Why is the latest version of log4j provided by the CentOS mirrors are only up to version 1.2.17? [closed] - centos

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
We don’t allow questions seeking recommendations for books, tools, software libraries, and more. You can edit the question so it can be answered with facts and citations.
Closed 1 year ago.
Improve this question
In the CentOS version 7 rpm repositories I am only finding the most recent version of log4j 1.2.17. The vulnerability is suggesting a version 2.x I believe 2.15. I do find the 2.x versions on the apache site but those are not rpm based.

There are different log4j frameworks. The version for 1.2.17 is the latest for 1.x and they changed the framework name after version 2. I think you should try log4j2, log4J-api or log4J-core.
For example, there are different versions for Maven:
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.16.0</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.16.0</version>
</dependency>
<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<version>1.2.17</version>
</dependency>

Related

JDK 11 with JAXB and JAXWS works with Eclipse but not IntelliJ

I am converting an application that uses JAXB and JAX-WS from JDK 8 to JDK 11. The code runs when I use Eclipse IDE but exactly the same code fails with IntelliJ IDEA
I have created a Maven project using both Eclipse and IntelliJ IDEA. The problems of finding a working combination of Maven resources has been described in another question. JDK 11 with JAXB and JAXWS problems
The code builds without error in both environments. I have tried creating the IntelliJ IDEA project as a Maven project as well as a standard IDEA project
part of pom.xl
<dependency>
<groupId>org.openjfx</groupId>
<artifactId>javafx-controls</artifactId>
<version>11.0.2</version>
</dependency>
<dependency>
<groupId>org.openjfx</groupId>
<artifactId>javafx-fxml</artifactId>
<version>11.0.2</version>
</dependency>
<dependency>
<groupId>org.glassfish.jaxb</groupId>
<artifactId>jaxb-runtime</artifactId>
<version>2.3.0</version>
</dependency>
<!-- JAXWS for Java 11 -->
<dependency>
<groupId>com.sun.xml.ws</groupId>
<artifactId>rt</artifactId>
<version>2.3.1</version>
</dependency>
module-info.java
module org.openfx.gustfx {
requires javafx.controls;
requires javafx.fxml;
requires transitive javafx.graphics;
requires java.xml.bind;
requires java.xml.ws;
requires javax.jws;
opens com.agile.ws.schema.common.v1.jaxws to javafx.fxml;
opens org.openfx.gustfx to javafx.fxml;
exports org.openfx.gustfx;
}
When the code is run from Eclipse, there are no errors.
Running the same code from IntelliJ IDE results in this error
java.lang.ClassNotFoundException: com.sun.xml.internal.ws.spi.ProviderImpl
Searching through the jar files confirms that ProviderImpl.class is now located in com.sun.ws.spi not in com.sun.xml.internal.ws.spi This does not cause a problem with eclipse but IDEA reports the ClassNotFoundException
Therefore, my question "How does eclipse resolve this problem while IntelliJ does not ?"
With help from Roman Shevchenko at IntelliJ, I have solved this problem using the following pom.xml
<dependency>
<groupId>com.sun.xml.ws</groupId>
<artifactId>jaxws-rt</artifactId>
<version>2.3.2</version>
</dependency>
<dependency>
<groupId>javax.jws</groupId>
<artifactId>javax.jws-api</artifactId>
<version>1.1</version>
</dependency>
and module-info.java
requires java.xml.ws;
requires java.xml.bind;
requires javax.jws;

junit-jupiter-engine v5.0.1 not working with eclipse Oxygen.3a Release (4.7.3a)

I stumbled upon this exception while running a junit test class (versions in question title).
As i have read in this thread that i must upgrade to eclipse Oxygen.3, i did it but still have the same exception thrown.
Maybe the platform is missing in your pom.
<dependency>
<groupId>org.junit.platform</groupId>
<artifactId>junit-platform-launcher</artifactId>
<version>${junit.platform.version}</version>
<scope>test</scope>
</dependency>

Making Jasper 6.3.0 work with itextpdf-5.5.6 or Higher Version [duplicate]

