log4j-core and log4j-api version constraint specified in io.quarkus:quarkus-bom does not match

[cuichenli]

Describe the bug

Since version 3.0.1.Final, the io.quarkus:quarkus-bom package introduced a constraint on log4j-core and specified the version as 2.17.1. However, the version constraint for log4j-api remains at 2.20.0. It is unclear whether this was intentional, but it has led to a tricky bug during development (at least in my case, it was not easy to identify the root cause). You can find a reproducible repository at https://github.com/cuichenli/quarkus-log4j-core-constraint-issue.

When you run the program in this repo, you will see error:

Caused by: java.lang.NoSuchMethodError: 'java.lang.ClassLoader[] org.apache.logging.log4j.util.LoaderUtil.getClassLoaders()'

I have observed that when using io.quarkus.platform:quarkus-bom, this issue does not occur. Therefore, I'm curious about the scenarios in which we should use either the quarkus-bom package or the quarkus-platform:quarkus-bom package. Could you provide some guidance on this matter? Thank you!

[geoand]

cc @aloubyansky @gsmet

[aloubyansky]

The core a appears to be a test scoped dependency constraint in the io.quarkus:quarkus-bom which gets filtered out from the io.quarkus.platform:quarkus-bom

<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>2.17.1</version>
    <scope>test</scope>
</dependency>

We are not actually managing log4j-core directly in the quarkus-bom, it's probably getting leaked from some other BOM we import but it makes sense to align them.

As to the io.quarkus vs io.quarkus.platform, it's the later one that we officially recommend Quarkus applications to use.

Thanks for reporting the issue @cuichenli