Why is Autopsy still using Apache Log4J version 1.2.17?

Good Morning,

Why is Autopsy still using/relying on Apache Log4J version 1.2.17?
Apache states it no longer supports or test this version 1.x since 2015.
Apache recommends upgrading to a supported version 2.x.

Respectfully,
DaveR