From yesterday I have problems compiling with maven because of iText jar.
My project has a dependency of jasperreports-2.0.1 that depends on itext-1.02b or higher.
<dependency>
<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>
<version>[1.02b,)</version>
<scope>compile</scope>
</dependency>
That is the log error in maven:
Failed to collect dependencies for [jasperreports:jasperreports:jar:2.0.1 (compile)]: Failed to read artifact descriptor for com.lowagie:itext:jar:4.2.2: Could not transfer artifact com.itextpdf:itextpdf:pom:4.2.2 from/to jaspersoft (http://www.jasperforge.org/maven2): Access denied to http://www.jasperforge.org/maven2/com/itextpdf/itextpdf/4.2.2/itextpdf-4.2.2.pom. Error code 403, Forbidden -> [Help 1]
I see here a comment from Amedee Van Gasse that says something about a 4.2.2 version with no jar.
Why does the 1.02b version attach to 4.2.2?
Edit:
Jasper-reports uses an open version range:
[1.02b,)
This range says to maven to take the library latest version.
With the update from iText adding new version Pom with no jar and editting the maven-metadata of maven-central to that no-jar version crashes the compilation to all jar depending form latest com.lowagie library.
Updating locally your maven-metadata-central.xml (and other metadata if your company has it's own nexus.public) from ...m2\repository\com\lowagie\itext
to that works. Temporally solucion until iText updates the metadata or ALL companies that has dependencies for it's latest version updates it's pom
<metadata modelVersion="1.1.0">
<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>
<versioning>
<latest>4.2.1</latest>
<release>4.2.1</release>
<versions>
<version>0.99</version>
<version>1.1.4</version>
<version>1.02b</version>
<version>1.2.3</version>
<version>1.3</version>
<version>1.3.1</version>
<version>1.4</version>
<version>1.4.8</version>
<version>2.0.1</version>
<version>2.0.6</version>
<version>2.0.7</version>
<version>2.0.8</version>
<version>2.1.0</version>
<version>2.1.2</version>
<version>2.1.3</version>
<version>2.1.4</version>
<version>2.1.5</version>
<version>2.1.7</version>
<version>4.2.0</version>
<version>4.2.1</version>
</versions>
<lastUpdated>20150709153501</lastUpdated>
</versioning>
</metadata>
A much simpler solution may be to upgrade to a newer version of jasperreports. Version 6.1.0 has this dependency on iText:
<dependency>
<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>
<version>2.1.7.js2</version>
<scope>compile</scope>
</dependency>
No more "floating" dependency on iText, and it's a version that's custom made for jasperreports!
See http://mvnrepository.com/artifact/net.sf.jasperreports/jasperreports/6.1.0 for the complete pom.xml.
I'm using gradle and for the current version 6.8.2 I got the following build error:
> Could not find com.lowagie:itext:2.1.7.js6
So I added http://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/ as repository and now it works.
repositories {
mavenCentral()
maven { url "https://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/" }
}
dependencies {
compile 'net.sf.jasperreports:jasperreports:6.8.0'
}
EDIT:
If you used this solution and suddenly get an error like
> Could not resolve com.lowagie:itext:2.1.7.js6.
> Could not parse POM http://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/com/lowagie/itext/2.1.7.js6/itext-2.1.7.js6.pom
> The element type "hr" must be terminated by the matching end-tag "</hr>".
This is because the jfrog repository disabled http and only allows https now. For some reason this creates a broken pom with the following content
<html>
<head><title>308 Permanent Redirect</title></head>
<body>
<center><h1>308 Permanent Redirect</h1></center>
<hr><center>nginx</center>
</body>
</html>
Solution: Replace the http in the repository url with https.
The problem is indeed in the POM of jasper-reports:
<dependency>
<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>
<version>[1.02b,)</version>
<scope>compile</scope>
</dependency>
Jasper-reports distributes a (modified) build of iText 2.1.7 since at least November 2012 (if memory serves me well), so if your version of jasper-reports still has a dependency on 1.02b and up, it must be a very old version.
The jasper-reports dependency on iText should be changed to:
<dependency>
<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>
<version>[1.02b,2.1.7]</version>
<scope>compile</scope>
</dependency>
Or just:
<dependency>
<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>
<version>2.1.7</version>
<scope>compile</scope>
</dependency>
This relates to this question: How do I tell Maven to use the latest version of a dependency?
That page is riddled with cautions about always using the latest version for your dependencies. It reduces reproducibility of your builds.
2.1.7 was the last version of iText released by the company iText Group NV (or its legal predecessor), with the com.lowagie groupId. The next version of iText, released by the company iText Group NV, was version 5.0.0, with the com.itextpdf groupId, which means it's binary incompatible with your current code. There's also the matter of a license change to AGPL, but that is outside the scope of StackOverflow, I want to restrict my answer to the technical matters.
Any other versions of iText between 2.1.7 and 5.0.0, like 4.2.0 and 4.2.1, are forks by other companies. According to Apache's Guide to uploading artifacts to the Central Repository (https://maven.apache.org/guides/mini/guide-central-repository-upload.html), those companies should have used a different groupId, as the page clearly states in their FAQ:
