Dependencies in Maven Artefact

[thoebert]

Thank you for your work on PDDL4J!

Today I noticed that the current Maven Artefact of PDDL4J (Maven) is packed with all its compiled dependencies, for example: Log4j, JUnit, etc. This leads to several drawbacks:

• Runtime exceptions: If one of these libraries is used within the same project, PDDL4J can not be used because of the code-duplication of the same library (with different versions). This leads to exceptions, for example a 'java.lang.NoSuchMethodError' if another version of Log4J is used in the same project.
• Security Issues: the packed Log4J version is highly unsafe because of the critical vulnerability CVE-2021-44228 a.k.a. log2shell (CVSS severity level 10 out of 10)
• Bulky dependency: Some of the packed dependencies, e. g. JUnit, are not necessary in the maven artefact and only increase the file size.

I think this can easily be fixed with a small change in the build/publish workflow.
Thank you!

[pellierd]

You 're right.

We will change this in the next release which is in preparation in the devel branch.