如何在maven构建期间删除或排除传递Log4j ?

Question

在我的构建期间(使用maven命令mvn clean install)，我的maven编译器自动下载log4j依赖1.2.12(repository/log4j/log4j/)，但由于这有漏洞问题，我需要排除这个传递依赖下载。

这是我的POM(但不是真的需要，因为一个空的POM将下载它以及使用默认的mvn编译器，我猜?)

<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.dsm</groupId>
<artifactId>testing</artifactId>
<version>1.0-SNAPSHOT</version>
<properties>
<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>
<cucumber.version>7.3.3</cucumber.version>
<selenium.version>4.1.4</selenium.version>
<awaitility.version>4.2.0</awaitility.version>
<assertj.version>3.22.0</assertj.version>
<commonsmodel.version>5.3.3</commonsmodel.version>
<maven.surefire.version>3.0.0-M5</maven.surefire.version>
<commons-lang3.version>3.12.0</commons-lang3.version>
<junit-jupiter-engine.version>5.8.2</junit-jupiter-engine.version>
<maven-cucumber-reporting.version>5.7.0</maven-cucumber-reporting.version>
</properties>
<dependencies>
<dependency>
<groupId>io.cucumber</groupId>
<artifactId>cucumber-java</artifactId>
<version>${cucumber.version}</version>
</dependency>
<dependency>
<groupId>io.cucumber</groupId>
<artifactId>cucumber-junit-platform-engine</artifactId>
<version>${cucumber.version}</version>
</dependency>
<dependency>
<groupId>org.junit.platform</groupId>
<artifactId>junit-platform-suite</artifactId>
<version>1.8.2</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-engine</artifactId>
<version>${junit-jupiter-engine.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>net.jodah</groupId>
<artifactId>failsafe</artifactId>
<version>2.4.4</version>
</dependency>
<dependency>
<groupId>org.seleniumhq.selenium</groupId>
<artifactId>selenium-java</artifactId>
<version>${selenium.version}</version>
</dependency>
<dependency>
<groupId>org.awaitility</groupId>
<artifactId>awaitility</artifactId>
<version>${awaitility.version}</version>
</dependency>
<dependency>
<groupId>org.assertj</groupId>
<artifactId>assertj-core</artifactId>
<version>${assertj.version}</version>
</dependency>
<dependency>
<groupId>io.cucumber</groupId>
<artifactId>cucumber-picocontainer</artifactId>
<version>${cucumber.version}</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>${commons-lang3.version}</version>
</dependency>
<dependency>
<groupId>net.masterthought</groupId>
<artifactId>maven-cucumber-reporting</artifactId>
<version>${maven-cucumber-reporting.version}</version>
</dependency>
</dependencies>
<profiles>
<profile>
<id>TestExecutor</id>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>${maven.surefire.version}</version>
<dependencies>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-engine</artifactId>
<version>${junit-jupiter-engine.version}</version>
</dependency>
</dependencies>
<configuration>
<includes>
<includes>**/ExecutorTest.java</includes>
</includes>
</configuration>
</plugin>
<!--cucumber report plugin-->
<plugin>
<groupId>net.masterthought</groupId>
<artifactId>maven-cucumber-reporting</artifactId>
<version>${maven-cucumber-reporting.version}</version>
<executions>
<execution>
<id>generate-cucumber-reports</id>
<phase>test</phase>
<goals>
<goal>generate</goal>
</goals>
<configuration>
<projectName>Automation report</projectName>
<outputDirectory>${project.build.directory}/cucumber-reports</outputDirectory>
<inputDirectory>${project.build.directory}/cucumber</inputDirectory>
<jsonFiles>
<param>**/*.json</param>
</jsonFiles>
<checkBuildResult>false</checkBuildResult>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
</profiles>

</project>

Answer 1

您已经给出了一半的答案:您需要更改maven-compiler-plugin的版本。说明可在https://maven.apache.org/plugins/maven-compiler-plugin/usage.html上找到最好的做法是锁定插件的版本，以确保你也可以在X年后重建你的项目。

Answer 2

我尝试更新编译器版本，但现在它在maven-dependency-plug-in中给出相同的传递依赖错误。目前使用的是2.8，我尝试将其更改为3.3.0，这是最新的，但仍然存在相同的问题。