so since the log4j-issue hit pretty far and wide, I was wondering how to determine the currently used version inside a shadowjar.

I'm creating one fat jar using com.github.jengelman's shadow v5.2 and was not able to figure out which version of log4j or any other classes from multiple .jars (poi, saxon, junit) was used. Of course I have the original .jar's the fat jar is made from, but still I was wondering if there is a way to either display the dependencies that are packed into the shadow jar, or if there is a way to determine their version when the full jar is finished.

So far I couldn't find any way to see inside the jar which version of a class is used, and unfortunately there also seems to be no way to list all the versions while packing the jar.

The actual reason to check the versions is a log4j inside the shadow-folder of the shadow jar. So before I do some byte-diff of the .class-file against the original jar, I was hoping for a nicer solution that might be logging them in the build process, so is there any other way to see what dependecies with which versions went inside it?