Merge pull request #4857 from jeremylong/logging

Fix Logging Issue

RELEASE_NOTES.md

@@ -1,5 +1,15 @@
 # Release Notes
 
+## [Version 7.2.0](https://github.com/jeremylong/DependencyCheck/releases/tag/v7.2.0) (2022-09-14)
+
+**Changes**
+
+- Add support for Bazel's pinned `maven_install.json` (#4772).
+- Fixed bug preventing the use of custom report templates (#4800).
+- Updated several dependencies including upgrades for dependencies with CVEs.
+- Several bug fixes made and suppression rules were added.
+- See the full listing of [changes](https://github.com/jeremylong/DependencyCheck/milestone/48?closed=1).
+
 ## [Version 7.1.2](https://github.com/jeremylong/DependencyCheck/releases/tag/v7.1.2) (2022-08-20)
 
 **Changes**

cli/src/main/java/org/owasp/dependencycheck/App.java

@@ -39,7 +39,6 @@
 import org.owasp.dependencycheck.utils.Settings;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.slf4j.impl.StaticLoggerBinder;
 
 import ch.qos.logback.core.FileAppender;
 import ch.qos.logback.classic.encoder.PatternLayoutEncoder;
@@ -658,9 +657,7 @@ private String getDefaultCveUrlModified(CliParser cli) {
      * @param verboseLog the path to the verbose log file
      */
     private void prepareLogger(String verboseLog) {
-        final StaticLoggerBinder loggerBinder = StaticLoggerBinder.getSingleton();
-        final LoggerContext context = (LoggerContext) loggerBinder.getLoggerFactory();
-
+        final LoggerContext context = (LoggerContext) LoggerFactory.getILoggerFactory();
         final PatternLayoutEncoder encoder = new PatternLayoutEncoder();
         encoder.setPattern("%d %C:%L%n%-5level - %msg%n");
         encoder.setContext(context);

pom.xml

@@ -119,8 +119,11 @@ Copyright (c) 2012 - Jeremy Long
 
         <apache.lucene.version>8.11.2</apache.lucene.version>
         <apache.ant.version>1.10.12</apache.ant.version>
-        <slf4j.version>2.0.0</slf4j.version>
+
+        <!-- upgrading slf4j and logback can cause issues ;) https://github.com/jeremylong/DependencyCheck/issues/4846 -->
+        <slf4j.version>1.7.36</slf4j.version>
         <logback.version>1.2.11</logback.version>
+
         <!-- Note that Maven will use classes from the distro, ignoring declared dependencies for Maven core... -->
         <maven.api.version>3.1.0</maven.api.version>
         <reporting.checkstyle-plugin.version>3.2.0</reporting.checkstyle-plugin.version>