revert logging updates

Author: jeremylong

cli/src/main/java/org/owasp/dependencycheck/App.java

@@ -39,7 +39,6 @@
 import org.owasp.dependencycheck.utils.Settings;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.slf4j.impl.StaticLoggerBinder;
 
 import ch.qos.logback.core.FileAppender;
 import ch.qos.logback.classic.encoder.PatternLayoutEncoder;
@@ -658,8 +657,7 @@ private String getDefaultCveUrlModified(CliParser cli) {
      * @param verboseLog the path to the verbose log file
      */
     private void prepareLogger(String verboseLog) {
-        final StaticLoggerBinder loggerBinder = StaticLoggerBinder.getSingleton();
-        final LoggerContext context = (LoggerContext) loggerBinder.getLoggerFactory();
+        LoggerContext context = (LoggerContext) LoggerFactory.getILoggerFactory();
 
         final PatternLayoutEncoder encoder = new PatternLayoutEncoder();
         encoder.setPattern("%d %C:%L%n%-5level - %msg%n");

pom.xml

@@ -119,8 +119,11 @@ Copyright (c) 2012 - Jeremy Long
 
         <apache.lucene.version>8.11.2</apache.lucene.version>
         <apache.ant.version>1.10.12</apache.ant.version>
-        <slf4j.version>2.0.0</slf4j.version>
+        
+        <!-- upgrading slf4j and logback can cause issues ;) https://github.com/jeremylong/DependencyCheck/issues/4846 -->
+        <slf4j.version>1.7.36</slf4j.version>
         <logback.version>1.2.11</logback.version>
+        
         <!-- Note that Maven will use classes from the distro, ignoring declared dependencies for Maven core... -->
         <maven.api.version>3.1.0</maven.api.version>
         <reporting.checkstyle-plugin.version>3.2.0</reporting.checkstyle-plugin.version>