Search code examples
spring-bootmavenintellij-idea

How can I locate the pom.xml where the jar is imported?

Currently, I'm developing a web project based on SpringBoot and the building tool is Maven. A few days ago, a vulnerability was found in the commons-fileupload(jar) 1.4 which is from Apache. Unexpectedly, when I was trying to located it in Intelij Idea(the IDE), the searching list is empty as follows. searching result

But the jar is include in the package after compiling.

it exists

Maybe it is imported directly from another dependency.So I tried to find it in the dependencies diagram. In vain. How can I find it? Thank you indeed for you reply.

Solution

  • Try to get the dependency tree, that way you will see the dependencies and where they come from.

    In Maven you can do that by using the command mvn dependency:tree

    This command will scan all your direct and transitory dependencies, and then you can ignore and replace the specific dependency on your project. Still, you must be sure the versions are compatible.