4.0.0-M3 is using logback-core 1.5.18 (with a CVE)

[fleboulch]

From spring boot 3.5.7

[INFO] \- org.springframework.boot:spring-boot-starter-data-jpa:jar:3.5.7:compile
[INFO]    \- org.springframework.boot:spring-boot-starter:jar:3.5.7:compile
[INFO]       \- org.springframework.boot:spring-boot-starter-logging:jar:3.5.7:compile
[INFO]          \- ch.qos.logback:logback-classic:jar:1.5.20:compile
[INFO]             \- ch.qos.logback:logback-core:jar:1.5.20:compile

To SB 4.0.0-M3

[INFO] \- org.springframework.boot:spring-boot-starter-data-jpa:jar:4.0.0-M3:compile
[INFO]    \- org.springframework.boot:spring-boot-starter:jar:4.0.0-M3:compile
[INFO]       \- org.springframework.boot:spring-boot-starter-logging:jar:4.0.0-M3:compile
[INFO]          \- ch.qos.logback:logback-classic:jar:1.5.18:compile
[INFO]             \- ch.qos.logback:logback-core:jar:1.5.18:compile

There is a downgrade on the logback dependency (from 1.5.20 to 1.5.18) which contains a CVE

[mp911de]

This has been fixed with Spring Boot 4.0 RC1. Also, the dependency is being introduced by the spring-boot-starter-logging artifact.