Logback vulnerabilities in 1.0.6 release

[boroda4436]

Hi! Do you have plans to publish version 1.0.7 on maven? For now, the latest version has logback vulnerabilities

[vladmihalcea]

All the dependencies use <scope>provided</scope>, so they are not transitive.

Therefore, the library doesn't force you to use a dependency that has vulnerabilities as you have to declare all the dependencies explicitly in your project with higher version numbers.

I could do a release, but it will not change anything actually. The Logback version that your application is using is not the one from the db-util, but the one you declared explicitly in your pom.xml file.

[boroda4436]

Great, thanks!

[vladmihalcea]

Fixed. I revised the dependencies and changed the scope of the logback one for test only. There is a single transitive dependency now.