Gradle dependency on classpath but not dependency tree?

Question

I am currently upgrading an app from a lower level of Spring to 5.3.15 (as well as other jars as needed) plus making the code compatible with Java 11. However, I am having an issue with javax.xml.namespace.QName because it is finding multiple sources on the classpath: java 11 and javax.xml.stream:stax-api

BUT - stax-api isn't in the dependency tree, so how do I remove it from the classpath? is it a hidden dependency?

build.grade:

apply plugin: 'java'
apply plugin: "war"
apply plugin: 'eclipse'
apply plugin: 'com.bmuschko.tomcat'

webAppDirName = 'web'

war {
    baseName = 'VMT'
    }
    
configurations {
   provided
}


sourceCompatibility = 11
targetCompatibility = 11

buildscript {
  repositories {
    gradlePluginPortal()
    mavenCentral()
    maven {
        url 'https://repo.maven.apache.org/'
    }
  }
  dependencies {
    classpath 'com.bmuschko:gradle-tomcat-plugin:2.7.0'
  }
}

sourceSets {
    main{
        java {
            srcDir 'src/main/java'
        }
        resources {
            srcDir 'src/main/resources'
            include 'log4j2.xml'
        }
    }
}

task main(type: Test) {
    description = "Runs JAVA main"
    testClassesDirs = project.sourceSets.main.output.classesDirs
    classpath += sourceSets.main.runtimeClasspath
 }


repositories {
    gradlePluginPortal()
    mavenCentral()
    maven {
        url 'https://repo.maven.apache.org/'
    }
}

dependencies {
    def tomcatVersion = '8.0.44'
    def log4j2Version = '+' // Use at least 2.16.0 due to RCE vuln
    def springVersion = '4.2.9.RELEASE'
     
    implementation files('web/WEB-INF/classes')

    implementation group: 'com.oracle.database.jdbc', name: 'ojdbc8', version: '21.5.0.0'
    implementation group: 'commons-codec', name: 'commons-codec', version: '1.15'
    implementation group: 'org.apache.commons', name: 'commons-collections4', version: '4.4' //3.2.1
    implementation group: 'commons-io', name: 'commons-io', version: '2.11.0' //replacing commons-io2.4
    implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.12.0'
    

    implementation group: 'org.antlr', name: 'antlr4-runtime', version: '4.9.3' //2.7.7
    implementation group: 'org.apache.axis', name: 'axis', version: '1.4' //upgrade to 2
    implementation group: 'com.mchange', name: 'c3p0', version: '0.9.5.5' //0.9.2.1
    implementation group: 'jakarta.enterprise', name: 'jakarta.enterprise.cdi-api', version: '4.0.0-RC5' //cdi-api-1.1
    implementation group: 'org.dom4j', name: 'dom4j', version: '2.1.3' //1.6.1
    implementation group: 'org.ehcache', name: 'ehcache', version: '3.10.0'
    implementation group: 'jakarta.el', name: 'jakarta.el-api', version: '5.0.0-RC1' //el-api-2.2.
    implementation group: 'com.google.code.gson', name: 'gson', version: '2.9.0' //2.6.2
    implementation group: 'com.fasterxml.jackson.core', name: 'jackson-annotations', version: '2.13.2' //2.1.5
    implementation group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: '2.13.2' //2.1.5
    implementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.13.2.2' //2.1.5
    implementation group: 'org.apache.poi', name: 'poi', version: '5.2.2' //3.9
    implementation group: 'org.apache.poi', name: 'poi-ooxml', version: '5.2.2' //3.9
    implementation group: 'org.apache.poi', name: 'poi-ooxml-schemas', version: '4.1.2' //3.9
    runtimeOnly group: 'org.apache.taglibs', name: 'taglibs-standard-impl', version: '1.2.5'
    implementation group: 'wsdl4j', name: 'wsdl4j', version: '1.6.3'
    implementation group: 'org.apache.xmlbeans', name: 'xmlbeans', version: '5.0.3' //2.3.0
    

