IntelliJ Platform Drops Log4j for java.util.logging: Migration Guide and Security Rationale
JetBrains announced that the IntelliJ platform will discontinue Log4j usage, recommending java.util.logging as the standard logging framework, and provides detailed migration steps, security reasons, and version information for developers to adapt their plugins and dependencies.
JetBrains officially announced on its blog that the IntelliJ platform will completely stop using Log4j and recommends switching to java.util.logging as the standard logging framework.
The platform requires logging to files and consoles with configurable levels, which the standard JDK logging API fully satisfies.
To avoid security alerts and reduce attack surface, JetBrains will replace Log4j with java.util.logging in the 2022.1 release.
JetBrains will also provide a stub implementation that redirects Log4j API calls to java.util.logging (derived from SLF4J), though the stub is not fully functional and may require code adjustments.
If your plugin code uses Log4j, switch to the standard platform logger com.intellij.openapi.diagnostic.Logger .
If your code uses Log4j in both plugin and other contexts, switch to the SLF4J API, which the IntelliJ platform implements via java.util.logging .
If a dependency uses Log4j, ask its maintainer to migrate to SLF4J; if that is impossible, use the Log4j‑SLF4J bridge.
If you customized Log4j API to work with SLF4J, switch to configuring handlers and levels directly with java.util.logging .
If you configure test logging with Log4j XML files, migrate to property‑file configuration as described in the LogManager documentation and set the system property idea.log.config.properties.file when running tests.
These changes will be available in the upcoming 221.4165.x EAP version, and developers are encouraged to test plugin compatibility with the new logging setup.
Although Log4j2 suffered major vulnerabilities last year, JetBrains uses a patched Log4j 1.2 version, so IntelliJ‑based IDEs are not affected and have removed all network‑related code.
Note that Log4j 1 and Log4j 2 are completely different codebases with incompatible APIs, which can cause some security tools to incorrectly flag JetBrains as vulnerable.
The migration eliminates lingering security concerns for JetBrains users.
Top Architect
Top Architect focuses on sharing practical architecture knowledge, covering enterprise, system, website, large‑scale distributed, and high‑availability architectures, plus architecture adjustments using internet technologies. We welcome idea‑driven, sharing‑oriented architects to exchange and learn together.
How this landed with the community
Was this worth your time?
0 Comments
Thoughtful readers leave field notes, pushback, and hard-won operational detail here.