Merge pull request #406 from guardian/ash/logback

Bump logback-classic to 1.2.13
guardian · Dec 12, 2023 · 8f17ecb · 8f17ecb
2 parents c5df113 + 077d10f
commit 8f17ecb
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/build.sbt b/build.sbt
@@ -36,7 +36,9 @@ lazy val root = (project in file("."))
     libraryDependencies ++= jacksonOverrides
       ++ akkaSerializationJacksonOverrides
       ++ Seq(
-        "net.logstash.logback" % "logstash-logback-encoder" % "7.3"
+        "net.logstash.logback" % "logstash-logback-encoder" % "7.3",
+        // Transient dependency of Play. No newer version of Play 2.9 or Play 3.0 with this vulnerability fixed.
+        "ch.qos.logback" % "logback-classic" % "1.2.13",
       ),
 
     buildInfoKeys ++= Seq[BuildInfoKey](