Not able to exclude dependency in Nexus IQ - Sonatype Lifecycle & Repository Firewall - Sonatype Community

Not able to exclude dependency in Nexus IQ

post by hurtooe on Oct 20, 2022

Hi,

I found a strange thing, not sure if anyone can help.

I have a project “A” which has dependency to another project “B” and “B” uses bouncycastle.

I already put in the dependency section in the pom.xml in “A” to exclude the bouncycastle dependency from “B”.

I ran the command “mvn dependency:tree” to check the dependency, and I didn’t see the bouncycastle from “B”.

However, from our Nexus IQ report, it still shows that bouncycastle from “B”.

Is the dependency exclusion not taken into account?

Or do I have to use dependencyManagement?

Sincerely,

Roger


post by jwilcox on Oct 21, 2022

Hi Roger,

Thank you for taking the time to post. Is it possible to provide an example? An example would help us reproduce the issue.

Thank you,

Jim Wilcox

Lifecycle Product Manager


New & Unread Topics

Topic Replies Views Activity
Batch Deletion of expired waivers 1 26 26d
Bom scan does not generate a report 3 122 Mar 11
how to use remote tcp socket instead of local unix socket for nexus iq container image scan for pulling neuvector image from private registry 1 65 Apr 21
IQ Firewall: Database update frequency and coverage of new libraries against recent threats 4 39 Jun 9
Freeing up space Recovery Mode 1 95 Mar 16