log4j-api -> conflicting versions coming from 3rd party or transitive dependencies

[adamkobor]

It might be a silly question, or it's possible that there is already a well-known workaround/fix for this issue, but there is a problem we can't figure out for a while now:
Since a lot of libraries out there started to migrate to use the the 2.x.x versions of org.slf4j:slf4j-api, we have to be super careful when we're bumping dependency versions, because Micronaut still depends on 1.7.36 and having different versions on the classpath ends in the following:

SLF4J: No SLF4J providers were found.
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See https://www.slf4j.org/codes.html#noProviders for further details.
SLF4J: Class path contains SLF4J bindings targeting slf4j-api versions 1.7.x or earlier.

Despite the error above the applications starts normally, except the fact that there are no logs anymore. What I don't understand is that if it's a dependency configuration issue of the 3rd party/transitive dependencies, or is this a configuration issue on our side, because we have a fairly basic setup in every affected project with logback (following the guidelines of Micronaut's docs).

Could you help me understand what is the correct way to handle this issue if it's even possible? Or should we just stick to the current dependency versions until Micronaut will be migrated to use the 2.x.x version of slf4j-api?