Skip to content

Updates for logging under Java 21 #317

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Updates for logging under Java 21 #317

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d005f7f
Updates for logging under Java 21
nickgaray Sep 24, 2025
655e1c6
Update logback-classic to address CVE
nickgaray Sep 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions lib-ogc/swe-common-core/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@ group = 'org.vast.opengis'
description = 'SWE Common Core'

dependencies {
api 'ch.qos.logback:logback-classic:1.2.13'
api 'com.fasterxml.woodstox:woodstox-core:6.2.8'
api 'ch.qos.logback:logback-classic:1.5.13'
api 'com.fasterxml.woodstox:woodstox-core:6.4.0'
api 'com.google.code.gson:gson:2.11.0'
api 'com.google.guava:guava:32.1.3-jre'
api 'net.sf.trove4j:core:3.1.0'
Expand Down
8 changes: 3 additions & 5 deletions sensorhub-core/src/main/java/org/sensorhub/utils/ModuleUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,6 @@
import org.sensorhub.api.module.ModuleConfig;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.slf4j.impl.StaticLoggerBinder;
import org.vast.util.Asserts;
import ch.qos.logback.classic.LoggerContext;
import ch.qos.logback.classic.util.ContextInitializer;
Expand Down Expand Up @@ -218,11 +217,10 @@ public static Logger createModuleLogger(IModule<?> module)
String moduleID = module.getLocalID();

// if module config wasn't initialized or logback not available, use class logger
StaticLoggerBinder binder = StaticLoggerBinder.getSingleton();
if (moduleID == null || NO_ID_FLAG.equals(moduleID) ||
!binder.getLoggerFactoryClassStr().contains("logback"))
if (moduleID == null || NO_ID_FLAG.equals(moduleID)) {
return LoggerFactory.getLogger(module.getClass());

}

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What error were you getting before this change?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SLF4J(W): No SLF4J providers were found.
SLF4J(W): Defaulting to no-operation (NOP) logger implementation
SLF4J(W): See https://www.slf4j.org/codes.html#noProviders for further details.
SLF4J(W): Class path contains SLF4J bindings targeting slf4j-api versions 1.7.x or earlier.
SLF4J(W): Ignoring binding found at [jar:file:/E:/COMMON/osh-node/build/distributions/osh-node-2.0-beta2/lib/logback-classic-1.2.13.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J(W): Ignoring binding found at [jar:file:lib/logback-classic-1.2.13.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J(W): See https://www.slf4j.org/codes.html#ignoredBindings for an explanation.

I was seeing this issue, unfortunately, this morning I cannot reproduce. However, updating the build.gradle file noted with this PR to use

  api 'ch.qos.logback:logback-classic:1.5.13'
  api 'com.fasterxml.woodstox:woodstox-core:6.4.0'

Does eliminate CVEs in builds, and I was running yesterday with these updates.

I think I can just sit on this and see if I can reproduce the issue,

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hold on I just reproduced the build break...

Copy link
Collaborator Author

@nickgaray nickgaray Sep 25, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Task :osh-core:sensorhub-core:compileJava FAILED
E:\CUBIC\osh-node\include\osh-core\sensorhub-core\src\main\java\org\sensorhub\utils\ModuleUtils.java:31: error: package org.slf4j.impl does not exist
import org.slf4j.impl.StaticLoggerBinder;

  • on master branch, after wiping all builds
  • using OpenLogic OpenJDK 21.0.8
  • building on Windows 11

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using CoPilot to assess the issue

You're encountering this error because SLF4J version 2.x no longer uses the StaticLoggerBinder class. Instead, it relies on the Java ServiceLoader mechanism to discover logging implementations at runtime.

🔍 What's Happening
The org.slf4j.impl.StaticLoggerBinder class was part of SLF4J 1.x.

In SLF4J 2.x, this static binding mechanism was removed.

If you're using SLF4J 2.x but trying to import StaticLoggerBinder, you'll get the "package does not exist" error.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am able to reproduce when building SensorHub Test, but it is odd because it is intermittently breaking while other times exhibiting the following "warning"

SLF4J(W): No SLF4J providers were found.
SLF4J(W): Defaulting to no-operation (NOP) logger implementation
SLF4J(W): See https://www.slf4j.org/codes.html#noProviders for further details.
SLF4J(W): Class path contains SLF4J bindings targeting slf4j-api versions 1.7.x or earlier.
SLF4J(W): Ignoring binding found at [jar:file:/C:/Users/Nicolas%20Garay/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-classic/1.2.13/e9f3458e7354fe4917081237c01fa4999f4e1b86/logback-classic-1.2.13.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J(W): See https://www.slf4j.org/codes.html#ignoredBindings for an explanation.

// generate instance ID
String instanceID = Integer.toHexString(moduleID.hashCode());
instanceID = instanceID.replace("-", ""); // remove minus sign if any
Expand Down
Loading