Even if you don't use l4j in your project, you are likely to use something that uses it; a transient dependency.