Why would Sonatype IQ scan report Guava vulnerability when 'mvn dependency:tree' does not show Guava at all?

Question

Why would Sonatype IQ scan report show (in IntelliJ-IDEA) a Guava vulnerability when mvn dependency:tree does not show Guava at all?

Here is my Sonatype scan result, with a Level-7 Critical vulnerability in all versions of Guava.

So, if mvn dependency:tree -Dverbose shows absolutely no mention of Guava, how is it that the Sonatype scan complains about it?

Also, I tried using the JDK jdeps tool and it also doesn't show a Guava dependency. jdeps eb-mu-cbos-eeoi-api-1.0.14-SNAPSHOT.jar .

Is there a way, or another tool, that would allow me to dig even deeper to discover where the Guava dependency reference is coming from?

Answer 1

Instead of --verbose Using -X reveals Guava but still does not show the parent module that the library comes from. Instead it just shows Guava at root of classpath.

So, the solution to my issue was to use the Intellij-IDEA project settings, and in the "Libraries" section when I try to delete Guava it tells me which module/library had included it.

Thanks for all your comments on my original question. It let me to the answer.