    implementation group: 'jakarta.xml.bind', name: 'jakarta.xml.bind-api', version: '2.3.3'
    implementation group: 'jakarta.xml.ws', name: 'jakarta.xml.ws-api', version: '3.0.1'
    implementation group: 'jakarta.activation', name: 'jakarta.activation-api', version: '2.1.0'
    implementation group: 'jakarta.annotation', name: 'jakarta.annotation-api', version: '2.1.0' //'1.3.2'
    implementation group: 'jakarta.servlet', name: 'jakarta.servlet-api', version: '5.0.0'
    implementation group: 'jakarta.xml.bind', name: 'jakarta.xml.bind-api', version: '3.0.1' //'2.3.3'
    implementation group: 'jakarta.xml.ws', name: 'jakarta.xml.ws-api', version: '3.0.1' 
    implementation group: 'jakarta.inject', name: 'jakarta.inject-api', version: '2.0.1' //javax.inject-1
    implementation group: 'jakarta.servlet.jsp.jstl', name: 'jakarta.servlet.jsp.jstl-api', version: '2.0.0'
    implementation group: 'jakarta.servlet', name: 'jakarta.servlet-api', version: '5.0.0'
    
        
    implementation group: 'com.sun.xml.bind', name: 'jaxb-core', version: '2.3.0'
    implementation (group: 'com.sun.xml.rpc', name: 'jaxrpc-impl', version: '1.1.6') 
    
    
    implementation group: 'org.apache.logging.log4j', name: 'log4j-api', version: "${log4j2Version}"
    implementation group: 'org.apache.logging.log4j', name: 'log4j-core', version: "${log4j2Version}"   
    implementation group: 'org.apache.logging.log4j', name: 'log4j-jcl', version: "${log4j2Version}"
    implementation group: 'org.apache.logging.log4j', name: 'log4j-jdbc-dbcp2', version: "${log4j2Version}"
    implementation group: 'org.apache.logging.log4j', name: 'log4j-jul', version: "${log4j2Version}"
    implementation group: 'org.apache.logging.log4j', name: 'log4j-spring-boot', version: "${log4j2Version}"
    implementation group: 'org.springframework', name: 'spring-aop', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-aspects', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-beans', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-core', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-context', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-context-support', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-expression', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-instrument', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-instrument-tomcat', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-jdbc', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-jms', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-messaging', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-orm', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-oxm', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-test', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-tx', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-web', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-webmvc', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-webmvc-portlet', version: "${springVersion}"
    implementation group: 'org.springframework', name: 'spring-websocket', version: "${springVersion}"
    implementation group: 'org.springframework.security', name: 'spring-security-config', version: "${springVersion}" //3.1.3.RELEASE
    implementation group: 'org.springframework', name: 'spring-dao', version: "2.0.8" //"${springVersion}" //2.0
    implementation group: 'org.hibernate.common', name: 'hibernate-commons-annotations', version: '6.0.0.Final'
    implementation group: 'org.hibernate.javax.persistence', name: 'hibernate-jpa-2.1-api', version: '1.0.2.Final'
    implementation group: 'org.hibernate.orm', name: 'hibernate-core', version: '6.0.0.Final'
    implementation group: 'org.hibernate.orm', name: 'hibernate-c3p0', version: '6.0.0.Final'
    

    implementation  group: 'com.sun.mail', name: 'javax.mail', version: '1.5.1'
    implementation "org.apache.tomcat:tomcat-catalina:${tomcatVersion}"
    implementation "org.apache.tomcat:tomcat-util:${tomcatVersion}"
    implementation "org.apache.tomcat:tomcat-jasper:${tomcatVersion}"
    implementation "org.apache.tomcat:tomcat-juli:${tomcatVersion}"
    tomcat "org.apache.tomcat.embed:tomcat-embed-core:${tomcatVersion}",
           "org.apache.tomcat.embed:tomcat-embed-logging-juli:${tomcatVersion}",
           "org.apache.tomcat.embed:tomcat-embed-jasper:${tomcatVersion}"
}

tomcat {
  httpPort = 8090
  stopPort = 8091
  contextPath = '/'
}

output of gradle -q dependencies:

