Fix logback serialization vulnerability (#88)

Signed-off-by: munishchouhan <[email protected]>
Signed-off-by: Paolo Di Tommaso <[email protected]>
Co-authored-by: Paolo Di Tommaso <[email protected]>

Author: munishchouhan

app/conf/reflect-config.json

@@ -17,6 +17,10 @@
   "queryAllPublicMethods":true,
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"ch.qos.logback.classic.joran.SerializedModelConfigurator",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"ch.qos.logback.classic.pattern.DateConverter",
   "methods":[{"name":"<init>","parameterTypes":[] }]
@@ -41,6 +45,10 @@
   "name":"ch.qos.logback.classic.pattern.ThreadConverter",
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"ch.qos.logback.classic.util.DefaultJoranConfigurator",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"ch.qos.logback.core.ConsoleAppender",
   "queryAllPublicMethods":true,

app/conf/resource-config.json

@@ -26,8 +26,12 @@
     "pattern":"\\Qcom/knuddels/jtokkit/cl100k_base.tiktoken\\E"
   }, {
     "pattern":"\\Qio/seqera/wave/cli/usage-examples.txt\\E"
+  }, {
+    "pattern":"\\Qlogback-test.scmo\\E"
   }, {
     "pattern":"\\Qlogback-test.xml\\E"
+  }, {
+    "pattern":"\\Qlogback.scmo\\E"
   }, {
     "pattern":"\\Qlogback.xml\\E"
   }, {

buildSrc/src/main/groovy/io.seqera.wave.cli.java-common-conventions.gradle

@@ -18,11 +18,12 @@ dependencies {
         implementation 'org.apache.commons:commons-text:1.9'
     }
 
-    implementation "org.slf4j:jcl-over-slf4j:2.0.7"
-    implementation "org.slf4j:jul-to-slf4j:2.0.7"
-    implementation "org.slf4j:log4j-over-slf4j:2.0.7"
-    implementation "ch.qos.logback:logback-classic:1.4.6"
-    implementation "ch.qos.logback:logback-core:1.4.6"
+    implementation "org.slf4j:slf4j-api:2.0.16"
+    implementation "org.slf4j:jcl-over-slf4j:2.0.16"
+    implementation "org.slf4j:jul-to-slf4j:2.0.16"
+    implementation "org.slf4j:log4j-over-slf4j:2.0.16"
+    implementation "ch.qos.logback:logback-classic:1.5.12"
+    implementation "ch.qos.logback:logback-core:1.5.12"
 
     // Use JUnit Jupiter for testing.
     testImplementation 'org.junit.jupiter:junit-jupiter:5.9.1'