-
Notifications
You must be signed in to change notification settings - Fork 1.4k
SLF4J 2.0.0 requires logback 1.3.0 #4846
Description
Describe the bug
SLF4J 2.0.0 requires logback 1.3.0+
Running 7.2.0 version of ODC gives the following warnings:
WARNING: SLF4J: No SLF4J providers were found.
WARNING: SLF4J: Defaulting to no-operation (NOP) logger implementation
WARNING: SLF4J: See http://www.slf4j.org/codes.html#noProviders for further details.
WARNING: SLF4J: Class path contains SLF4J bindings targeting slf4j-api versions prior to 1.8.
WARNING: SLF4J: Ignoring binding found at [jar:file:/D:/Program%20Files/dependency-check/lib/logback-classic-1.2.11.jar!/org/slf4j/impl/StaticLoggerBinder.class]
WARNING: SLF4J: See http://www.slf4j.org/codes.html#ignoredBindings for an explanation.
And then fails to provide normal logged data besides the warnings above.
Version of dependency-check used
The problem occurs using version 7.2.0 of the cli
Log file
Warning output provided above.
To Reproduce
dependency-check.bat" --format JSON --prettyPrint --enableExperimental --out C:****\dc-output-20220914093309.json" --yarn "D:\Program Files\Yarn\bin\yarn.cmd" --scan ****
Expected behavior
A clear and concise description of what you expected to happen.
Additional context
I downloaded logback-core-1.3.0.jar and logback-classic-1.3.0.jar and replaced the 1.2.11 versions with the updated versions and logging worked as it did in previous versions of ODC.