BFO does not include or depend on Log4J
BFO products do not ship with Log4J. We will use it if configured and in the classpath for logging, but we do not depend on it in any way and it's up to you to include and configure it in your own deployment.
More generally, the BFO PDF Library, Graph Library and Report Generator will never have a dependency on any third party software. In general, code written for these APIs 20 years ago will continue to work today. We can't do that building on code we didn't write.
We include the open-source JPEG2000 package as
our PDF Library. It's optional, but recommended.
It's built from a version we've
branched and maintain.
We are satisfied it does not create a security risk, or do anything other than
JPEG2000 image compression.
In all other cases where we work with third party libraries, such as Log4J or Apache Lucene, these will always be optional and up to you to install if you need them.
We do not use JNDI, and we never, ever load classes from URLs.