Bump logback-classic to 1.4.14

guardian · Dec 12, 2023 · d8c2de3 · d8c2de3
1 parent e5b8290
commit d8c2de3
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/build.sbt b/build.sbt
@@ -73,6 +73,8 @@ lazy val root = (project in file("."))
       filters,
       specs2 % "test",
       "net.logstash.logback" % "logstash-logback-encoder" % "7.4" exclude ("com.fasterxml.jackson.core", "jackson-databind"),
+      // Transient dependency of Play. No newer version of Play 3.0.0 with this vulnerability fixed.
+      "ch.qos.logback" % "logback-classic" % "1.4.14",
       "com.fasterxml.jackson.module" %% "jackson-module-scala" % "2.16.0"
     ),
     excludeDependencies ++= Seq(