I recently update logback-classic and logback-core from version 1.5.8 top version 1.5.15 in order to fix some vulnerabilities. However, after doing that I couldn't start the application and I got the following error:
Caused by: org.springframework.boot.web.server.WebServerException: Unable to start embedded Tomcat
...
Caused by: org.apache.catalina.LifecycleException: Failed to start component [ch.qos.logback.access.tomcat.LogbackValve[null]]
...
Caused by: java.lang.NoClassDefFoundError: ch/qos/logback/core/boolex/JaninoEventEvaluatorBase
I did find out that JaninoEventEvaluatorBase was removed as discussed here, but I still coudln't find a way to fix this error, even after trying to recreate the evaluator.
How can I solve this problem?
Taking a look at the stacktrace I found out that the problem was being originated from the package logback-access at the class LogbackAccessDefaultNestedComponentRegistryRules which was registering JaninoEventEvaluator in version 2.0.3. I tried to update it to 2.0.5, which shouldn't have the line that used janino, but the dependency coudln't be found. Later I found out that it was renamed from ch.qos.logback.access:common to ch.qos.logback.access:logback-access-common.
In the end, the solution was to update logback-access to the new version and the new package name.
implementation("ch.qos.logback.access:common:2.0.3")
implementation("ch.qos.logback.access:tomcat:2.0.3")
to
implementation("ch.qos.logback.access:logback-access-common:2.0.5")
implementation("ch.qos.logback.access:logback-access-tomcat:2.0.5")