Is it a standard practice to explicitly exclude dependencies?

user_777085 0
Viewed 501

for example, in my pom.xml

    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-api</artifactId>
        <version>2.15.0</version>
    </dependency>
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core</artifactId>
        <version>2.15.0</version>
    </dependency>

for some reasons, the dependencies graph is like:

enter image description here

So, there is a conflicting log4j-api (2.7 vs 2.15).

To fix this, I can explicitly exclude log4j-api in the log4j-core dependency. However, is this actually a standard practice since the log4j-api 2.15.0 will always be used anyway due to dependency management.

log4j2 spring-boot maven java
1 Answers

So first if a app is using log4j-api in version 2.7 this has even not being upgrade for 5 years apart from that I suppose that the api has not being changed (which the api part implies) so you should or could only replace the implementation (log4j-core) and use the more recent version. You can exclude dependencies via the exclusions like this.

<project>
  ...
  <dependencies>
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core</artifactId>
      <version>2.15.0</version>
      <exclusions>
        <exclusion>
          <groupId>org.apache.logging.log4j</groupId>
          <artifactId>log4j-api</artifactId>
        </exclusion>
      </exclusions> 
    </dependency>
  </dependencies>
</project>

This can also being done in dependencyManagement which is even better...In such I would not exclude the api here...

user_2963280
Related