Repository navigation
Remove runtime dependency on log4j-core - #2343
Merged
Merged
Conversation
Read and write `Log4j2Plugins.dat` files directly in `Log4j2PluginsCacheFileTransformer` instead of using Log4j's `PluginCache`, so Shadow no longer pulls `log4j-core` and its CVEs into users' build classpaths. The output stays byte-for-byte identical, which is verified against `PluginCache` in tests. Closes #2060.
Goooler
commented
Oct 25, 2026
Co-authored-by: Zongle Wang <wangzongler@gmail.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
Static review found no blocking issues in the focused replacement, and the added tests check compatibility with Log4j; tests were not run.
No open issues 🎉
What changed in this PR
Removes Shadow’s runtime dependency on log4j-core, addressing #2060 while retaining Log4j plugin-cache merging and class relocation.
Changes:
- Reads and writes
Log4j2Plugins.datdirectly, replacing Log4j’sPluginCacheand temporary files. - Keeps Log4j as a test-only dependency and adds byte-for-byte compatibility checks.
- Updates functional-test imports and documents the dependency removal.
| File | Description |
|---|---|
| src/test/kotlin/com/github/jengelman/gradle/plugins/shadow/transformers/Log4j2PluginsCacheFileTransformerTest.kt | Adds format compatibility checks and adapts relocation tests. |
| src/main/kotlin/com/github/jengelman/gradle/plugins/shadow/transformers/Log4j2PluginsCacheFileTransformer.kt | Implements direct cache parsing, merging, and serialization. |
| src/functionalTest/kotlin/com/github/jengelman/gradle/plugins/shadow/transformers/TransformersTest.kt | Uses Shadow’s cache-path constant. |
| CHANGELOG.md | Records the runtime dependency removal. |
| build.gradle.kts | Moves Log4j from runtime to unit-test dependencies. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Read and write
Log4j2Plugins.datfiles directly inLog4j2PluginsCacheFileTransformerinstead of using Log4j'sPluginCache, so Shadow no longer pullslog4j-coreand its CVEs into users' build classpaths. The output stays byte-for-byte identical, which is verified againstPluginCachein tests.Closes #2060.