Bump slf4j and logback to match Terasology

[soloturn]

AI-assisted change proposal.

Bumps slf4j-api and logback-classic to match Terasology's pins:

• slf4j-api: 1.7.25 -> 2.0.18
• logback-classic: 1.2.3 -> 1.6.0

gestalt-android and gestalt-android-testbed pin slf4j-api strictly back to 1.7.25. logback-android:1.3.0-3 (the latest release compatible with our minSdkVersion 24 - the next release, 3.0.0, requires API 26 and is the only one that supports SLF4J 2.x) predates SLF4J 2.x's provider-discovery mechanism. Pairing it with slf4j-api 2.x wouldn't fail the build, but would silently no-op all logging at runtime (SLF4J 2.x can't find a compatible provider and falls back to NOP with a one-time warning).

Verified locally against a real Android SDK (compileSdk 36, AGP 9.3.1):

• gestalt-android:assembleDebug and gestalt-android-testbed:testDebugUnitTest both pass, with slf4j-api confirmed resolving to 1.7.25 on the Android runtime classpath via dependencyInsight.
• Full JVM test suite: only the 3 known pre-existing failures (SandboxTest/PermissiveSandboxTest/EmbeddedLibraryTest, blocked by SecurityManager removal on newer JDKs, and the flaky ModuleEnvironmentWatcherTest), all reproduced identically against a clean, unmodified develop checkout.

Lockfiles regenerated for every affected module.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 15b8e8e7-2b8f-47c8-91e7-c1193db504bf

📥 Commits

Reviewing files that changed from the base of the PR and between 0c6e948 and 14f2d60.

📒 Files selected for processing (11)

• gestalt-android-testbed/build.gradle
• gestalt-android/build.gradle
• gestalt-asset-core/gradle.lockfile
• gestalt-di/gradle.lockfile
• gestalt-entity-system/gradle.lockfile
• gestalt-es-perf/gradle.lockfile
• gestalt-inject-java/gradle.lockfile
• gestalt-inject/gradle.lockfile
• gestalt-module/gradle.lockfile
• gestalt-util/gradle.lockfile
• settings.gradle.kts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • Improved logging compatibility across Android and JVM environments.
  • Prevented Android logging from being silently disabled by incompatible logging API versions.

• Maintenance

  • Updated Logback and SLF4J components to newer supported versions across development and test configurations.
  • Preserved Android compatibility by keeping its logging API on the compatible 1.7.25 release.

Walkthrough

The PR updates SLF4J and Logback versions in the version catalog and Gradle lockfiles. The Android module and testbed override the catalog with a strict SLF4J API version of 1.7.25.

Changes

Dependency alignment

Layer / File(s)	Summary
Version catalog updates settings.gradle.kts	The catalog updates slf4j-api to 2.0.18 and logback-classic to 1.6.0.
Gradle lockfile updates gestalt-*/gradle.lockfile	The lockfiles update Logback Classic/Core to 1.6.0 and SLF4J API to 2.0.18 across existing configurations.
Android SLF4J pins gestalt-android/build.gradle, gestalt-android-testbed/build.gradle	The Android declarations use a strict slf4j-api version of 1.7.25 instead of the catalog reference.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 14f2d

The dependency updates preserve Android compatibility through the documented SLF4J pin and logback rationale. No actionable merge-blocking risk remains after normal checks and review.

Poem

A rabbit checks the versions in a row
New Logback leaves begin to grow
SLF4J hops through locks with care
Android keeps its older pair
The build files thump: all paths now show

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main dependency upgrades and relates them to Terasology’s pins. It is concise and specific.
Description check	✅ Passed	The description accurately explains the dependency upgrades, Android-specific SLF4J pinning, validation results, and regenerated lockfiles.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (10 skipped: 10 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bump-slf4j-logback

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}