[GROOVY-10431] Bump logback to 1.2.9 (test dependency)

• Type: Dependency upgrade
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.0.0-rc-2
• Assignee: Paul King
• Reporter: Paul King
• Created: 23/Dec/21 01:41
• Updated: 03/Feb/22 22:29
• Resolved: 10/Jan/22 23:54

Description

Groovy doesn't bundle a version of Logback in its distribution nor list it as a dependency in its pom (or bom), so isn't directly affected by CVE-2021-42550. Folks using logback directly may wish to upgrade their version or follow the advice in the links.

Note that Logback 1.2.9 disables Groovy configuration support for being "too powerful". Users relying on that feature may wish to stay using Logback 1.2.8 but please ensure your configuration files have appropriate file system protections.

See also:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42550
https://jira.qos.ch/browse/LOGBACK-1591