Re:Log4j 2.15.0 – Previously suggested mitigations may not b...
by ishjoh on Thursday December 16, 2021 @05:54PM
(#29585127)
Shaded dependencies are a nightmare, and it's a particular bone I have to pick with using Elastic products that they think this practice is ok.
I prefer to package all my projects into a single fat jar, since it makes distribution so easy and clean, but if I was creating jar files with the expectation that other projects would use them I would make sure to package everything separately.
In this case using fat jars made things really easy to check for the effected classes and luckily for me I also didn't have any log4j-core classes in my fat jars.
I prefer to package all my projects into a single fat jar, since it makes distribution so easy and clean, but if I was creating jar files with the expectation that other projects would use them I would make sure to package everything separately.
In this case using fat jars made things really easy to check for the effected classes and luckily for me I also didn't have any log4j-core classes in my fat jars.