bump log4js version

so callers of one.js don't their console.* polluted.