maven - Why would Sonatype IQ scan report Guava vulnerability when 'mvn dependency:tree' does not show Guava at all? - Stack Overflow

Why would Sonatype IQ scan report show (in IntelliJ-IDEA) a Guava vulnerability when mvn dependency:tree does not show Guava at all? Here is my Sonatype scan result, with a Level-7 Critical vulnera

java - Why is the Guava library included with Vaadin 14 not appearing on my project's classpath? - Stack Overflow

java - Failed to read artifact descriptor for com.google.guava (nexus) - Stack Overflow

jar - java.lang.NoClassDefFoundError: com/fasterxml/jackson/core/JsonFactory - Stack Overflow

java - The POM for is missing, no dependency information available even though it exists in Maven Repository - Stack Overflow

June 2018 - devel - Fedora Mailing-Lists

June 2018 - devel - Fedora Mailing-Lists

Maven Dependencies Pop Quiz – Results – Andres Almiray

Manage JAVA dependencies with confidence using Maven BOMs, by Brian NQC

Solved SOFTWARE SECURITY QUESTION (JAVA, ECLIPSE) Next

android - Red squiggly line in Maven dependency list in IntelliJ - where do I start debugging? - Stack Overflow

June 2018 - devel - Fedora Mailing-Lists

spring boot - Guava version 16.0 being used during runtime even though 18.0 is used during compile time - Stack Overflow

android - Could not resolve com.google.guava:guava:30.1-jre - Gradle project sync failed. Basic functionality will not work properly - in kotlin project - Stack Overflow

maven - Why would Sonatype IQ scan report Guava vulnerability when 'mvn dependency:tree' does not show Guava at all? - Stack Overflow