[Snyk] Fix for 1 vulnerabilities

[ayusuf-mq]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• samples/server/petstore/jaxrs-cxf-annotated-base-path/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	External Initialization of Trusted Variables or Data Stores SNYK-JAVA-CHQOSLOGBACK-15062482	290	ch.qos.logback:logback-classic: 1.2.0 -> 1.5.25 ch.qos.logback:logback-core: 1.2.0 -> 1.5.25 No Path Found No Known Exploit

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[ayusuf-mq]

This major version upgrade from 1.2.0 to 1.5.25 introduces significant breaking changes, including a required JDK and SLF4J version bump, which can cause logging to fail if not addressed.

Highlights:

• Java & SLF4J Version: The minimum required Java version is now 11 (up from 8), and the required SLF4J version is 2.0.x (up from 1.7.x). Mismatched SLF4J versions may cause logging to stop working.
• Jakarta EE Namespace: Optional components like <code>SMTPAppender</code> now use the <code>jakarta.</code> namespace instead of <code>javax.</code>, requiring import updates for applications using them.
• Configuration Internals: The internal configuration system (Joran) was rewritten in version 1.3. While most standard XML configurations are compatible, any code that programmatically interacts with Joran will need to be adapted.

Source: Logback documentation
Recommendation: Before merging, ensure the project uses Java 11+ and update the SLF4J dependency to the 2.0.x series. Review code for any use of optional components or programmatic configuration that may need updates.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[ayusuf-mq]

This major version upgrade from 1.2.0 to 1.5.25 introduces significant breaking changes, including new runtime and dependency requirements, and API modifications.

Highlights:

• Java and SLF4J Upgrade Required: Logback 1.4.x and 1.5.x require Java 11 and SLF4J 2.0.x at runtime, an increase from Java 8 for Logback 1.3.x. Applications must be updated to meet these new baseline requirements.
• Javax to Jakarta Namespace: For applications using optional components like SMTPAppender, the dependency namespace has changed from Java EE (javax.*) in version 1.3.x to Jakarta EE (jakarta.*) in versions 1.4.x and 1.5.x.

Source: Logback documentation
Recommendation: Update the JDK to version 11 or higher and the SLF4J dependency to the 2.0.x series. Verify and update any code using optional components for the new Jakarta EE namespace. Thoroughly test logging configurations and programmatic usage before merging.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.