log4j dependency should be updated to 2.17.1

[dbschwartz]

See https://logging.apache.org/log4j/2.x/security.html

log4j 16.0 is still susceptible to log4shell (although to a lesser scale). The vulnerability is fixed in log4j 2.17.1

Can this be updated?

Thank you