fix: logback vulnerability (#1151)

Author: sattvikc

.github/workflows/dev-tag.yml

@@ -56,7 +56,9 @@ jobs:
           with:
             path: ./supertokens-plugin
             repository: supertokens/supertokens-${{ matrix.plugin }}-plugin
-            ref: ${{ fromJson(needs.dependency-versions.outputs.branches)[matrix.plugin] }}  
+            ref: ${{ fromJson(needs.dependency-versions.outputs.branches)[matrix.plugin] }}
+            fetch-depth: 0
+            fetch-tags: true
         - name: Run script
           env:
             SUPERTOKENS_API_KEY: ${{ secrets.SUPERTOKENS_API_KEY }}

CHANGELOG.md

@@ -9,7 +9,7 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [11.0.1]
 
-- Upgrades the embedded tomcat from 11.0.5 to 11.0.6 because of security vulnerabilities
+- Upgrades the embedded tomcat 11.0.6 and logback classic to 1.5.13 because of security vulnerabilities
 
 ## [11.0.0]
 

build.gradle

@@ -42,7 +42,7 @@ dependencies {
     implementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.18.2'
 
     // https://mvnrepository.com/artifact/ch.qos.logback/logback-classic
-    implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.4.14'
+    implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.5.13'
 
     // https://mvnrepository.com/artifact/org.apache.tomcat.embed/tomcat-embed-core
     implementation group: 'org.apache.tomcat.embed', name: 'tomcat-embed-core', version: '11.0.6'

ee/build.gradle

@@ -38,7 +38,7 @@ dependencies {
     testImplementation group: 'org.apache.tomcat.embed', name: 'tomcat-embed-core', version: '11.0.5'
 
     // https://mvnrepository.com/artifact/ch.qos.logback/logback-classic
-    testImplementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.4.14'
+    testImplementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.5.13'
 
     // https://mvnrepository.com/artifact/com.google.code.gson/gson
     testImplementation group: 'com.google.code.gson', name: 'gson', version: '2.13.1'