log4j 1.x is a test-only dependency, we should move off of it due to the continued security issues popping up for log4j. While we are not directly impacted, having this as a dependency alone will be enough to be flagged in specific CVE reporting solutions.