grails-core
grails-core copied to clipboard
Remove logback.groovy configuration (incompatible with logback 1.2.9)
Logback dropped support for grooovy configuration since 1.2.9.
Details info could be found in news for Dec 16, 2021 http://logback.qos.ch/news.html
There are a lot of mentions of this way for configuring logs in documentation and probably also in templates. Better to remove them.
Current result - application will fail to run (including integration tests) if logback is updated to 1.2.9
Just to mention, update to Logback 1.2.9 is desirable since the recent CVE-2021-42550 affecting Logback 1.2.7 and older.
There were some discussions from Logback JIRA , grails framework nead to support backward compatibility.
Spring Boot 2.6.2 use Logback 1.2.9 now, so if Grails 5.1.2 upgrade to Spring Boot 2.6.2, it would cause some errors with logback.
Logback still supports programmatic configuration. Grails could:
- Implement logback's
com.qos.logback.classic.spi.Configuratorthat looks for the old groovy file - Use a groovy dsl to generate the xml logback expects
- Inform users that the first option above is left up to end-users now
Is it just me, or is arbitrary code execution when you have access to the server's files, a non-issue?