compileClasspath - Compile classpath for source set 'main'.
+--- com.oracle.database.jdbc:ojdbc8:21.5.0.0
+--- commons-codec:commons-codec:1.15
+--- org.apache.commons:commons-collections4:4.4
+--- commons-io:commons-io:2.11.0
+--- org.apache.commons:commons-lang3:3.12.0
+--- org.antlr:antlr4-runtime:4.9.3
+--- org.apache.axis:axis:1.4
+--- com.mchange:c3p0:0.9.5.5
|    \--- com.mchange:mchange-commons-java:0.2.19
+--- jakarta.enterprise:jakarta.enterprise.cdi-api:4.0.0-RC5
|    +--- jakarta.enterprise:jakarta.enterprise.lang-model:4.0.0-RC5
|    +--- jakarta.annotation:jakarta.annotation-api:2.1.0-B1 -> 2.1.0
|    +--- jakarta.el:jakarta.el-api:5.0.0-RC1
|    +--- jakarta.interceptor:jakarta.interceptor-api:2.1.0-RC3
|    \--- jakarta.inject:jakarta.inject-api:2.0.1
+--- org.dom4j:dom4j:2.1.3
+--- org.ehcache:ehcache:3.10.0
|    +--- javax.cache:cache-api:1.1.0
|    +--- org.slf4j:slf4j-api:1.7.25
|    \--- org.glassfish.jaxb:jaxb-runtime:[2.2,3) -> 3.0.2
|         +--- com.sun.activation:jakarta.activation:2.0.1
|         \--- org.glassfish.jaxb:jaxb-core:3.0.2
|              +--- jakarta.xml.bind:jakarta.xml.bind-api:3.0.1
|              |    \--- com.sun.activation:jakarta.activation:2.0.1
|              +--- com.sun.activation:jakarta.activation:2.0.1
|              +--- org.glassfish.jaxb:txw2:3.0.2
|              \--- com.sun.istack:istack-commons-runtime:4.0.1
+--- jakarta.el:jakarta.el-api:5.0.0-RC1
+--- com.google.code.gson:gson:2.9.0
+--- com.fasterxml.jackson.core:jackson-annotations:2.13.2
+--- com.fasterxml.jackson.core:jackson-core:2.13.2
+--- com.fasterxml.jackson.core:jackson-databind:2.13.2.2
|    +--- com.fasterxml.jackson.core:jackson-annotations:2.13.2
|    \--- com.fasterxml.jackson.core:jackson-core:2.13.2
+--- org.apache.poi:poi:5.2.2
|    +--- commons-codec:commons-codec:1.15
|    +--- org.apache.commons:commons-collections4:4.4
|    +--- org.apache.commons:commons-math3:3.6.1
|    +--- commons-io:commons-io:2.11.0
|    +--- com.zaxxer:SparseBitSet:1.2
|    \--- org.apache.logging.log4j:log4j-api:2.17.2
+--- org.apache.poi:poi-ooxml:5.2.2
|    +--- org.apache.poi:poi:5.2.2 (*)
|    +--- org.apache.poi:poi-ooxml-lite:5.2.2
|    |    \--- org.apache.xmlbeans:xmlbeans:5.0.3
|    |         \--- org.apache.logging.log4j:log4j-api:2.17.1 -> 2.17.2
|    +--- org.apache.xmlbeans:xmlbeans:5.0.3 (*)
|    +--- org.apache.commons:commons-compress:1.21
|    +--- commons-io:commons-io:2.11.0
|    +--- com.github.virtuald:curvesapi:1.07
|    +--- org.apache.logging.log4j:log4j-api:2.17.2
|    \--- org.apache.commons:commons-collections4:4.4
+--- org.apache.poi:poi-ooxml-schemas:4.1.2
|    \--- org.apache.xmlbeans:xmlbeans:3.1.0 -> 5.0.3 (*)
+--- wsdl4j:wsdl4j:1.6.3
+--- org.apache.xmlbeans:xmlbeans:5.0.3 (*)
+--- jakarta.xml.bind:jakarta.xml.bind-api:2.3.3 -> 3.0.1 (*)
+--- jakarta.xml.ws:jakarta.xml.ws-api:3.0.1
|    +--- jakarta.xml.bind:jakarta.xml.bind-api:3.0.1 (*)
|    +--- jakarta.xml.soap:jakarta.xml.soap-api:2.0.1
|    |    \--- com.sun.activation:jakarta.activation:2.0.1
|    \--- jakarta.jws:jakarta.jws-api:3.0.0
