Move "log4j shadow" to a separate plugin

What feature do you want to see added?

I would like to avoid default shadow-plugin -> log4j-core dependency as it causes CVEs indentified in log4j-core.

Here's an example:

Transitive dependency org.apache.logging.log4j:log4j-core 2.25.3 is introduced via
com.gradleup.shadow:shadow-gradle-plugin 9.4.2  org.apache.logging.log4j:log4j-core 2.25.3

By default, shadow should detect precense of multiple log4j configurations on the classpath and just fail with clear message like "to merge log4j configurations, use the following plugin" or something like that.

Note: in the ideal world, log4j should be designed in such a way that does not require special merger.

The hard dependency on log4j-core is painful for the end-users.

The issue impacts https://github.com/pgjdbc/pgjdbc

Upstream changes

No response

Are you interested in contributing this feature?

I would be willing to contribute the feature if that could be accepted

Start by locating the shadow Gradle plugin's log4j-core dependency and the code that merges log4j configurations. Review how plugin dependencies and configuration detection are tested. Done means the default plugin no longer carries log4j-core, while projects needing the merger can use a separate plugin and receive a clear failure message when multiple configurations are detected.