Why does logback have a dependency to audio libraries?

[shi-314]

We have seen an open vulnerability using OWASP checks in logback because of an audio module in logback:
https://nvd.nist.gov/vuln/detail/CVE-2018-14948

The dependency: https://github.com/Trilarion/java-vorbis-support

However, I could not find any documentation on why logback needs this audio module besides of this: https://tersesystems.com/blog/2019/05/18/application-logging-in-java-part-4/

Unfortunately, this tutorial doesn't explain the use case.
Is it really necessary for a logging library to have a dependency to audio libraries?

[shi-314]

Oops, nevermind should have just use the logback dependency directly: https://github.com/qos-ch/logback

[wsargent]

You only have a dependency on audio if you're using the logback-audio module https://github.com/tersesystems/terse-logback/tree/master/logback-audio/