使用gradle configuration.all更新同一组中的2依赖项

Question

由于我们希望(轻松地)解决所有log4j / logback漏洞，所以我们尝试在build.gradle.kts中添加configuration.all

configurations.all {
    resolutionStrategy.eachDependency {
        if (requested.group == "org.apache.logging.log4j" && requested.version!! < "2.16.0") {
            useVersion("2.16.0")
            because("To avoid RCE vulnerability.")
        }
        if (requested.group == "ch.qos.logback" && requested.name == "logback-classic" && requested.version!! < "1.2.8") {
            useVersion("1.2.8")
            because("To avoid RCE vulnerability.")
        }
        if (requested.group == "ch.qos.logback" && requested.name == "logback-core" && requested.version!! < "1.2.8") {
            useVersion("1.2.8")
            because("To avoid RCE vulnerability.")
        }
    }
}

但是它只改变了logback-core，而没有改变logback-classic。

(如果我删除了logback-core，它就会为经典的.

Answer 1

我现在觉得有点傻了。

您必须使用<=版本，而不是<版本

比预期的更有效

configurations.all {
    resolutionStrategy.eachDependency {
        if (requested.group == "org.apache.logging.log4j" && requested.version!! <= "2.16.0") {
            useVersion("2.16.0")
            because("To avoid RCE vulnerability.")
        }
        if (requested.group == "ch.qos.logback" && requested.name == "logback-classic" && requested.version!! <= "1.2.8") {
            useVersion("1.2.8")
            because("To avoid RCE vulnerability.")
        }
        if (requested.group == "ch.qos.logback" && requested.name == "logback-core" && requested.version!! <= "1.2.8") {
            useVersion("1.2.8")
            because("To avoid RCE vulnerability.")
        }
    }
}

你甚至可以让它更简单：

configurations.all {
    resolutionStrategy.eachDependency {
        if (requested.group == "org.apache.logging.log4j" && requested.version!! <= "2.16.0") {
            useVersion("2.16.0")
            because("To avoid RCE vulnerability.")
        }
        if (requested.group == "ch.qos.logback" && requested.version!! <= "1.2.8") {
            useVersion("1.2.8")
            because("To avoid RCE vulnerability.")
        }
    }
}