code.findbugs:jsr305:jar:3.0.2:compile
[INFO]    +- com.datastax.oss:java-driver-query-builder:jar:4.13.0:compile
[INFO]    \- org.slf4j:slf4j-api:jar:1.7.32:compile

    <dependencies>
        <dependency>
            <groupId>org.springframework.data</groupId>
            <artifactId>spring-data-cassandra</artifactId>
            <version>3.3.0</version>
        </dependency>
    </dependencies>

[wilkinsona]

Sorry for the lack of details. I noticed the problem when working on Spring Boot 2.4.x and it would appear that it is specific to Spring Data Cassandra 3.1.x:

plugins {
    id 'java'
}

repositories {
    mavenCentral()
}

dependencies {
    implementation 'org.springframework.data:spring-data-cassandra:3.1.15'
}

$ gradle dependencyInsight --dependency jcl-over-slf4j

> Task :dependencyInsight
org.slf4j:jcl-over-slf4j:1.7.25
   variant "compile" [
      org.gradle.status              = release (not requested)
      org.gradle.usage               = java-api
      org.gradle.libraryelements     = jar (compatible with: classes)
      org.gradle.category            = library

      Requested attributes not found in the selected variant:
         org.gradle.dependency.bundling = external
         org.gradle.jvm.environment     = standard-jvm
         org.gradle.jvm.version         = 8
   ]

org.slf4j:jcl-over-slf4j:1.7.25
\--- org.apache.tinkerpop:gremlin-core:3.4.8
     +--- com.datastax.oss:java-driver-core:4.9.0
     |    +--- org.springframework.data:spring-data-cassandra:3.1.15
     |    |    \--- compileClasspath
     |    \--- com.datastax.oss:java-driver-query-builder:4.9.0
     |         \--- org.springframework.data:spring-data-cassandra:3.1.15 (*)
     \--- org.apache.tinkerpop:tinkergraph-gremlin:3.4.8
          \--- com.datastax.oss:java-driver-core:4.9.0 (*)

(*) - dependencies omitted (listed previously)

A web-based, searchable dependency report is available by adding the --scan option.

BUILD SUCCESSFUL in 517ms
1 actionable task: 1 executed

[mp911de]

Thanks a lot. gremlin-core was made optional in java-driver-core:4.10.0 and that is why newer Cassandra drivers do not pull in jcl-over-slf4j. The 3.1.x development line has now reached OSS EOL. Unless there's a strong indication for another 3.1.x release, I'd keep things as-is for now.

[wilkinsona]

I'm surprised that 3.1.x has reached OSS EOL already. It's part of Spring Boot 2.4.x which is supported until August 2022.

[wilkinsona]

@snicoll's just pointed out that I've mixed up my OSS support and full EOL dates. Boot 2.4.x will reach the end of its OSS support period when we release 2.6.0 later this week. We're all good here.

[mp911de]

This is out of support so closing the ticket.