old slf4j pulled by jdeb breaks sbt-web asset pipeline

[guersam]

After upgrading sbt-native-packager 0.7.2 from 0.7.2-RC2 in a Play 2.3 project, I'm getting this error when running assets:

SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/Users/guersam/.ivy2/cache/org.slf4j/slf4j-nop/jars/slf4j-nop-1.5.3.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/Users/guersam/.ivy2/cache/org.slf4j/slf4j-jdk14/jars/slf4j-jdk14-1.5.6.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/Users/guersam/.ivy2/cache/org.slf4j/slf4j-simple/jars/slf4j-simple-1.7.7.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: slf4j-api 1.6.x (or later) is incompatible with this binding.
SLF4J: Your binding is version 1.5.5 or earlier.
SLF4J: Upgrade your binding to version 1.6.x.
[trace] Stack trace suppressed: run last web-plugin:webJarsNodeModules for the full output.
[trace] Stack trace suppressed: run last web-assets:webJars for the full output.
[error] (web-plugin:webJarsNodeModules) java.lang.NoSuchMethodError: org.slf4j.impl.StaticLoggerBinder.getSingleton()Lorg/slf4j/impl/StaticLoggerBinder;
[error] (web-assets:webJars) java.lang.ExceptionInInitializerError

It's caused by org.vafer:jdeb:1.2 which depends on org.apache.maven:maven-core:2.2.1, bringing tons of slf4j-api:1.5.x for related libraries.

Is there any workaround to remove jdeb? I tried addSbtPlugin("com.typesafe.sbt" % "sbt-native-packager" % "0.7.2" exclude ("org.vafer", "jdeb")) but had no luck.

[muuki88]

The workaround is to force to a slf4j version. When you add this to your plugins.sbt everything works. However we will target this issue (hopefully from both sides)

libraryDependencies ++= Seq(
    "org.slf4j" % "slf4j-api"       % "1.7.7" force(),
    "org.slf4j" % "slf4j-nop"       % "1.7.7" force(),
    "org.slf4j" % "slf4j-jdk14"     % "1.7.7" force(),
    "org.slf4j" % "jcl-over-slf4j"  % "1.7.7" force()
)

[guersam]

It works, thanks!

[muuki88]

@jsuereth , I was not able to exclude the org.slf4j dependencies from the dependency :(
Neither exclude nor excludeAll worked.

    "org.vafer" % "jdeb" % "1.2" artifacts (Artifact("jdeb", "jar", "jar")) excludeAll(
       ExclusionRule(organization = "org.slf4j")
    )

slf4j doesn't show up in the dependencies, but still there at runtime :/

[benmccann]

Fixed in jdeb here: tcurdt/jdeb#174. Need a new jdeb release so that we can update sbt-native-packager to use it. Btw, the workaround above caused some issues in Play per the linked issue, so might want to be careful using it

[muuki88]

Thanks for putting this information here! Hopefully the release won't take two month :)

[muuki88]

@benmccann I saw your ticket [tcurdt/jdeb/issues/175]. I'm playing around with the though removing the jdeb support in a 0.7.4 release and putting it back in, when jdeb 1.3 is released.

[benmccann]

Pull request here to upgrade to 1.3 :-) #307

[jsuereth]

Also related, jdeb appears to have lots of version ranges and significantly hurt the activator offline repository. I'm actually debating whether or not it's worth it to try to do classloader isolation on jdeb rather than using it directly.

i.e. we'd resolve it somewhere and use it via reflection rather than directly. In any case, these are all workable problems, just thought I'd share that slf4j isn't the only issue with jdeb's massive dependency list.

[benmccann]

@jsuereth good to know. looks like the version ranges aren't in jdeb directly, but are somewhere in the transitive dependency chain. it'd be worth upgrading to 1.3 and then seeing if the problem still exists or whether it's as severe since it removes three jdeb dependencies and upgrades most of the remaining to much newer versions

[muuki88]

@benmccann, @jsuereth I'm sure the upgrade will resolve a lot of stuff as all the maven2 dependencies which are more then 5 (?) years old are replaced.

If there are still problems, we have to refactor this out :/

[benmccann]

This is fixed now with 0.7.4 released! Looks like we can close this one =)