[Maintenance]: Migrate from Log4j 2 to SLF4J + Logback
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
Research direction
Start by reading LogFunctions.java and JTextAreaAppender.java, which the issue identifies as the highest- and medium-risk parts of the migration. Review how the current logging setup uses Log4j 2 Core and how the appender is registered before estimating the broader import and dependency changes. Done means the logging code and named dependencies use SLF4J + Logback, Log4j 2 is removed, and the macro functions are carefully tested.
Written by the indexing model from the issue text.
Description
Describe the problem
Some corporate security scanners flag any version of log4j-core*.jar by name, regardless of patch level. Removing Log4j 2 entirely eliminates the false positive.
The improvement you'd like to see
Migrate the current logging code to SLF4J + Logback
Expected Benefits
No more false positives for security scanners that have flagged all Log4j 2 libraries as critical security issues, regardless of patch level.
SLF4J provides a facade allowing us to swap the logging implementation in the future if we desire,
Additional Context
Risks
High Risk - LogFunctions.java uses advanced Log4j 2 Core API that has no direct SLF4J equivalent — requires Logback-specific API and careful testing of macro functions.
Medium Risk - JTextAreaAppender.java needs to be reimplemented as a Logback appender with a different discovery/registration mechanism.
Low Risk The bulk, approx. 190 file import changes are import-only and can be validated by the compiler.
com.github.RPTools:advanced-dice-roller will need to change its logger to SLF4J (low risk)
com.github.RPTools:upnplib will need to change its logger to SLF4J (low risk)
Replace sentry-log4j with sentry-logback
- Dominant language
- Java
- Stars
- 927
- Forks
- 286
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 94
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from RPTools/maptool
-
[Bug]: An initiative list with no current entry logs an error on every changePossibly taken @dwizard0 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
[Maintenance]: Migrate gradle dependency submission to modern alternativePossibly taken @VelpulaGangavardhan claimed this 18 days ago. Opencode-maintenance
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
RPTools/maptool#6156 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
code-maintenance
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
feature
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
Similar issues
-
Cleanup: restore the interrupt flag in AiFailureAnalyzerPossibly taken @Rishankgupta08 claimed this today. Opengood first issue
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
seleniumboot/selenium-boot#258 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
johanhaleby/occurrent#1505 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
FasterXML/jackson-databind#6443 ·
Maintainers usually reply within 1 day
-
Docs: 2 broken linksOpen
Difficulty 1/5 Under an hour Newbie friendliness 78/100
Maintainers usually reply within 1 day