How to exclude a transitive dependency inside a transitive dependency?

Question

I have a maven project "Project-1". This project uses some dependencies, let's consider jackson databind 2.9.8

Another maven project "Project-2" uses "Project-1" as a dependency.

"Project-3" uses "Project-2" as a dependency.

In the "Project-3", I used jackson databind 2.10.0 using the dependency management tag. Additionally, under the dependency tag of "Project-2" inside the pom of "Project-1", I added the exclusion tag of jackson databind.

In the dependency tree of "Project-3", only one version of jackson databind is getting resolved which is 2.10.0

But, In a security scan in the pipeline, it is still reporting some security issue for the jackson databind 2.9.8

I am not sure how come this version is getting resolved even though it is not mentioned in the dependency tree.

I am trying to add the exclusion in the "Project-1" now. But, is there any better way to exclude it in "Project-3"?

Answer 1

It seems like the dependency "jackson databind" is not pulled by Maven, so their is no way to exclude it in Maven.

It may be the dependency of a Maven plugin you run, and you can try to find that out by running Maven with the debug flag -X. Then you might need to remove that plugin.

It may as well be the case that your "scanner" does not only scan the dependencies of the project, but other things as well. Maybe it is a bug in the scanner so that excluded artifacts are also scanned.