maven - Why would Sonatype IQ scan report Guava vulnerability when 'mvn dependency:tree' does not show Guava at all? - Stack Overflow

Why would Sonatype IQ scan report show (in IntelliJ-IDEA) a Guava vulnerability when mvn dependency:tree does not show Guava at all? Here is my Sonatype scan result, with a Level-7 Critical vulnera

FYP_similartags/RerunKeming/allTags_test.txt at master · lint0011/FYP_similartags · GitHub

History

Manage JAVA dependencies with confidence using Maven BOMs, by Brian NQC

Getting Started with Sonatype Vulnerability Analysis

Displaying the dependency tree for a Maven project

How to identify vulnerable dependencies in a Maven project

September 2010 - devel - Fedora Mailing-Lists

June 2018 - devel - Fedora Mailing-Lists

java - IntelliJ IDEA does not recognise maven dependencies (omitted for conflict with ) - Stack Overflow

spring - NexusIQ scan report - Stack Overflow

maven - Why would Sonatype IQ scan report Guava vulnerability when 'mvn dependency:tree' does not show Guava at all? - Stack Overflow

Continuous Integration with Jenkins Hands-On Solutions - TECH UPDATE

June 2018 - devel - Fedora Mailing-Lists

CSE-190-Assignment-2/Model2_0.02.ipynb at master · Atlrrific/CSE-190-Assignment-2 · GitHub

Provides transitive vulnerable dependency maven:com.google.guava:guava :27.0.1-android-CSDN博客