Skip to content

Conversation

@vp-elitnet
Copy link
Contributor

It's great that slf4j is used, but it's not good that a library drags in a logging backend (logback-classic and logback-core artifacts) as a transitive dependency into projects using it. It creates bloat in the client project, might raise questions during security audits (why an unused logging framework is part of the project), etc.

Logback has also been upgraded to the latest version. I assumed this should not be a problem and did not bother separating scope change and version upgrade into separate commits. Let me know otherwise.

As an aside, I'm not a fan of DEBUG log level being enabled by default, which is the case for Logback when not configured explicitly. The debug log is useful when troubleshooting a failing test case, but when all test cases are passing (the typical case), debug logging just creates noise in build output possibly drowning out something more important. In a simple case like this I would opt for the more lightweight slf4j-simple instead of a full-blown logging framework, debug level could be enabled via a system property when actually needed. Alternatively, Logback configuration could be added to disable debug level by default. Either approach could be the subject of a separate PR, if desired.

Do not drag in a logging backend as a transitive dependency to client
projects.
@alexvoronov
Copy link
Owner

Sounds good! Debug logging was useful for development, but it definitely should not be the default logging level.

@alexvoronov alexvoronov merged commit e2aed57 into alexvoronov:master Nov 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants