Dependency problem with logback when upgrade to A12 2023-06-ext8

Data Services
1

Hi,
I’m upgrading A12 from 2023-06-ext5 to 2023-06-ext8. I encountered a dependency problem with logback (version 1.4.7), the application can’t start due to the following error:

Exception in thread "main" java.lang.NoClassDefFoundError: ch/qos/logback/core/util/StatusPrinter2
	at org.springframework.boot.logging.logback.LogbackLoggingSystem.<init>(LogbackLoggingSystem.java:110)
	at org.springframework.boot.logging.logback.LogbackLoggingSystem$Factory.getLoggingSystem(LogbackLoggingSystem.java:495)
	at org.springframework.boot.logging.DelegatingLoggingSystemFactory.getLoggingSystem(DelegatingLoggingSystemFactory.java:44)
	at org.springframework.boot.logging.LoggingSystem.get(LoggingSystem.java:167)

When I used version 1.5.13:

force 'ch.qos.logback:logback-core:1.5.13'
force 'ch.qos.logback:logback-classic:1.5.13'

the above error is gone, but I encountered the following issue:

> Task :data-services:app:bootRun
Logging system failed to initialize using configuration from 'null'
java.lang.NoSuchMethodError: 'java.lang.Object ch.qos.logback.classic.LoggerContext.getConfigurationLock()'
	at org.springframework.boot.logging.logback.LogbackConfigurator.getConfigurationLock(LogbackConfigurator.java:53)
	at org.springframework.boot.logging.logback.DefaultLogbackConfiguration.apply(DefaultLogbackConfiguration.java:57)
	at org.springframework.boot.logging.logback.LogbackLoggingSystem.lambda$loadDefaults$0(LogbackLoggingSystem.java:238)
	at org.springframework.boot.logging.logback.LogbackLoggingSystem.withLoggingSuppressed(LogbackLoggingSystem.java:472)
	at org.springframework.boot.logging.logback.LogbackLoggingSystem.loadDefaults(LogbackLoggingSystem.java:227)
	at org.springframework.boot.logging.AbstractLoggingSystem.initializeWithConventions(AbstractLoggingSystem.java:84)
	at org.springframework.boot.logging.AbstractLoggingSystem.initialize(AbstractLoggingSystem.java:61)
	at org.springframework.boot.logging.logback.LogbackLoggingSystem.initialize(LogbackLoggingSystem.java:193)
	at org.springframework.boot.context.logging.LoggingApplicationListener.initializeSystem(LoggingApplicationListener.java:332)

The version I used in gradle setting is:

		a12Libs {
			//2023.06-ext8
			version('base', '27.1.0')
			version('kernel', '28.5.3')
			version('form-engine', '36.7.4')
			version('uaa', '7.5.0')
			version('utils', '5.7.0')
			version('dataservices', '36.3.9')
			version('workflows', '10.6.9')
			version('print-engine', '1.2.2')
...

Do you have any idea how to fix that?
Thanks!

2

Could you provide the current spring boot version as well?

3

sure: springBootVersion = ‘3.3.2’

4

Could you please try to force only the following:

 force 'ch.qos.logback:logback-classic:1.4.7'
5

It caused this error:

6

deps.txt (632.4 KB)
I checked to update the project template to ext8, but I did not experience such an issue.
The logback version is resolved to 1.5.6

7

The application works fine with ogback 1.5.6 , but this version contains 2 vulnerability bugs

see: https://mvnrepository.com/artifact/ch.qos.logback/logback-classic/1.5.6

should we keep using that?

8

I’m not a security expert, but for context, this Logback version is a transitive dependency managed by Spring Boot. Once your project is upgraded to Spring Boot 2024.x or a newer a12 release, this should be addressed through the spring boot updates.

9

ok, I’ll ask the security guy in my project if we could use 1.5.6.
And thanks for your support @loi-risen-dale