Hacker News Reader

I’ve always used the various log4j adapters and then excluded log4j from the transitive dependencies.

Same. Gradle even lets you configure replacement dependencies, so if anything depends on Log4J it automatically gets the adapter instead.