Every sprint has a ticket that says “upgrade log4j”. It is four years old. Close it this week without touching a single import.