Istvan Toth

> Since these libraries use commons-logging as their logging facade, excluding commons-logging may introduce troubles like ClassNotFoundException? Not if the the jcl-over-slf4j jar is present on the classpath (which already...

> Better also ban commons-logging import in the maven enforcer plugin? The commons-logging classes (along with log4j1 and log4j2 ) are already restricted.

+1 LGTM I agree that the current code does not make sense. This does change the semantics of the timeout. Maybe merge this with #7519 ? I think that a...

> should we adapt these functions to use java.lang.invoke.MethodHandles.Lookup.defineClass instead? That would alleviate concerns about removing methods in a patch release.