BE: upgrade logback to 1.5.16

[yeikel]

What changes did you make? (Give an overview)

Fixes CVE-2024-12798 and CVE-2024-12801 while we wait for the next Spring Boot Release

How Has This Been Tested? (put an "x" (case-sensitive!) next to an item)

• Covered by existing automation
• Manual tests

Cherry-picked 150b7af to test with changes in #745

Without this PR : https://github.com/kafbat/kafka-ui/actions/runs/12760141709/job/35565086663?pr=745

With this PR: https://github.com/kafbat/kafka-ui/actions/runs/12760148833/job/35565105573?pr=773

Checklist (put an "x" (case-sensitive!) next to all the items, otherwise the build will fail)

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas

A picture of a cute animal (not mandatory but encouraged)

[Haarolean]

@yeikel do you mind if we hold this for a few days? We currently have #109 in progress so this will impose merge conflicts, I believe it'd be easier to do this the other way -- to upgrade logback once we migrate to gradle.

[yeikel]

@yeikel do you mind if we hold this for a few days? We currently have #109 in progress so this will impose merge conflicts, I believe it'd be easier to do this the other way -- to upgrade logback once we migrate to gradle.

I am okay to wait

[yeikel]

The only challenge is that the project will remain vulnerable to these CVEs until this upgrade can happen so hopefully we can complete the Gradle migration soon

[Haarolean]

The only challenge is that the project will remain vulnerable to these CVEs until this upgrade can happen so hopefully we can complete the Gradle migration soon

I've been told a few days

[sixdouglas]

Hi @yeikel
Logback has been upgraded to the 1.5.16 version in spring-boot 3.4.2 ( the release note is here )
Maybe bumping Spring Boot would be better than fixing this manually, don't you think?

[yeikel]

Hi @yeikel
Logback has been upgraded to the 1.5.16 version in spring-boot 3.4.2 ( the release note is here )
Maybe bumping Spring Boot would be better than fixing this manually, don't you think?

Yes, much better, actually. At the time, I raised this PR that was still pending

[Haarolean]

@yeikel let's bump spring boot instead?

[yeikel]

@yeikel let's bump spring boot instead?

That works for me.