+--- jakarta.activation:jakarta.activation-api:2.1.0
+--- jakarta.annotation:jakarta.annotation-api:2.1.0
+--- jakarta.servlet:jakarta.servlet-api:5.0.0
+--- jakarta.xml.bind:jakarta.xml.bind-api:3.0.1 (*)
+--- jakarta.inject:jakarta.inject-api:2.0.1
+--- jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api:2.0.0
|    +--- jakarta.servlet:jakarta.servlet-api:5.0.0
|    +--- jakarta.el:jakarta.el-api:4.0.0 -> 5.0.0-RC1
|    \--- jakarta.xml.bind:jakarta.xml.bind-api:3.0.0 -> 3.0.1 (*)
+--- com.sun.xml.bind:jaxb-core:2.3.0
+--- com.sun.xml.rpc:jaxrpc-impl:1.1.6
|    +--- jakarta.servlet:jakarta.servlet-api:4.0.2 -> 5.0.0
|    +--- jakarta.xml.rpc:jakarta.xml.rpc-api:1.1.3
|    +--- com.sun.xml.messaging.saaj:saaj-impl:1.5.1
|    |    +--- jakarta.xml.bind:jakarta.xml.bind-api:2.3.2 -> 3.0.1 (*)
|    |    +--- jakarta.xml.soap:jakarta.xml.soap-api:1.4.1 -> 2.0.1 (*)
|    |    +--- org.jvnet.mimepull:mimepull:1.9.11
|    |    \--- org.jvnet.staxex:stax-ex:1.8.1
|    |         \--- jakarta.xml.bind:jakarta.xml.bind-api:2.3.2 -> 3.0.1 (*)
|    +--- com.sun.xml.fastinfoset:FastInfoset:1.2.16
|    +--- com.sun.mail:jakarta.mail:1.6.3
|    |    \--- com.sun.activation:jakarta.activation:1.2.1 -> 2.0.1
|    \--- com.sun.xml.rpc:jaxrpc-spi:1.1.6
|         +--- jakarta.servlet:jakarta.servlet-api:4.0.2 -> 5.0.0
|         \--- jakarta.xml.rpc:jakarta.xml.rpc-api:1.1.3
+--- org.apache.logging.log4j:log4j-api:+ -> 2.17.2
+--- org.apache.logging.log4j:log4j-core:+ -> 2.17.2
|    \--- org.apache.logging.log4j:log4j-api:2.17.2
+--- org.apache.logging.log4j:log4j-jcl:+ -> 2.17.2
|    +--- commons-logging:commons-logging:1.2
|    \--- org.apache.logging.log4j:log4j-api:2.17.2
+--- org.apache.logging.log4j:log4j-jdbc-dbcp2:+ -> 2.17.2
|    +--- org.apache.logging.log4j:log4j-core:2.17.2 (*)
|    \--- org.apache.commons:commons-dbcp2:2.9.0
|         +--- org.apache.commons:commons-pool2:2.10.0
|         \--- commons-logging:commons-logging:1.2
+--- org.apache.logging.log4j:log4j-jul:+ -> 2.17.2
|    \--- org.apache.logging.log4j:log4j-api:2.17.2
+--- org.apache.logging.log4j:log4j-spring-boot:+ -> 2.17.2
|    +--- org.junit.vintage:junit-vintage-engine:5.7.2
|    |    +--- org.apiguardian:apiguardian-api:1.1.0
|    |    +--- org.junit.platform:junit-platform-engine:1.7.2
|    |    |    +--- org.apiguardian:apiguardian-api:1.1.0
|    |    |    +--- org.opentest4j:opentest4j:1.2.0
|    |    |    \--- org.junit.platform:junit-platform-commons:1.7.2
|    |    |         \--- org.apiguardian:apiguardian-api:1.1.0
|    |    \--- junit:junit:4.13
|    |         \--- org.hamcrest:hamcrest-core:1.3
|    +--- org.junit.jupiter:junit-jupiter-engine:5.7.2
|    |    +--- org.apiguardian:apiguardian-api:1.1.0
|    |    +--- org.junit.platform:junit-platform-engine:1.7.2 (*)
|    |    \--- org.junit.jupiter:junit-jupiter-api:5.7.2
|    |         +--- org.apiguardian:apiguardian-api:1.1.0
|    |         +--- org.opentest4j:opentest4j:1.2.0
|    |         \--- org.junit.platform:junit-platform-commons:1.7.2 (*)
|    +--- org.junit.jupiter:junit-jupiter-api:5.7.2 (*)
