cf-java-logging-support icon indicating copy to clipboard operation
cf-java-logging-support copied to clipboard

Consider updating `com.auth0:java-jwt` to version 4.4.0

Open LukasHeimann opened this issue 1 year ago • 2 comments

I'm trying to use cf-java-logging-support together with SAP Cloud SDK. Both depend on com.auth0:java-jwt, albeit at different major versions, which is causing problems.

  • Cloud SDK depends on features of version 4, and won't run with a lower version installed: https://github.com/SAP/cloud-sdk-java/blob/ae8900c3d899dd197f3a98addffd649298fd1dcb/dependency-bundles/bom/pom.xml#L50
  • cf-java-logging-support declares version 3 as a dependency, and I don't feel comfortable just switching out the major version of a dependency from under its tows, especially given that JWT is potentially security relevant: https://github.com/SAP/cf-java-logging-support/blob/72739a04b3367a7c31f5554810e2f52e003811b2/pom.xml#L145

image

Please consider updating the dependency in this project, to make sure both SAP libraries work well together.

Thank you very much! Lukas

LukasHeimann avatar Aug 29 '24 06:08 LukasHeimann

Thank you for raising this issue. Note, that java-jwt is only required for the dynamic log level feature of the library. If you do not use it, you can even exclude this dependency. I will look into the upgrade though.

KarstenSchnitter avatar Aug 29 '24 06:08 KarstenSchnitter

I did some manual testing and can confirm, that cf-java-logging-support works well with java-jwt version 4.4.0. You can replace the dependency in your project safely. I am going to provide a library update. I already checked, that even version 4.4.0 will support Java 8.

KarstenSchnitter avatar Aug 29 '24 07:08 KarstenSchnitter

Fixed with release v3.8.5.

KarstenSchnitter avatar May 14 '25 08:05 KarstenSchnitter