[Snyk] Security upgrade ch.qos.logback:logback-classic from 1.2.6 to 1.5.25

[bogarin]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• maven-modules/maven-exec-plugin/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	External Initialization of Trusted Variables or Data Stores SNYK-JAVA-CHQOSLOGBACK-15062482	376	ch.qos.logback:logback-classic: 1.2.6 -> 1.5.25 No Known Exploit

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[Copilot]

Pull request overview

This PR upgrades the logback-classic dependency from version 1.2.6 to 1.5.25 to fix a low-severity security vulnerability (SNYK-JAVA-CHQOSLOGBACK-15062482) related to external initialization of trusted variables or data stores.

Changes:

• Updated logback-classic version property from 1.2.6 to 1.5.25 in the maven-exec-plugin module

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The upgrade to logback-classic 1.5.25 is incompatible with the project's Java version configuration. Logback 1.5.x requires Java 11 as a minimum, but this project is configured to use Java 1.8 (see line 49). This will cause runtime or compile-time failures.

To fix the security vulnerability while maintaining Java 8 compatibility, consider using logback-classic 1.2.13 instead, which is the latest 1.2.x version that supports Java 8 and includes security fixes. Alternatively, if upgrading to Java 11+ is acceptable, update the java.version property accordingly.

Suggested change

	<logback.version>1.5.25</logback.version>
	<logback.version>1.2.13</logback.version>