get rid of log4j 1.2.12 from cache

Question

I have a requirement to get rid of log4j v1.2.12 due to the vulnerabilities. My app is spring boot 2, i have in my gradle:

configurations.all {
exclude group: 'log4j', module: 'log4j'

} I wipe out my cache, run a build on my project and this lib shows up again:

.gradle/caches/modules-2/files-2.1/log4j/log4j/1.2.12

when i run

gradle -q dependencyInsight --configuration compile --dependency log4j

It doesn't show me use of that version of log4j. Same with the whole dependency tree on a project, no where this version of log4j shows up. What is going on here? How do i get rid of it?

What's the way to see how gradle builds my local cache?

user_5845802 · Answer

Gradle cache is not reflective your project alone. It may be from any other project that you build or some other transitive dependency. For your project - you can additionally generate htmlDependencyReport and check from

plugins {
    id 'project-report'
}

see https://docs.gradle.org/current/userguide/project_report_plugin.html

plugins {
    id 'project-report'
}

see https://docs.gradle.org/current/userguide/project_report_plugin.html

get rid of log4j 1.2.12 from cache

1 Answers