upgrade commons-io
upgrade logback
drop cglib dep which is now inlined in spring