I have a patched version of the foo project developed at foo.com, what
groupId should I use? When you patch / modify a third party project,
that patched version becomes your project and therefore should be
distributed under a groupId you control as any project you would have
developed, never under com.foo. See above considerations about
groupId.
TL;DR
If you don't want to change your code, tell your Maven to only get iText 2.1.7.
We decide to maintain same jasperreport version and made this changes in conflicteds pom:
<dependencies>
<dependency>
<groupId>jasperreports</groupId>
<artifactId>jasperreports</artifactId>
<version>2.0.1</version>
<exclusions>
<exclusion>
<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>
<version>2.1.7</version>
</dependency>
...
</dependencies>
Edit: Change dependecy to 2.1.7 to be certain it will compile in future
I was making manteinance to some legacy code, and i faced the same problem. The solution that i found was to add the following to the pom.xml:
<repositories>
<repository>
<id>jasper-3rd-party</id>
<name>Jasper3rdParty</name>
<url>http://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/</url>
</repository>
</repositories>
<dependencies>
<dependency>
<groupId>net.sf.jasperreports</groupId>
<artifactId>jasperreports</artifactId>
<version>6.12.2</version>
</dependency>
<!-- More dependencies like: commons-collections4, org.apache.xmlgraphics, etc -->
<dependency>
<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>
<version>2.1.7.js4</version>
</dependency>
</dependencies>
The JasperReports version used to test this code was released on Mar/2020. Hope this helps!
I got the same problem,
Just realized that https://jaspersoft.jfrog.io/artifactory/third-party-ce-artifacts is not accessible by public, you need to change the artifactory to jaspersoft directory.
For maven you can use below repositories in pom.xml
<repositories>
<repository>
<id>jaspersoft-third-party</id>
<url>https://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/</url>
</repository>
</repositories>
JasperReports patched the iText with some bug fixes. So you have to add the patched iText repo[1] in your pom/gradle file.
[1] http://jasperreports.sourceforge.net/maven2/
Below is the gradle snippet for your reference when using jasper report 6.1.1.
repositories {
mavenLocal()
mavenCentral()
maven { url "http://repo.spring.io/release" }
maven { url "https://jaspersoft.jfrog.io/artifactory/third-party-ce-artifacts/" }
maven { url "http://jasperreports.sourceforge.net/maven2/" }
}
This worked with the latest jasper-reports version 6.17.0 and maven 3.8.1, especially with the jasperreports-plugin from com.alexnederlof in version 2.8:
<project>
...
<repositories>
<!-- JasperSoft, they modified a standard library for their own special needs -->
<repository>
<id>jaspersoft-third-party</id>
<url>https://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/</url>
</repository>
</repositories>
<pluginRepositories>
<!-- JasperSoft, they modified a standard library for their own special needs -->
<pluginRepository>
<id>jaspersoft-third-party</id>
<url>https://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/</url>
</pluginRepository>
</pluginRepositories>
...
It's important to know that there is not only <repositories> but also <pluginRepositories> which you maybe have to supply (depending on your setup and transitive dependencies).
Answer for searchers in 2k19
Artifact:
<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>
is deprecated now.
Better to exclude it from jasperreports and add new itext dependency manually
<dependency>
<groupId>jasperreports</groupId>
<artifactId>jasperreports</artifactId>
<version>6.10.0</version> <!--(or higher)-->
<exclusions>
<exclusion>
<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.itextpdf</groupId>
<artifactId>itextpdf</artifactId>
<version>5.5.13</version> <!--(or higher)-->
</dependency>
"Fix" for me was to switch from jasperreports version 5.5.0 to 4.5.1 LOL. (which doesn't depend on itext)
Then it doesn't depend on a custom, seemingly unpublished dependency version of itext (2.1.7.js2 in my case).
You could download 2.1.7.js2.jar from the jasper people and publish it locally to your "own" custom maven repo, or even your local ~/.m2/repository (ugh). I've even seen people have a custom ivy command to "publish" a local copy of it to a local server (ivy or maven).
Or add the repo's in the other answers. Or just specify it manually as 2.1.7, which is in the main repo's, etc. (you'll miss some bug fixes though).
If you are using gradle Note That the url to the jaspersoft package below was changed from this one:
maven{ url "http://jaspersoft.artifactoryonline.com/jaspersoft/third-party-ce-artifacts" }
To this one here:
maven { url "https://jaspersoft.jfrog.io/artifactory/third-party-ce-artifacts" }
We have the same problem. To solve it, we have deleted the proxy parameters of the Maven config, and change the last version of the maven-metadata-central (in folder com\lowagie\itext of your repository).
A bad solution, but, temporaly, works :/
I have the same problem when using Maven 2.2.1, i re-built my project using Maven 3.2.3 and its works !
You have to use Maven 3 to resolve your problem, the bug seem to be resolved in this version.

