maven - Why would Sonatype IQ scan report Guava vulnerability when 'mvn dependency:tree' does not show Guava at all? - Stack Overflow

Why would Sonatype IQ scan report show (in IntelliJ-IDEA) a Guava vulnerability when mvn dependency:tree does not show Guava at all? Here is my Sonatype scan result, with a Level-7 Critical vulnera

Provides transitive vulnerable dependency maven:com.google.guava:guava :27.0.1-android-CSDN博客

java - The POM for is missing, no dependency information available even though it exists in Maven Repository - Stack Overflow

Open Source Updates, Get Open Source News + Security Updates

History

spring boot - Guava version 16.0 being used during runtime even though 18.0 is used during compile time - Stack Overflow

java - IntelliJ IDEA does not recognise maven dependencies (omitted for conflict with ) - Stack Overflow

Guava (Google Collection Library) dependency missing from maven build file · Issue #174 · zeromq/jeromq · GitHub

SCM Features Technical Overview

Maven surefire plugin not running tests after migrating from Spock 1.2 to 2.0-M2 - Stack Overflow

Maven dependencies not resolved correctly during filesystem scan - properties · Issue #2145 · aquasecurity/trivy · GitHub

Dependency Tree