Alexis Sarda-Espinosa created FLINK-29716:
---------------------------------------------
Summary: Separate slf4j jar in the lib folder from the distribution
Key: FLINK-29716
URL: https://issues.apache.org/jira/browse/FLINK-29716
Project: Flink
Issue Type: Improvement
Affects Versions: 1.15.2
Reporter: Alexis Sarda-Espinosa
Flink's binary distribution includes several jars under the {{lib}} folder,
which has individual jars for all log4j artifacts. This makes it relatively
easy to swap out those logging jars when necessary, for example when critical
vulnerabilities are found (as was recently the case).
With SLF4J 2.+, some breaking changes mean that many implementations are not
directly backwards compatible, see for example the [notes for
log4j2|https://logging.apache.org/log4j/2.x/log4j-slf4j-impl/index.html]. This
means that, in the future, if swapping logging jars were necessary, the SLF4J
jar might have to be changed as well.
Right now the SLF4J jar is not included separately in the distribution, I
believe it's packed inside the {{flink-dist}} jar, although I'm not sure. It
would be better to separate that as it is done for the default log4j2 jars.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
