Maven shade plugin does not exclude an artifact

Question

I need to exclude the log4j artifact from the shade plug-in to avoid the log4j vulnerability, however, the exclude tag under artifactSet does not seem to work. Any suggestion to fix this?

<groupId>org.apache.maven.plugins</groupId> <artifactId>maven-shade-plugin</artifactId> <version>3.2.4</version> ~~ <executions> <execution> <phase>package</phase> <goals> <goal>shade</goal> </goals> <configuration> <artifactSet> <excludes> <exclude>*:log4j-core:jar</exclude> </excludes> </artifactSet> ~~~

I keep getting below error: Failed to execute goal org.apache.maven.plugins:maven-shade-plugin:3.2.4:shade (default) on project : Execution default of goal org.apache.maven.plugins:maven-shade-plugin:3.2.4:shade failed: Plugin org.apache.maven.plugins:maven-shade-plugin:3.2.4 or one of its dependencies could not be resolved: Could not find artifact org.apache.logging.log4j:log4j-core:jar:2.13.0

thanks TheAmateurCoder and khmarbaise for the comments. I tried changing the versions but getting same error. I want to exclude the log4j-core which this plug-in tries to resolve during build time. It throws this error when I run 'mvn install' command/ — Anup
– Anup, Commented Jan 23, 2022 at 3:50

Armstrongya · Accepted Answer · 2022-04-20 07:38:48Z

I meet the same problem, and finally solved by maven-shade-plugin config. In your case, you want to exclude log4j-core, your filter config must put outside of artifactSet as below.

find log4j-core class path prefix, for example org/slf4j/;
put this class path prefix in filter exclude rule, run cmd mvn package
use vim your-target.jar to check exclude success or not, you will find that org/slf4j has gone.
for more exclude info, pls see https://maven.apache.org/plugins/maven-shade-plugin/examples/includes-excludes.html
```
 <filter> <artifact>*:*</artifact> <excludes> <exclude>org/slf4j/**</exclude> </excludes> </filter> 
```

Collectives™ on Stack Overflow

Maven shade plugin does not exclude an artifact

1 Answer 1

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Linked

Related