log4j-1.2.12.jar gets installed in Confluence when upgrading Lucidchart plugin to version 1.27.1

Hi @kent.rogers, thanks for posting in the Lucid Community! I have raised this issue with our engineers and they are looking into this issue. I will update this thread once I learn more from them, I appreciate your help and patience!

I have the same Confluence environment as Kent Rogers has and we have a detected issue from our Compliance department with our Confluence instance, due to the presence of this log4j-1.2.12 jar file, detected in /var/atlassian/application-data/confluence/plugins-osgi-cache/felix/felix-cache/bundle320/version0.0/bundle.jar-embedded/META-INF/lib/log4j-1.2.12.jar .     I’m assuming that just removing this jar file will take care of the issue, preferably while Confluence is stopped. 

Since Atlassian does recommend cleaning out the cache directories when plug-in issues occur, and is something we do with every stop + start of our Confluence instance, is this something that will come back again when the plug-in cache folders are re-crated on startup of Confluence? 

Atlassian’s page for plug-in cache folder clean-up is here:
https://confluence.atlassian.com/confkb/how-to-clear-confluence-plugins-cache-297664846.html

plugins-osgi-cache is one of the four folders that are re-created if not present on startup of Confluence, the log4j-1.2.12.jar would be re-created in the location listed above once the plug-in cache folders are re-created on startup.  That would mean that the log4j file would need to be removed, for our instance, every time Confluence would be started up. 

If this log4j jar file isn’t needed, can this be fixed in a future update of LucidChart? 

Amelia,

I see the LucidChart plug-in for Confluence to version 1.27.2, with no release notes of what’s in the update, save a two-word comment on the version page on the Atlassian Marketplace entry that says “Internal Maintenance”. 

Does this update to 1.27.2 remove this old log4j-1.2.12.jar file that came up with 1.27.1? 

Amelia, I see that 1.28.0 was released today, did the fix for the old log4j-1.2.12.jar file get incorporated into this new release or is it still pending for a future release?