不应用 Gradle 依赖约束

Question

我的 Gradle 配置中有以下内容：

dependencies {    
    implementation "org.slf4j:slf4j-api:1.7.32"
    implementation "org.apache.logging.log4j:log4j-slf4j-impl:2.15.0"
    implementation "org.slf4j:jul-to-slf4j:1.7.32"
    implementation "org.slf4j:jcl-over-slf4j:1.7.32"

    constraints {
        add("implementation", "org.apache.logging.log4j:log4j-core") {
            version {
                strictly("[2.15")
                prefer("2.15.0")
            }
            because("CVE-2021-44228 Log4j 2 Vulnerability")
        }
        add("implementation", "org.apache.logging.log4j:log4j-api") {
            version {
                strictly("[2.15")
                prefer("2.15.0")
            }
            because("CVE-2021-44228 Log4j 2 Vulnerability")
        }
    }
}

虽然此配置不直接依赖于 log4j，但它对 log4j 有一些暂时依赖。我预计它将强制使用 2.15.0 或更高版本。

但不幸的是它并没有改变任何东西：

$ gradle dependencies | grep log4j
+--- org.apache.logging.log4j:log4j-slf4j-impl:2.15.0
|    \--- org.apache.logging.log4j:log4j-api:2.15.0 -> 2.13.3
.....
+--- org.apache.logging.log4j:log4j-api:{strictly [2.15; prefer 2.15.0} -> 2.13.3 (c)
\--- org.apache.logging.log4j:log4j-core:{strictly [2.15; prefer 2.15.0} -> 2.13.3 (c)

和

$ gradle dependencyInsight --dependency org.apache.logging.log4j

> Task :dependencyInsight 
org.apache.logging.log4j:log4j-api:2.13.3
variant "compile" [
  org.gradle.status                  = release (not requested)
  org.gradle.usage                   = java-api
  org.gradle.libraryelements         = jar (compatible with: classes+resources)
  org.gradle.category                = library

  Requested attributes not found in the selected variant:
     org.gradle.dependency.bundling     = external
     org.gradle.jvm.environment         = standard-jvm
     org.jetbrains.kotlin.platform.type = jvm
     org.gradle.jvm.version             = 13
]
Selection reasons:
  - Selected by rule
  - By constraint : CVE-2021-44228 Log4j 2 Vulnerability

org.apache.logging.log4j:log4j-api:{strictly [2.15; prefer 2.15.0} -> 2.13.3
\--- compileClasspath

org.apache.logging.log4j:log4j-api:2.15.0 -> 2.13.3
\--- org.apache.logging.log4j:log4j-slf4j-impl:2.15.0
     \--- compileClasspath 

为什么降级到2.13.3版本？尽管它被设置为 2.15，log4j-slf4j-impl并且也是受约束所要求的。

Gradle 6.9 和 7.2 的结果相同

--

更新：

为了简单起见，我将约束更改为：

    add("implementation", "org.apache.logging.log4j:log4j-core:2.15.0") {
        because("CVE-2021-44228 Log4j 2 Vulnerability")
    }
    add("implementation", "org.apache.logging.log4j:log4j-api:2.15.0") {
        because("CVE-2021-44228 Log4j 2 Vulnerability")
    }

还是没有效果

Answer 1

该库依赖于org.slf4j:slf4j-api:1.7.25.

dependencies {    
    testIplementation 'org.apache.logging.log4j:log4j-slf4j-impl:2.15.0'
}

可能没有必要constraints；尝试mavenCentral()？正如我们所看到的（上面的链接），它带有编译、运行时和测试依赖项。当 Maven Central 建议这应该是时testImplementation，这可能是要使用的正确配置。