[Snyk] Fix for 2 vulnerabilities

[bogarin]

Snyk has created this PR to fix 2 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Information Exposure SNYK-JAVA-COMMONSCODEC-561518	399	No Known Exploit
	External Initialization of Trusted Variables or Data Stores SNYK-JAVA-CHQOSLOGBACK-15062482	376	ch.qos.logback:logback-classic: 1.2.6 -> 1.5.25 ch.qos.logback:logback-core: 1.2.6 -> 1.5.25 No Known Exploit

Vulnerabilities that could not be fixed

• Upgrade:
  • Could not upgrade software.amazon.awssdk:s3@2.10.27 to software.amazon.awssdk:s3@2.41.15; Reason could not apply upgrade, dependency is managed externally ; Location: https://maven-central.storage-download.googleapis.com/maven2/software/amazon/awssdk/aws-sdk-java-pom/2.10.27/aws-sdk-java-pom-2.10.27.pom

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Information Exposure

[Copilot]

Pull request overview

Updates Maven dependency versions to address Snyk-reported vulnerabilities in the project’s dependency graph.

Changes:

• Upgrades Logback version property from 1.2.6 to 1.5.25.
• Normalizes Eclipse m2e lifecycle-mapping <ignore> elements to self-closing form.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

logback.version was bumped to 1.5.25, but this POM still pins org.slf4j.version to 1.7.32. Logback 1.3+/1.5.x targets SLF4J 2.x, so forcing SLF4J 1.7 here can lead to dependency convergence problems and runtime failures (e.g., missing provider / NoSuchMethodError). Align the versions by upgrading org.slf4j.version (and related bridges like jcl-over-slf4j) to a compatible 2.x release, or choose a Logback version that remains compatible with SLF4J 1.7.

Suggested change

	<org.slf4j.version>1.7.32</org.slf4j.version>
	<org.slf4j.version>2.0.16</org.slf4j.version>

[Copilot]

The PR description mentions fixing a Commons Codec vulnerability (SNYK-JAVA-COMMONSCODEC-561518), but pom.xml doesn't declare or manage commons-codec anywhere. If the vulnerable version is coming transitively, consider adding an explicit <dependencyManagement> (or direct dependency) entry to pin commons-codec to a non-vulnerable version; otherwise the PR may not actually remediate that issue as described.