security: modernize Java 8 logging stack

Author: kevinten10

README.md

@@ -180,6 +180,13 @@ Sample implementation library:
 </project>
 ```
 
+### Logging compatibility
+
+The Spring Boot integration does not transitively select a logging implementation. Applications should provide the
+SLF4J provider they use, such as Logback or Log4j 2. Capa's Java 8 Logback adapters compile against SLF4J 2.0.17 and
+Logback 1.3.16; their logging dependencies remain optional so Spring Boot applications can keep their own managed
+logging stack.
+
 ### Running the examples
 
 Try the following examples to learn more about Capa's Java SDK:

README_ZH.md

@@ -148,6 +148,12 @@ Sample implementation library:
 </project>
 ```
 
+### 日志兼容性
+
+Spring Boot 集成模块不会再传递引入具体日志实现。应用需要自行提供所使用的 SLF4J provider，例如 Logback 或
+Log4j 2。Capa 的 Java 8 Logback 适配模块使用 SLF4J 2.0.17 和 Logback 1.3.16 编译；日志依赖保持可选，
+因此 Spring Boot 应用可以继续使用自身管理的日志技术栈。
+
 ### Running the examples
 
 Try the following examples to learn more about Capa's Java SDK:

examples/pom.xml

@@ -32,7 +32,8 @@
 
     <properties>
         <log4j.version>2.25.4</log4j.version>
-        <logback.version>1.2.13</logback.version>
+        <logback.version>1.3.16</logback.version>
+        <slf4j.version>2.0.17</slf4j.version>
     </properties>
 
     <dependencies>
@@ -72,12 +73,6 @@
              <version>${logback.version}</version>
          </dependency>
 
-        <!--lombok-->
-        <dependency>
-            <groupId>org.projectlombok</groupId>
-            <artifactId>lombok</artifactId>
-            <version>1.18.2</version>
-        </dependency>
     </dependencies>
 
     <build>

examples/src/main/java/group/rxcloud/capa/examples/log/DemoLog.java

@@ -16,7 +16,8 @@
  */
 package group.rxcloud.capa.examples.log;
 
-import lombok.extern.slf4j.Slf4j;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * An application cannot use log4j and logback configuration to print logs at the same time.
@@ -26,13 +27,14 @@
  * 1. Resources cannot contain log4j2.xml and logback.xml files at the same time,
  * 2. log4j-slf4j-impl and logback-classic cannot exist at the same time.
  */
-@Slf4j
 public class DemoLog {
 
+    private static final Logger LOG = LoggerFactory.getLogger(DemoLog.class);
+
     public static void main(String[] args) {
         try {
-            log.info("test");
-        }catch (Exception e){
+            LOG.info("test");
+        } catch (Exception e) {
             System.out.println();
         }
 

sdk-component/pom.xml

@@ -34,7 +34,8 @@
         <okhttp.version>4.12.0</okhttp.version>
         <kotlin-stdlib.version>1.8.21</kotlin-stdlib.version>
         <log4j.version>2.25.4</log4j.version>
-        <logback.version>1.2.13</logback.version>
+        <logback.version>1.3.16</logback.version>
+        <slf4j.version>2.0.17</slf4j.version>
      </properties>
 
     <dependencies>

sdk-spi-demo/pom.xml

@@ -32,7 +32,8 @@
 
     <properties>
         <log4j.version>2.25.4</log4j.version>
-        <logback.version>1.2.13</logback.version>
+        <logback.version>1.3.16</logback.version>
+        <slf4j.version>2.0.17</slf4j.version>
     </properties>
 
     <dependencies>

sdk-spi/pom.xml

@@ -32,7 +32,8 @@
 
     <properties>
         <log4j.version>2.25.4</log4j.version>
-        <logback.version>1.2.13</logback.version>
+        <logback.version>1.3.16</logback.version>
+        <slf4j.version>2.0.17</slf4j.version>
     </properties>
 
     <dependencies>

sdk-springboot/pom.xml

@@ -31,7 +31,6 @@
 
     <properties>
         <jackson.version>2.18.8</jackson.version>
-        <logback.version>1.2.13</logback.version>
         <okhttp.version>4.12.0</okhttp.version>
         <spring-framework.version>5.3.39</spring-framework.version>
         <springboot.version>2.7.18</springboot.version>
@@ -61,16 +60,6 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
-            <dependency>
-                <groupId>ch.qos.logback</groupId>
-                <artifactId>logback-classic</artifactId>
-                <version>${logback.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>ch.qos.logback</groupId>
-                <artifactId>logback-core</artifactId>
-                <version>${logback.version}</version>
-            </dependency>
             <dependency>
                 <groupId>com.squareup.okhttp3</groupId>
                 <artifactId>okhttp</artifactId>
@@ -90,6 +79,10 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter</artifactId>
             <exclusions>
+                <exclusion>
+                    <groupId>org.springframework.boot</groupId>
+                    <artifactId>spring-boot-starter-logging</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>org.yaml</groupId>
                     <artifactId>snakeyaml</artifactId>