Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade to latest johnrengelman.shadow dependency to avoid vulnerable log4j version #93

Open
henbox opened this issue Sep 8, 2022 · 0 comments

Comments

@henbox
Copy link
Contributor

henbox commented Sep 8, 2022

Example step gradle builds currently use 'com.github.johnrengelman.shadow' version '5.2.0', which will cause dependency log4j-core and log4j-api 2.11 to be downloaded to the build machine.

Upgrade to 7.1.2 so that log4j 2.17.1 is used instead: https://github.com/johnrengelman/shadow/releases

For this change we'll also need to upgrade to Gradle v7. In gradle-wrapper.properties:
distributionUrl=https://services.gradle.org/distributions/gradle-7.5.1-bin.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant