sbt 1.7.3 warns about no-op slf4j implementation on startup

[bpholt]

steps

Launch sbt 1.7.3 with a plugin enabled that uses slf4j 1.x.

problem

sbt prints this on startup:

SLF4J: No SLF4J providers were found.
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See https://www.slf4j.org/codes.html#noProviders for further details.
SLF4J: Class path contains SLF4J bindings targeting slf4j-api versions 1.7.x or earlier.

expectation

I expected the log4j implementation included with sbt to be used, instead of the no-op implementation.

notes

I think this is because of the coursier update, which (according to its release notes) pulls in slf4j 2.0.3—but log4j 2.17.1, which sbt depends on directly, depends on slf4j 1.7.25.

[SethTisue]

Clarification: "Launch sbt 1.7.3" isn't sufficient to reproduce the problem.

scalacenter/scalafix#1700 seems to imply that it's necessary certain plugins to be involved (sbt-scalafix is one such plugin, perhaps there are others?).

[bjaglin]

scalacenter/scalafix#1700 seems to imply that it's necessary certain plugins to be involved (sbt-scalafix is one such plugin, perhaps there are others?).

I assume (but haven't verified) that sbt itself does not use SLF4J, but any sbt plugin that does triggers the warning (and won't have Java logs).

[bpholt]

Clarification: "Launch sbt 1.7.3" isn't sufficient to reproduce the problem.

Yep, you're right—we have a default set of plugins enabled, and it seems that addSbtPlugin("com.github.sbt" % "sbt-git" % "2.0.0") triggers the warnings as well.

[wsargent]

I've run into this as well.

[pk044]

Same here - I get this warning on >= 1.7.3. No warning on 1.7.2.

[eed3si9n]

I think this is because of the coursier update, which (according to its release notes) pulls in slf4j 2.0.3—but log4j 2.17.1, which sbt depends on directly, depends on slf4j 1.7.25.

So sbt's forced into bumping up slf4j-api and log4j binding?

[kevin-lee]

Is there any workaround? I think because of this, sbt-dependency-check doesn't show CVE info even with Dlog4j2.level=debug.

[ennru]

This shows in the same way with sbt 1.8.0 when plugins pull in slf4j.
(To make it even more fun: slf4j 2.x is not compatible with slf4j 1.7, but that's just another chamber in dependency hell.)

[eed3si9n]

I have a PR for this - coursier/sbt-coursier#441

[bpholt]

Thanks @eed3si9n!