如何在 Maven 構建期間刪除或排除傳遞 Log4j？

Question

在我的構建過程中（使用 maven 命令mvn clean install ）我的 maven 編譯器會自動下載log4j依賴1.2.12 （repository/log4j/log4j/），但由於這存在漏洞問題，我需要排除這個傳遞依賴項下載。

這是我的 POM（但實際上並不需要，因為我猜一個空的 pom 也會使用默認的 mvn 編譯器下載它？）

<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.dsm</groupId>
    <artifactId>testing</artifactId>
    <version>1.0-SNAPSHOT</version>

    <properties>
        <maven.compiler.source>1.8</maven.compiler.source>
        <maven.compiler.target>1.8</maven.compiler.target>

        <cucumber.version>7.3.3</cucumber.version>
        <selenium.version>4.1.4</selenium.version>
        <awaitility.version>4.2.0</awaitility.version>
        <assertj.version>3.22.0</assertj.version>
        <commonsmodel.version>5.3.3</commonsmodel.version>
        <maven.surefire.version>3.0.0-M5</maven.surefire.version>
        <commons-lang3.version>3.12.0</commons-lang3.version>
        <junit-jupiter-engine.version>5.8.2</junit-jupiter-engine.version>
        <maven-cucumber-reporting.version>5.7.0</maven-cucumber-reporting.version>
    </properties>

    <dependencies>

        <dependency>
            <groupId>io.cucumber</groupId>
            <artifactId>cucumber-java</artifactId>
            <version>${cucumber.version}</version>
        </dependency>

        <dependency>
            <groupId>io.cucumber</groupId>
            <artifactId>cucumber-junit-platform-engine</artifactId>
            <version>${cucumber.version}</version>
        </dependency>

        <dependency>
            <groupId>org.junit.platform</groupId>
            <artifactId>junit-platform-suite</artifactId>
            <version>1.8.2</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter-engine</artifactId>
            <version>${junit-jupiter-engine.version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>net.jodah</groupId>
            <artifactId>failsafe</artifactId>
            <version>2.4.4</version>
        </dependency>

        <dependency>
            <groupId>org.seleniumhq.selenium</groupId>
            <artifactId>selenium-java</artifactId>
            <version>${selenium.version}</version>
        </dependency>

        <dependency>
            <groupId>org.awaitility</groupId>
            <artifactId>awaitility</artifactId>
            <version>${awaitility.version}</version>
        </dependency>

        <dependency>
            <groupId>org.assertj</groupId>
            <artifactId>assertj-core</artifactId>
            <version>${assertj.version}</version>
        </dependency>

        <dependency>
            <groupId>io.cucumber</groupId>
            <artifactId>cucumber-picocontainer</artifactId>
            <version>${cucumber.version}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>${commons-lang3.version}</version>
        </dependency>

        <dependency>
            <groupId>net.masterthought</groupId>
            <artifactId>maven-cucumber-reporting</artifactId>
            <version>${maven-cucumber-reporting.version}</version>
        </dependency>

    </dependencies>

    <profiles>
        <profile>
            <id>TestExecutor</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-surefire-plugin</artifactId>
                        <version>${maven.surefire.version}</version>
                        <dependencies>
                            <dependency>
                                <groupId>org.junit.jupiter</groupId>
                                <artifactId>junit-jupiter-engine</artifactId>
                                <version>${junit-jupiter-engine.version}</version>
                            </dependency>
                        </dependencies>
                        <configuration>
                            <includes>
                                <includes>**/ExecutorTest.java</includes>
                            </includes>
                        </configuration>
                    </plugin>
                    <!--cucumber report plugin-->
                    <plugin>
                        <groupId>net.masterthought</groupId>
                        <artifactId>maven-cucumber-reporting</artifactId>
                        <version>${maven-cucumber-reporting.version}</version>
                        <executions>
                            <execution>
                                <id>generate-cucumber-reports</id>
                                <phase>test</phase>
                                <goals>
                                    <goal>generate</goal>
                                </goals>
                                <configuration>
                                    <projectName>Automation report</projectName>
                                    <outputDirectory>${project.build.directory}/cucumber-reports</outputDirectory>
                                    <inputDirectory>${project.build.directory}/cucumber</inputDirectory>
                                    <jsonFiles>
                                        <param>**/*.json</param>
                                    </jsonFiles>
                                    <checkBuildResult>false</checkBuildResult>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>


</project>

Answer 1

您自己已經給出了一半的答案：您需要更改 maven-compiler-plugin 的版本。 可以在https://maven.apache.org/plugins/maven-compiler-plugin/usage.html找到說明。在 pom 中鎖定插件版本始終是最佳實踐，以確保您可以在X年也是。