Unnecessary dependency on commons-logging

[ikeyat]

Description

Until v5.3.1, terasoluna-gfw-parent imports spring-core through io-platform (a.k.a Spring IO Platform). Actually it's defined in spring-boot-starter-parent that is a parent of io-platform. Since v5.4.1, terasoluna-gfw-parent imports spring-core through spring-framework-bom to satisfy #797.

The change causes an unnecessary dependency on commons-logging on v5.4.1. Therefore, application will include unexpected commons-logging in spite the application never use it. (In TERASOLUNA Framework Development guideline, jcl-over-slf4j and logback are recommended instead of commons-logging) terasoluna-gfw-parent pom should be fixed not to import commons-logging.

• v5.4.1 https://github.com/terasolunaorg/terasoluna-gfw/blob/5.4.1.RELEASE/terasoluna-gfw-parent/pom.xml#L188-L215 http://central.maven.org/maven2/org/springframework/spring-framework-bom/4.3.14.RELEASE/spring-framework-bom-4.3.14.RELEASE.pom

  commons-logging is not excluded.

• v5.3.1 https://github.com/terasolunaorg/terasoluna-gfw/blob/5.3.1.RELEASE/terasoluna-gfw-parent/pom.xml#L187-L193 http://central.maven.org/maven2/io/spring/platform/platform-bom/Athens-SR2/platform-bom-Athens-SR2.pom http://central.maven.org/maven2/org/springframework/boot/spring-boot-starter-parent/1.4.3.RELEASE/spring-boot-starter-parent-1.4.3.RELEASE.pom

  commons-logging is excluded as following. This is described on the Spring IO Reference.

  <dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
      <version>${spring.version}</version>
      <exclusions>
        <exclusion>
          <groupId>commons-logging</groupId>
          <artifactId>commons-logging</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
  </dependencies>
  </dependencyManagement>

Possible Solutions

Candidates

1. excludes commons-logging at terasoluna-gfw-parent pom
2. change the version of platform-io keeping the versions of all the dependent libraries.

Affects Version/s

• 5.4.1.RELEASE

Fix Version/s

• 5.5.1
• 5.4.2

Issue Links

• 797

• https://docs.spring.io/platform/docs/Brussels-SR5/reference/htmlsingle/#getting-started-logging

[ikeyat]

Warning: The impact of this problem may be a separation of log system.

I'm not sure whether commons-logging takes over jcl-over-slf4j or not. If it does, logs of legacy libraries based on commons-logging (such as Spring4, commons) may be written with commons-logging, others may be written with logback through slf4j.

To avoid this certainly, please exclude commons-logging in your application's pom.

[yoshikawaa]

Fixed at #896. terasoluna-gfw 5.4.2 depend on spring-core using platform-bom Brussels-SR17.