I'm using a gradle project, with guava version defined in repo.build.gradle as 32.0.0-jre but guava version 18 is being detected in the scan reports for the docker image of the repo, for the war file created in a module(core) within the repo(containing libraries of core module) and it(version 18 of guava) is not detected in the dependency tree.Any suggestions on how to find guava v18 is a transitive dependency for which library?
This is how the depency is defined in the repo.build.gradle
configurations.all {
resolutionStrategy {
dependencySubstitution {
substitute module('ch.qos.logback:logback-classic') using module("org.apache.logging.log4j:log4j-slf4j-impl:${log4jVersion}")
substitute module('ch.qos.logback:logback-core') using module("org.apache.logging.log4j:log4j-slf4j-impl:${log4jVersion}")
substitute module('org.slf4j:log4j-over-slf4j') using module("org.apache.logging.log4j:log4j-1.2-api:${log4jVersion}")
}
.
.
force 'com.google.guava:guava:32.0.0-jre'
force 'org.glassfish.jaxb:jaxb-runtime:2.3.8'
.
.
}
allprojects {
dependency{
implementation "com.google.guava:guava:32.0.0-jre"
}
}
force 'com.google.guava:guava:32.0.0-jre' I also excluded guava module from other libraries that were importing an older version of guava as per dependency tree.