Latex Arara is flagged as using log4j, has anyone found out if its a risk? And how to patch/remove it?