Scala package throws java.lang.UnsupportedClassVersionError

Our java application has dependencies on Spark, which is written in Scala. Build tool is Maven, and am running from within Eclipse. The JDK_HOME used to compile the application on the command line using Maven, and the JRE used to run within Eclipse, are both 1.7.0_15.
The Maven POM contains the following:
<plugin>
<groupId>org.scala-tools</groupId>
<artifactId>maven-scala-plugin</artifactId>
...
<configuration>
<scalaVersion>1.10.5</scalaVersion>
<args>
<arg>-target:jvm-1.7</arg>
</args>
</configuration>
</plugin>
I understand that Spark is built using Scala 2.10
The maven dependencies include the following:
<dependency>
<groupId>org.apache.spark</groupId>
<artifactId>spark-core_2.11</artifactId>
<version>1.3.1</version>
</dependency>
<dependency>
<groupId>org.elasticsearch</groupId>
<artifactId>elasticsearch-hadoop</artifactId>
<version>2.1.0.Beta4</version>
</dependency>
<dependency>
<groupId>org.elasticsearch</groupId>
<artifactId>elasticsearch-spark_2.10</artifactId>
<version>2.1.0.Beta4</version>
</dependency>
<dependency>
<groupId>org.scala-lang</groupId>
<artifactId>scala-xml</artifactId>
<version>2.11.0-M4</version>
</dependency>
<dependency>
<groupId>org.scala-lang.modules</groupId>
<artifactId>scala-parser-combinators_2.12.0-M2</artifactId>
<version>1.0.4</version>
</dependency>
<dependency>
<groupId>org.apache.spark</groupId>
<artifactId>spark-sql_2.10</artifactId>
<version>1.3.0</version>
</dependency
>
At runtime, the folowing exception is thrown:
Exception in thread "main" java.lang.UnsupportedClassVersionError: scala/util/parsing/combinator/PackratParsers : Unsupported major.minor version 52.0
I cannot find a 2.10.* version of the scala-parser-combinators jar.
Can anyone assist with the solution?
Thanks!
The scala-parser-combinators_2.12.0-M2 module is part of the Scala 2.12 distribution.
2.12 is targeted for Java 8 - bytecode major version 52, hence the error.
Your best bet is to either use an older Spark distribution or switch to Java 8 (Java 7 is at End-Of-Life since April 2015).
EDIT (addressing question edit): you cannot find an older version of the scala-parser-combinators library, because it was isolated to a stand-alone module at some point after 2.10. You can attempt to simply exclude this dependency in your POM, but there's no guarantee your chosen Spark version will be compatible with this older library version.