|    +--- org.springframework.boot:spring-boot:2.5.7
|    |    +--- org.springframework:spring-core:5.3.13 -> 5.3.15
|    |    |    \--- org.springframework:spring-jcl:5.3.15
|    |    \--- org.springframework:spring-context:5.3.13 -> 5.3.15
|    |         +--- org.springframework:spring-aop:5.3.15
|    |         |    +--- org.springframework:spring-beans:5.3.15
|    |         |    |    \--- org.springframework:spring-core:5.3.15 (*)
|    |         |    \--- org.springframework:spring-core:5.3.15 (*)
|    |         +--- org.springframework:spring-beans:5.3.15 (*)
|    |         +--- org.springframework:spring-core:5.3.15 (*)
|    |         \--- org.springframework:spring-expression:5.3.15
|    |              \--- org.springframework:spring-core:5.3.15 (*)
|    +--- org.springframework:spring-context:5.3.15 (*)
|    +--- org.springframework:spring-context-support:5.3.15
|    |    +--- org.springframework:spring-beans:5.3.15 (*)
|    |    +--- org.springframework:spring-context:5.3.15 (*)
|    |    \--- org.springframework:spring-core:5.3.15 (*)
|    +--- commons-logging:commons-logging:1.2
|    +--- org.apache.logging.log4j:log4j-api:2.14.1 -> 2.17.2
|    \--- org.apache.logging.log4j:log4j-core:2.14.1 -> 2.17.2 (*)
+--- org.springframework:spring-aop:4.2.9.RELEASE -> 5.3.15 (*)
+--- org.springframework:spring-aspects:4.2.9.RELEASE
|    \--- org.aspectj:aspectjweaver:1.8.9
+--- org.springframework:spring-beans:4.2.9.RELEASE -> 5.3.15 (*)
+--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
+--- org.springframework:spring-context:4.2.9.RELEASE -> 5.3.15 (*)
+--- org.springframework:spring-context-support:4.2.9.RELEASE -> 5.3.15 (*)
+--- org.springframework:spring-expression:4.2.9.RELEASE -> 5.3.15 (*)
+--- org.springframework:spring-instrument:4.2.9.RELEASE
+--- org.springframework:spring-instrument-tomcat:4.2.9.RELEASE
+--- org.springframework:spring-jdbc:4.2.9.RELEASE
|    +--- org.springframework:spring-beans:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
|    \--- org.springframework:spring-tx:4.2.9.RELEASE
|         +--- org.springframework:spring-beans:4.2.9.RELEASE -> 5.3.15 (*)
|         \--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
+--- org.springframework:spring-jms:4.2.9.RELEASE
|    +--- org.springframework:spring-aop:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-beans:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-context:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-messaging:4.2.9.RELEASE
|    |    +--- org.springframework:spring-beans:4.2.9.RELEASE -> 5.3.15 (*)
|    |    +--- org.springframework:spring-context:4.2.9.RELEASE -> 5.3.15 (*)
|    |    \--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
|    \--- org.springframework:spring-tx:4.2.9.RELEASE (*)
+--- org.springframework:spring-messaging:4.2.9.RELEASE (*)
+--- org.springframework:spring-orm:4.2.9.RELEASE
|    +--- org.springframework:spring-beans:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-jdbc:4.2.9.RELEASE (*)
|    \--- org.springframework:spring-tx:4.2.9.RELEASE (*)
+--- org.springframework:spring-oxm:4.2.9.RELEASE
