-1

I have a big pom.xml file, it's a spring hibernate project. Now I see I have all the versions of commons-collections of jar getting download and some of them are vulnerable, I only want it to download 4.x version of commons-collection jar.

Now it's a big pom file with more than 100 dependencies , and there is no direct dependency for commons-collections. So how can I find which dependency is downloading commons-collections jar or how can I make only 4.x version of commons-collection jar to download instead of all the versions.??

Praful Jha
  • 187
  • 4
  • 18

1 Answers1

2

You can generate dependency tree using the following command

mvn dependency:tree -Dverbose -Dincludes=commons-collections

Ref - https://maven.apache.org/plugins/maven-dependency-plugin/examples/resolving-conflicts-using-the-dependency-tree.html for more information.

krisnik
  • 1,406
  • 11
  • 18