vy commented on PR #4144: URL: https://github.com/apache/logging-log4j2/pull/4144#issuecomment-4678928850
> The hand-rolled JAXP hardening code is replaced with the [eu.copernik:copernik-xml-factory](https://github.com/copernik-eu/copernik-xml-factory) library @rgoers, @garydgregory, do you agree with adding this external dependency to `log4j-core`? As [we discussed this earlier](https://the-asf.slack.com/archives/C4TQW0M5L/p1780330235889469), I'm -0 on this change, because: - We will effective be replacing 10 LoC (which is working and bug-free) in `log4j-core` with an external dependency. - This doesn't really bring any compelling benefit either to users, or to maintainers. - Adding a new dependency for a feature that is used by a majority of the user base (i.e., XML-based configuration) can break fat-JAR setups. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
