build(deps): patch test-only Logback dependencies

[jbeckwith-oai]

Summary

• constrain the Spring Boot starter's test-only Logback classic/core dependencies to 1.2.13
• keep the starter on Spring Boot 2.7, SLF4J 1.7, and the existing Java 8 runtime target

This addresses Dependabot alerts #21, #22, and #23.

Why

Spring Boot 2.7.18 resolves Logback 1.2.12, which is affected by CVE-2023-6378 and CVE-2023-6481.

The newer Logback 1.3/1.5 fixes are intentionally out of scope because they require the SLF4J 2 and Java 11 ecosystem. Logback 1.2.13 is the narrow patch compatible with Spring Boot 2.7 and SLF4J 1.7.

Spring Expression alert #29 was removed from this PR after review showed that a library-side constraint cannot reliably override an application's own Spring Boot 2.7 dependency-management rules for both Maven and Gradle consumers. It should be handled separately as part of a broader Spring Boot upgrade or an explicit consumer-level override.

Compatibility

• Logback remains test-only and does not appear in Maven or Gradle publication metadata.
• No source, binary API, runtime dependency, or artifact dependency scope changes.
• Real Spring Boot startup and auto-configuration tests pass with Logback 1.2.13.

Validation

• dependency insight for Logback classic/core on test compile/runtime classpaths
• generated Maven POM and Gradle module metadata inspection
• focused Spring Boot starter tests
• ./scripts/lint
• ./scripts/build --rerun-tasks
• ./scripts/test --rerun-tasks
• older-Jackson compatibility suite
• ProGuard and R8 tests

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 16.814s for Java SDK PR #806.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	233ms
tests/chat-completions-create.test.ts	✅ Passed	733ms
tests/chat-completions-stream.test.ts	✅ Passed	405ms
tests/files-content-binary.test.ts	✅ Passed	199ms
tests/files-create-multipart.test.ts	✅ Passed	277ms
tests/files-list-pagination.test.ts	✅ Passed	277ms
tests/initialize-config.test.ts	✅ Passed	265ms
tests/instance-isolation.test.ts	✅ Passed	183ms
tests/models-list.test.ts	✅ Passed	185ms
tests/responses-background-lifecycle.test.ts	✅ Passed	393ms
tests/responses-body-method-errors.test.ts	✅ Passed	528ms
tests/responses-cancel-timeout.test.ts	✅ Passed	296ms
tests/responses-cancel.test.ts	✅ Passed	364ms
tests/responses-compact-retries.test.ts	✅ Passed	375ms
tests/responses-compact.test.ts	✅ Passed	265ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	259ms
tests/responses-create-advanced.test.ts	✅ Passed	1.271s
tests/responses-create-disconnect.test.ts	✅ Passed	1.112s
tests/responses-create-errors.test.ts	✅ Passed	309ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	306ms
tests/responses-create-retries.test.ts	✅ Passed	262ms
tests/responses-create-stream-failures.test.ts	✅ Passed	249ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	284ms
tests/responses-create-stream-wire.test.ts	✅ Passed	6.46s
tests/responses-create-stream.test.ts	✅ Passed	485ms
tests/responses-create-terminal-states.test.ts	✅ Passed	423ms
tests/responses-create-timeout.test.ts	✅ Passed	301ms
tests/responses-create.test.ts	✅ Passed	865ms
tests/responses-delete.test.ts	✅ Passed	270ms
tests/responses-input-items-errors.test.ts	✅ Passed	293ms
tests/responses-input-items-list.test.ts	✅ Passed	339ms
tests/responses-input-items-options.test.ts	✅ Passed	265ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	250ms
tests/responses-input-tokens-count.test.ts	✅ Passed	305ms
tests/responses-malformed-inputs.test.ts	✅ Passed	5.185s
tests/responses-not-found-errors.test.ts	✅ Passed	461ms
tests/responses-parse.test.ts	✅ Passed	613ms
tests/responses-retrieve-retries.test.ts	✅ Passed	470ms
tests/responses-retrieve.test.ts	✅ Passed	313ms
tests/responses-stored-method-errors.test.ts	✅ Passed	923ms
tests/retry-behavior.test.ts	✅ Passed	3.532s
tests/sdk-error-shape.test.ts	✅ Passed	481ms

View OkTest run #29779627793

_{SDK merge (90bb1cadaf09) · head (d9cf1e49d35b) · base (f42d1fb61a15) · OkTest (38f2e7c0559b)}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d8cbdc427e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[HAYDEN-OAI]

looks good — i rechecked the narrowed current head and confirmed the spring expression constraint is gone; the logback constraints resolve only on the starter test classpaths and stay out of the pom, gradle module metadata, and runtime classpath.