Unnecessary dependency on commons-logging

[ikeyat]

Description

Until v5.3.1, terasoluna-gfw-parent imports spring-core through io-platform (a.k.a Spring IO Platform). Actually it's defined in spring-boot-starter-parent that is a parent of io-platform.
Since v5.4.1, terasoluna-gfw-parent imports spring-core through spring-framework-bom to satisfy #797.

The change causes an unnecessary dependency on commons-logging on v5.4.1.
Therefore, application will include unexpected commons-logging in spite the application never use it.
(In TERASOLUNA Framework Development guideline, jcl-over-slf4j and logback are recommended instead of commons-logging)
terasoluna-gfw-parent pom should be fixed not to import commons-logging.

• v5.4.1
  https://github.com/terasolunaorg/terasoluna-gfw/blob/5.4.1.RELEASE/terasoluna-gfw-parent/pom.xml#L188-L215
  http://central.maven.org/maven2/org/springframework/spring-framework-bom/4.3.14.RELEASE/spring-framework-bom-4.3.14.RELEASE.pom

  commons-logging is not excluded.

• v5.3.1
  https://github.com/terasolunaorg/terasoluna-gfw/blob/5.3.1.RELEASE/terasoluna-gfw-parent/pom.xml#L187-L193
  http://central.maven.org/maven2/io/spring/platform/platform-bom/Athens-SR2/platform-bom-Athens-SR2.pom
  http://central.maven.org/maven2/org/springframework/boot/spring-boot-starter-parent/1.4.3.RELEASE/spring-boot-starter-parent-1.4.3.RELEASE.pom

  commons-logging is excluded as following. This is described on the Spring IO Reference.

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>${spring.version}</version>
        <exclusions>
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
    </dependencies>
  </dependencyManagement>

Possible Solutions

Candidates

1. excludes commons-logging at terasoluna-gfw-parent pom
2. change the version of platform-io keeping the versions of all the dependent libraries.

Affects Version/s

• 5.4.1.RELEASE

Fix Version/s

• 5.5.1
• 5.4.2

Issue Links

• Update spring and spring security version #797
• https://docs.spring.io/platform/docs/Brussels-SR5/reference/htmlsingle/#getting-started-logging

[ikeyat]

Warning: The impact of this problem may be a separation of log system.

I'm not sure whether commons-logging takes over jcl-over-slf4j or not.
If it does, logs of legacy libraries based on commons-logging (such as Spring4, commons) may be written with commons-logging, others may be written with logback through slf4j.

To avoid this certainly, please exclude commons-logging in your application's pom.

[yoshikawaa]

Fixed at #896. terasoluna-gfw 5.4.2 depend on spring-core using platform-bom Brussels-SR17.