In my project we are using SBT. We are not directly using log4j but it's being included; probably because one of the libraries we use requires it.
I'm trying to update the code to not use the vulnerable version of log4j but I have no direct control over this import. Is there anything I can do in the build.sbt file to prevent this?
I guess Gradle has some functionality to force this (step 3 here). Does SBT have an equivelant?