Stick to SLF4J 1.7.x

And logback 1.2.x (for the test suite).

Bumping SLF4J to 2.0 will require users to bump their bindings as well,
making the upgrade a breaking change.

Users are still free to include their own version of SLF4J.

See https://www.slf4j.org/faq.html#changesInVersion200

Author: acogoluegnes

.github/dependabot.yml

@@ -11,6 +11,10 @@ updates:
     ignore:
       - dependency-name: "org.eclipse.jetty:jetty-servlet"
         versions: [ "[10.0,)" ]
+      - dependency-name: "org.slf4j:slf4j-api"
+        versions: [ "[2.0,)" ]
+      - dependency-name: "ch.qos.logback:logback-classic"
+        versions: [ "[1.3,)" ]
   - package-ecosystem: "maven"
     directory: "/"
     schedule:
@@ -20,3 +24,9 @@ updates:
     ignore:
       - dependency-name: "org.eclipse.jetty:jetty-servlet"
         versions: ["[10.0,)"]
+      - dependency-name: "org.eclipse.jetty:jetty-servlet"
+        versions: [ "[10.0,)" ]
+      - dependency-name: "org.slf4j:slf4j-api"
+        versions: [ "[2.0,)" ]
+      - dependency-name: "ch.qos.logback:logback-classic"
+        versions: [ "[1.3,)" ]

pom.xml

@@ -54,12 +54,12 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 
-    <slf4j.version>2.0.0</slf4j.version>
+    <slf4j.version>1.7.36</slf4j.version>
     <metrics.version>4.2.11</metrics.version>
     <micrometer.version>1.9.3</micrometer.version>
     <opentelemetry.version>1.17.0</opentelemetry.version>
     <jackson.version>2.13.3</jackson.version>
-    <logback.version>1.4.0</logback.version>
+    <logback.version>1.2.11</logback.version>
     <junit.version>4.13.2</junit.version>
     <mockito.version>4.7.0</mockito.version>
     <assertj.version>3.23.1</assertj.version>