Hi,
We are using Hibernate-validator 6.0.17. We want to disable jboss-logging.
Our main aim is to remove dependency jboss-logging.jar.
Any suggestions on, how to configure it / disable. (To remove that jar dependency).
hibernate-validator » 6.0.17.Final they remove the dependencies list. I doubt can we disable this or not?
So, first, a question: why?
And then an answer: it’s probably doable but I don’t think it’s worth it. All our logging is based on JBoss Logging. If you really want to get rid of it, you would have to write an adapter layer for your logging solution of choice.
As of 2022, after the Log4j bug, I think it is safe to say the question “why” can be answered “because every additional library is a potential security risk”. So while I admit that several logging systems have advantages that might be needed, I still favor maximum package independence. Probably Hibernate can get such a lightweight adapter layer a some point in the future.
Jboss logging is a lightweight adapter layer. It redirects to Log4j, Logback, whatever you pick.
Hibernate validator does not depend on any logging implementation, just on jboss logging which is essentially an API.
If you’re suggesting to remove the dependency to a logging API, then I don’t understand how Hibernate Validator is supposed to log anything. Surely you’re not suggesting to rely on the (very limited) Java logging APIs?
There is always an assessment done between needs and risks. However, I am not really an expert for logging libraries, which is why I gladly resort to the limited Java logging APIs. That said, if Jboss logging is really lightweight, then the situation should be fine. After all, the whole Log4j mess came from too many features. I already have redirected Jboss logging to jdk, I’ve just been afraid there could be too many hidden features in the part I could not remove. Thanks for clearing that up.