Creating Akka project in OSGi

I am hoping to run an Akka project within an OSGi container (apache-servicemix-4.4.1-fuse-06-03) but am having a little trouble installing the dependent libraries. I have already installed akka-actor and config as follows:
osgi:install -s mvn:com.typesafe.akka/akka-actor/2.1-SNAPSHOT
osgi:install -s mvn:com.typesafe/config/0.4.1
But am unable to install scala-library (v2.9.2 required). I have tried creating my own bundle using the maven-bundle-plugin but to no avail and have googled round for ages.
Any help would be greatly appreciated.
If you're looking for a quick workaround, use the bundle from your Scala IDE/Eclipse for Scala 2.9.2. I did that for my Akka 2.1/Karaf POC and it worked fine. If you don't have one, download it from my lib folder here.
This was kindly uploaded after posting on the scala-users group:
https://github.com/guofengzh/scala-lang-osgi
The built binaries of scala-lang-osgi referred by #ben1729 is now available on our Bippo/Soluvas Nexus repository public repository: http://nexus.bippo.co.id/nexus/content/groups/public/
Feel free to browse our repository at http://nexus.bippo.co.id/nexus/
Usage:
<repository>
<id>bippo-nexus-public</id>
<url>http://nexus.bippo.co.id/nexus/content/groups/public/</url>
</repository>
then add one or all of them to your Maven POM file:
<dependency>
<groupId>org.scala-lang-osgi</groupId>
<artifactId>scala-library</artifactId>
<version>2.9.2</version>
</dependency>
<dependency>
<groupId>org.scala-lang-osgi</groupId>
<artifactId>scala-compiler</artifactId>
<version>2.9.2</version>
</dependency>
<dependency>
<groupId>org.scala-lang-osgi</groupId>
<artifactId>scala-dbc</artifactId>
<version>2.9.2</version>
</dependency>
<dependency>
<groupId>org.scala-lang-osgi</groupId>
<artifactId>scala-swing</artifactId>
<version>2.9.2</version>
</dependency>
Please let me know when a new version comes out so I can redeploy the newer artifacts to our repo.
Update: Scala OSGi 2.10-M6 is now available on our repository:
<dependency>
<groupId>org.scala-lang-osgi</groupId>
<artifactId>scala-library</artifactId>
<version>2.10.0-M6</version>
</dependency>
<dependency>
<groupId>org.scala-lang-osgi</groupId>
<artifactId>scala-compiler</artifactId>
<version>2.10.0-M6</version>
</dependency>
<dependency>
<groupId>org.scala-lang-osgi</groupId>
<artifactId>scala-dbc</artifactId>
<version>2.10.0-M2</version>
</dependency>
<dependency>
<groupId>org.scala-lang-osgi</groupId>
<artifactId>scala-swing</artifactId>
<version>2.10.0-M6</version>
</dependency>
It can work with Akka but using a patched Akka 2.1-M1 (see http://www.assembla.com/spaces/akka/tickets/2367-osgi-manifest-references-2-9-2 ).
The patched Akka is available in our repository as: (in Karaf URL)
mvn:com.typesafe.akka/akka-actor/2.1-M1/jar/patch2
Summary on Akka bug: Akka 2.1-M1 requires 2.10-M6, it doesn't work with 2.9.2 :
Error executing command: Error starting bundles:
nable to resolve 160.0: missing requirement [160.0] osgi.wiring.package; (&(osgi.wiring.package=scala.collection.convert)(version>=2.9.2)(!(version>=2.10.0)))
But it currently imports the wrong package versions:
scala.collection.convert;version="[2.9.2,2.10)",
scala.concurrent.util;version="[2.9.2,2.10)",
scala.concurrent.util.duration;version="[2.9.2,2.10)",