Use enforcer for log4j:log4j dependency exclusions

apache · Apr 26, 2024 · 130bc05 · 130bc05
1 parent 6dbebd7
commit 130bc05
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 2 deletions.
diff --git a/pom.xml b/pom.xml
@@ -1617,6 +1617,24 @@
               <fail>true</fail>
             </configuration>
           </execution>
+          <execution>
+            <id>enforce-banned-transitive-dependencies-logging</id>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <bannedDependencies>
+                  <excludes>
+                    <exclude>log4j:log4j</exclude>
+                  </excludes>
+                  <searchTransitive>true</searchTransitive>
+                  <message>A banned transitive logging dependency was found!</message>
+                </bannedDependencies>
+              </rules>
+              <fail>true</fail>
+            </configuration>
+          </execution>
           <execution>
             <id>check-banned-imports</id>
             <phase>initialize</phase>

diff --git a/standalone-metastore/metastore-server/pom.xml b/standalone-metastore/metastore-server/pom.xml
@@ -720,12 +720,12 @@
         <groupId>org.datanucleus</groupId>
         <artifactId>datanucleus-maven-plugin</artifactId>
         <version>5.2.1</version>
-        <!-- The plexus-contianer-default can be removed once we move to datanucleus-maven-plugin version 6.0.0-release-->
+        <!-- The plexus-contianer-default can be removed once we move to datanucleus-maven-plugin version >= 6.0.0-release-->
         <dependencies>
           <dependency>
             <groupId>org.codehaus.plexus</groupId>
             <artifactId>plexus-container-default</artifactId>
-            <version>1.5.6</version>
+            <version>${plexus.version}</version>
           </dependency>
         </dependencies>
         <configuration>

diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
@@ -91,6 +91,8 @@
     <mockito-core.version>3.4.4</mockito-core.version>
     <orc.version>1.8.5</orc.version>
     <protobuf.version>3.24.4</protobuf.version>
+    <!-- TODO: Remove plexus property from this pom.xml once we upgrade datanucleus-maven-plugin version >= 6.0.0-release-->
+    <plexus.version>1.5.6</plexus.version>
     <io.grpc.version>1.51.0</io.grpc.version>
     <sqlline.version>1.9.0</sqlline.version>
     <jline.version>2.14.6</jline.version>