Skip to content

SLF4J 2.0.0 requires logback 1.3.0 #4846

@mcondellva

Description

@mcondellva

Describe the bug
SLF4J 2.0.0 requires logback 1.3.0+

Running 7.2.0 version of ODC gives the following warnings:

WARNING: SLF4J: No SLF4J providers were found.
WARNING: SLF4J: Defaulting to no-operation (NOP) logger implementation
WARNING: SLF4J: See http://www.slf4j.org/codes.html#noProviders for further details.
WARNING: SLF4J: Class path contains SLF4J bindings targeting slf4j-api versions prior to 1.8.
WARNING: SLF4J: Ignoring binding found at [jar:file:/D:/Program%20Files/dependency-check/lib/logback-classic-1.2.11.jar!/org/slf4j/impl/StaticLoggerBinder.class]
WARNING: SLF4J: See http://www.slf4j.org/codes.html#ignoredBindings for an explanation.

And then fails to provide normal logged data besides the warnings above.

Version of dependency-check used
The problem occurs using version 7.2.0 of the cli

Log file
Warning output provided above.

To Reproduce
dependency-check.bat" --format JSON --prettyPrint --enableExperimental --out C:****\dc-output-20220914093309.json" --yarn "D:\Program Files\Yarn\bin\yarn.cmd" --scan ****

Expected behavior
A clear and concise description of what you expected to happen.

Additional context
I downloaded logback-core-1.3.0.jar and logback-classic-1.3.0.jar and replaced the 1.2.11 versions with the updated versions and logging worked as it did in previous versions of ODC.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions