docx4j lib dependencies

[ifallon]

Hi,

Looking at the graph of lib dependencies supplied for docx4j (6.1.2) I see this (plus others of course):

docx4j-6.1.2
slf4j-api-1.7.25
commons-io-2.5
xmlgraphics-commons-2.3

but xmlgraphics-commons-2.3 has its own dependencies that are not included above:

xmlgraphics-commons-2.3
commons-io-1.3.1
commons-logging-1.0.4

so it looks like commons-logging-1.0.4 is needed anyway regardless of the SLF4J stuff.

Plus I assume I have to add a compatible SLF4J JAR (I'm thinking slf4j-nop-1.7.5 as I don't care about docx4j's logging).

But what about the fact we end up with commons-io-1.3.1 AND commons-io-2.5.jar on the classpath as a result of the 'missing' xmlgraphics-commons-2.3 dependency ?
Does this just work by luck of compatibility ? It feels v risky in terms of clashing libs.

[jason]

You are right, xmlgraphics has a dependency on commons-io 1.3.1: https://search.maven.org/artifact/org.a ... ns/2.3/jar

That should be excluded in our pom (assuming 2.5 works ok), at https://github.com/plutext/docx4j/blob/ ... m.xml#L556

An issue should be created at xmlgraphics so they can update their dep.

Regarding commons-logging, we use jcl-over-slf4j instead; see https://github.com/plutext/docx4j/blob/ ... m.xml#L556

[ifallon]

Thanks Jason.

We don't use Maven unfortunately but we do use OSGi so I've managed to structure the bundling to avoid most classpath issues and am proceeding on the assumption the 2 commons-io libs are just playing nicely at the moment.