Logback version 1.2.9 and 1.3.0-alpha11 have been released simultaneously. They should be considered as security fixes superseding 1.2.8.