[Snyk] Upgrade ch.qos.logback:logback-classic from 1.6.1 to 1.6.3

[kburger]

Snyk has created this PR to upgrade ch.qos.logback:logback-classic from 1.6.1 to 1.6.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 2 versions ahead of your current version.

• The recommended version was released 21 days ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[kburger]

This patch upgrade introduces several behavioral changes and a deprecation.

Version 1.6.2

• Configuration analysis is now stricter and will emit warnings for contradictory caller-data inclusion instructions, for example, when an appender has includeCallerData set to false but the layout pattern uses caller-data converters (%C, %M, etc.).

Version 1.6.3

• Security Fix (CVE-2026-19880): The MDCBasedDiscriminator (used by SiftingAppender) now sanitizes MDC values by stripping slashes to prevent path traversal attacks. A warning is logged if a value is modified.
• Behavioral Change: ConsoleAppender no longer closes the underlying System.out or System.err streams when stopped. This prevents the appender from tearing down streams shared with the rest of the JVM.
• Deprecation: The withJansi property on ConsoleAppender is now deprecated. Existing configurations will continue to work, but the new JansiConsoleAppender should be used for new setups requiring ANSI color support.

Recommendation: While these changes are primarily bug fixes and security improvements, the modification to ConsoleAppender behavior could affect applications that implicitly relied on the stream being closed. Verify that your application is not dependent on this side-effect. No immediate code changes are required for the deprecation.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[kburger]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud