log4j 1.2.8, 1.2.17

[jason-easterday]

This project still has log4j in it.

It contains version 1.2.17 which comes thru with the use of commons-logging (neptune-export.jar/META-INF/maven/commons-logging/commons-logging/pom.xml)

It also contains version 1.2.8 which comes thru with the use of commons-configuration (neptune-export.jar/META-INF/maven/commons-configuration/commons-configuration/pom.xml)

Why is log4j 1.2.8/17 bad? while it's not log4shell, it still is a component that is just about 7 years out of support and not maintained.

[jason-easterday]

A Sonatype scan has proven to show that it has dependencies that have log4j in it. However, the resulted release may not have it included, it would be nice to see all the dependencies updated to get rid of any older unsupported open source items.