update dependency to fix CVE-2023-6378 (#4759) (#4771)

Co-authored-by: Zhe Sun <[email protected]>

Author: vaadin-bot

vaadin-spring-boot-starter/pom.xml

@@ -65,8 +65,19 @@
                     <groupId>org.yaml</groupId>
                     <artifactId>snakeyaml</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>ch.qos.logback</groupId>
+                    <artifactId>logback-classic</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
+        <!-- CVE-2023-6378, should be removed after spring-boot fix. 
+        https://github.com/spring-projects/spring-boot/blob/main/spring-boot-project/spring-boot-dependencies/build.gradle#L849  -->
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-classic</artifactId>
+            <version>1.4.12</version>
+        </dependency>
         <!-- End Spring -->
     </dependencies>
 </project>