|    +--- org.springframework:spring-beans:4.2.9.RELEASE -> 5.3.15 (*)
|    \--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
+--- org.springframework:spring-test:4.2.9.RELEASE
|    \--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
+--- org.springframework:spring-tx:4.2.9.RELEASE (*)
+--- org.springframework:spring-web:4.2.9.RELEASE
|    +--- org.springframework:spring-aop:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-beans:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-context:4.2.9.RELEASE -> 5.3.15 (*)
|    \--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
+--- org.springframework:spring-webmvc:4.2.9.RELEASE
|    +--- org.springframework:spring-beans:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-context:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-expression:4.2.9.RELEASE -> 5.3.15 (*)
|    \--- org.springframework:spring-web:4.2.9.RELEASE (*)
+--- org.springframework:spring-webmvc-portlet:4.2.9.RELEASE
|    +--- org.springframework:spring-beans:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-context:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-web:4.2.9.RELEASE (*)
|    \--- org.springframework:spring-webmvc:4.2.9.RELEASE (*)
+--- org.springframework:spring-websocket:4.2.9.RELEASE
|    +--- org.springframework:spring-context:4.2.9.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-core:4.2.9.RELEASE -> 5.3.15 (*)
|    \--- org.springframework:spring-web:4.2.9.RELEASE (*)
+--- org.springframework.security:spring-security-config:4.2.9.RELEASE
|    +--- aopalliance:aopalliance:1.0
|    +--- org.springframework.security:spring-security-core:4.2.9.RELEASE
|    |    +--- aopalliance:aopalliance:1.0
|    |    +--- org.springframework:spring-aop:4.3.19.RELEASE -> 5.3.15 (*)
|    |    +--- org.springframework:spring-beans:4.3.19.RELEASE -> 5.3.15 (*)
|    |    +--- org.springframework:spring-context:4.3.19.RELEASE -> 5.3.15 (*)
|    |    +--- org.springframework:spring-core:4.3.19.RELEASE -> 5.3.15 (*)
|    |    \--- org.springframework:spring-expression:4.3.19.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-aop:4.3.19.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-beans:4.3.19.RELEASE -> 5.3.15 (*)
|    +--- org.springframework:spring-context:4.3.19.RELEASE -> 5.3.15 (*)
|    \--- org.springframework:spring-core:4.3.19.RELEASE -> 5.3.15 (*)
+--- org.springframework:spring-dao:2.0.8
|    +--- aopalliance:aopalliance:1.0
|    +--- commons-logging:commons-logging:1.1 -> 1.2
|    +--- org.springframework:spring-beans:2.0.8 -> 5.3.15 (*)
|    +--- org.springframework:spring-context:2.0.8 -> 5.3.15 (*)
|    \--- org.springframework:spring-core:2.0.8 -> 5.3.15 (*)
+--- org.hibernate.common:hibernate-commons-annotations:6.0.0.Final
+--- org.hibernate.javax.persistence:hibernate-jpa-2.1-api:1.0.2.Final
+--- org.hibernate.orm:hibernate-core:6.0.0.Final
|    +--- jakarta.persistence:jakarta.persistence-api:3.0.0
|    +--- jakarta.transaction:jakarta.transaction-api:2.0.0
|    +--- org.jboss.logging:jboss-logging:3.4.3.Final
|    +--- org.jboss:jandex:2.4.2.Final
