another log4j update