maven - Why would Sonatype IQ scan report Guava vulnerability when 'mvn dependency:tree' does not show Guava at all? - Stack Overflow

Why would Sonatype IQ scan report show (in IntelliJ-IDEA) a Guava vulnerability when mvn dependency:tree does not show Guava at all? Here is my Sonatype scan result, with a Level-7 Critical vulnera

Dependency Tree

java - IntelliJ IDEA does not recognise maven dependencies (omitted for conflict with ) - Stack Overflow

June 2018 - devel - Fedora Mailing-Lists

Environment confusion - Atlassian Developer Tools - The Atlassian Developer Community

jar - java.lang.NoClassDefFoundError: com/fasterxml/jackson/core/JsonFactory - Stack Overflow

IQ Server vulnerability information contains the Root Cause – Sonatype Support

Getting Started with Sonatype Vulnerability Analysis

Sonatype Nexus: build smarter, fix faster, be secure - Amazic

Unnecessary-looking dependencies · Issue #2824 · google/guava · GitHub

Some Maven dependencies are absent · Issue #95 · jfrog/jfrog-vscode-extension · GitHub

Chii Sakai - OSCHINA - 中文开源技术交流社区

CS544_Project/tag_count.txt at master · weichenzhao/CS544_Project · GitHub

spring - NexusIQ scan report - Stack Overflow

Maven dependencies not resolved correctly during filesystem scan - properties · Issue #2145 · aquasecurity/trivy · GitHub