Slf4j consists of 3 pieces - input mappers (like log4j-slf4j) that pretend to be other implementations, the api itself (slf4j-api), and output mappers (like slf4j-log4j) that delegate the logging message to the users chosen implementation. Of these, only the API should be a compile dependency, the others should be marked "provided" so that the user can choose their own output mapper.

This specifically shows up in:

<groupId>org.zkoss.common</groupId>
<artifactId>zcommon</artifactId>
<version>7.0.0</version>

It also occurs transitively in org.zkoss.common.zel. "org.beanshell.bsh" includes it - it can be removed like so:

<dependency>
<groupId>org.beanshell</groupId>
<artifactId>bsh</artifactId>
<version>2.0b4</version>
<exclusions>
<exclusion>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-jdk14</artifactId>
</exclusion>
</exclusions>
</dependency>

If I get a free moment I'll put together a changeset myself for this and submit it - its a pretty small change overall.

Thanks!