Remove log4J due to the security vulnerability disclosed on 10 December 2021.
The Apache Commons logging project appears to be dead. It has open change requests going back to 2005, hasn't been updated for several years, and is a whole version behind Log4J. None of these external logging packages has had much point @since Java 1.4's java.util.logging, whatever its deficiencies. So remove these dependencies and just use java.util.logging. For simplicity this can best be done behind the existing LogFactory framework, but the other log providers behind this interface can cease to be supported and be removed.
--- old+++ new@@ -1,3 +1,4 @@-1. The Apache Commons logging project appears to be dead. It has open change requests going back to 2005, hasn't been updated for several years, and is a whole version behind Log4J. None of these external logging packages has had much point @since Java 1.4's java.util.logging, whatever its deficiencies. So remove these dependencies and just use java.util.logging. For simplicity this can best be done behind the existing LogFactory framework, but the other log providers behind this interface can cease to be supported.--2. Add formatted logging methods.+1. Remove log4J due to the security vulnerability disclosed on 10 December 2021.+2. The Apache Commons logging project appears to be dead. It has open change requests going back to 2005, hasn't been updated for several years, and is a whole version behind Log4J. None of these external logging packages has had much point @since Java 1.4's java.util.logging, whatever its deficiencies. So remove these dependencies and just use java.util.logging. For simplicity this can best be done behind the existing LogFactory framework, but the other log providers behind this interface can cease to be supported and be removed.+3. As a result, support Java Logging only.+4. Add formatted logging methods.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Diff: