This pull request addresses a security vulnerability by upgrading Logback to version 1.3.12 and includes necessary updates to related dependencies, such as SLF4J and Spring Boot, to ensure compatibility across the project.
Details
Upgraded Logback to 1.3.12
The primary objective of this update was to resolve a known security vulnerability (CVE) affecting all versions prior to 1.3.12.
Upgraded SLF4J to 2.0.0
Upgrading Logback to version 1.3.x required a corresponding update to SLF4J, as SLF4J 1.x is incompatible with Logback 1.3.x.
This change ensures smooth logging functionality and eliminates conflicts arising from older SLF4J versions.
Updated Spring Boot Version
The upgrade to SLF4J 2.0.0 introduced compatibility issues with Spring Boot 2.x, leading to runtime errors when mixing SLF4J 2.x with Spring Boot 2.x.
As part of this pull request, Spring Boot has been upgraded to a version compatible with SLF4J 2.0.0 to resolve these issues.
Background
This update is part of a larger effort to enhance the security and stability of the project by addressing known vulnerabilities and maintaining compatibility among core libraries. The changes ensure a smooth upgrade path and avoid runtime errors caused by mismatched versions.
Summary
This pull request addresses a security vulnerability by upgrading Logback to version
1.3.12
and includes necessary updates to related dependencies, such as SLF4J and Spring Boot, to ensure compatibility across the project.Details
1.3.12
1.3.12
.2.0.0
1.3.x
required a corresponding update to SLF4J, as SLF4J1.x
is incompatible with Logback1.3.x
.2.0.0
introduced compatibility issues with Spring Boot 2.x, leading to runtime errors when mixing SLF4J2.x
with Spring Boot2.x
.2.0.0
to resolve these issues.Background
This update is part of a larger effort to enhance the security and stability of the project by addressing known vulnerabilities and maintaining compatibility among core libraries. The changes ensure a smooth upgrade path and avoid runtime errors caused by mismatched versions.