|    +--- com.fasterxml:classmate:1.5.1
|    +--- org.hibernate.common:hibernate-commons-annotations:6.0.0.CR1 -> 6.0.0.Final
|    +--- net.bytebuddy:byte-buddy:1.12.8
|    +--- jakarta.activation:jakarta.activation-api:2.0.1 -> 2.1.0
|    +--- jakarta.xml.bind:jakarta.xml.bind-api:3.0.1 (*)
|    +--- org.glassfish.jaxb:jaxb-runtime:3.0.2 (*)
|    +--- jakarta.inject:jakarta.inject-api:2.0.0 -> 2.0.1
|    \--- org.antlr:antlr4-runtime:4.9.1 -> 4.9.3
+--- org.hibernate.orm:hibernate-c3p0:6.0.0.Final
|    +--- org.jboss.logging:jboss-logging:3.4.3.Final
|    +--- org.hibernate.orm:hibernate-core:6.0.0.Final (*)
|    \--- com.mchange:c3p0:0.9.5.5 (*)
+--- com.sun.mail:javax.mail:1.5.1
|    \--- javax.activation:activation:1.1
+--- org.apache.tomcat:tomcat-catalina:8.0.44
|    +--- org.apache.tomcat:tomcat-servlet-api:8.0.44
|    +--- org.apache.tomcat:tomcat-jsp-api:8.0.44
|    |    +--- org.apache.tomcat:tomcat-el-api:8.0.44
|    |    \--- org.apache.tomcat:tomcat-servlet-api:8.0.44
|    +--- org.apache.tomcat:tomcat-juli:8.0.44
|    +--- org.apache.tomcat:tomcat-annotations-api:8.0.44
|    +--- org.apache.tomcat:tomcat-api:8.0.44
|    |    \--- org.apache.tomcat:tomcat-servlet-api:8.0.44
|    +--- org.apache.tomcat:tomcat-jni:8.0.44
|    +--- org.apache.tomcat:tomcat-coyote:8.0.44
|    |    +--- org.apache.tomcat:tomcat-servlet-api:8.0.44
|    |    +--- org.apache.tomcat:tomcat-jni:8.0.44
|    |    +--- org.apache.tomcat:tomcat-juli:8.0.44
|    |    \--- org.apache.tomcat:tomcat-util:8.0.44
|    |         \--- org.apache.tomcat:tomcat-juli:8.0.44
|    +--- org.apache.tomcat:tomcat-util:8.0.44 (*)
|    \--- org.apache.tomcat:tomcat-util-scan:8.0.44
|         +--- org.apache.tomcat:tomcat-util:8.0.44 (*)
|         +--- org.apache.tomcat:tomcat-juli:8.0.44
|         \--- org.apache.tomcat:tomcat-api:8.0.44 (*)
+--- org.apache.tomcat:tomcat-util:8.0.44 (*)
+--- org.apache.tomcat:tomcat-jasper:8.0.44
|    +--- org.apache.tomcat:tomcat-servlet-api:8.0.44
|    +--- org.apache.tomcat:tomcat-juli:8.0.44
|    +--- org.apache.tomcat:tomcat-jsp-api:8.0.44 (*)
|    +--- org.apache.tomcat:tomcat-el-api:8.0.44
|    +--- org.eclipse.jdt:ecj:3.12.3
|    +--- org.apache.tomcat:tomcat-jasper-el:8.0.44
|    |    \--- org.apache.tomcat:tomcat-el-api:8.0.44
|    +--- org.apache.tomcat:tomcat-api:8.0.44 (*)
|    \--- org.apache.tomcat:tomcat-util-scan:8.0.44 (*)
\--- org.apache.tomcat:tomcat-juli:8.0.44

Screenshot of object on classpath

Answer 1

I found the root of the issue is that the dom4j package included two dependencies that wasn't mapped as I suspected. I found them by using the 'Open Type' screen in eclipse as shown in my screenshot in the original question then looking up libraries that used those on MVNRepository - sort of a reverse lookup. The dom4j package just so happened to contain both.

I was able to get past this issue by excluding as follows:

    implementation (group: 'org.dom4j', name: 'dom4j', version: '2.1.3')
    {
        exclude group: 'javax.xml.stream', module: 'stax-api'
        exclude group: 'xpp3', module: 'xpp3'
    }