dep update, log4j removal