Question: dependency-check-ant includes slf4j impl

[asoftwareguy]

Why does the JAR come packaged with an implementation instead of relying on the API? When deployed with other projects, it causes the multiple slf4j bindings issue.

[jeremylong]

Dependency-check has an instance of slf4j in its lib directory as slf4j is not used by Ant. I'm double checking with @colezlaw - but if memory serves implementing a StaticLoggerBinder allows a library that uses SLF4j (in this case dependency-check) to route log messages to Ant.

[asoftwareguy]

Thanks for checking. When I am integrating, the problem I am ending up with is the following: https://www.slf4j.org/codes.html#multiple_bindings

[jeremylong]

Newer versions of slf4j appear to support the Java extensions mechanism to load services. We need to investigate changing our binding to use this instead of the static binder.