trying to force logback version to prevent vulnerabilities from xuggler

pom.xml

@@ -55,11 +55,21 @@
 
     <!-- Project properties -->
     <properties>
-        <artifact-to-extract>com.xuggle.xuggler</artifact-to-extract>
+        <artifact-to-extract>logback-core,logback-classic,com.xuggle.xuggler</artifact-to-extract>
     </properties>
 
     <!-- List of project's dependencies -->
     <dependencies>
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-core</artifactId>
+            <version>1.4.6</version>
+        </dependency>
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-classic</artifactId>
+            <version>1.4.6</version>
+        </dependency>
         <dependency>
             <groupId>com.liferay</groupId>
             <artifactId>com.xuggle.xuggler</artifactId>
@@ -67,21 +77,6 @@
         </dependency>
     </dependencies>
 
-    <dependencyManagement>
-        <dependencies>
-            <dependency>
-                <groupId>ch.qos.logback</groupId>
-                <artifactId>logback-core</artifactId>
-                <version>1.4.6</version>
-            </dependency>
-            <dependency>
-                <groupId>ch.qos.logback</groupId>
-                <artifactId>logback-classic</artifactId>
-                <version>1.4.6</version>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
-
     <!-- Icy Maven repository (to find parent POM) -->
     <repositories>
         <repository>