maven - Why would Sonatype IQ scan report Guava vulnerability when 'mvn dependency:tree' does not show Guava at all? - Stack Overflow

Why would Sonatype IQ scan report show (in IntelliJ-IDEA) a Guava vulnerability when mvn dependency:tree does not show Guava at all? Here is my Sonatype scan result, with a Level-7 Critical vulnera

History

java - The POM for is missing, no dependency information available even though it exists in Maven Repository - Stack Overflow

java - Failed to read artifact descriptor for com.google.guava (nexus) - Stack Overflow

Nexus IQ for Azure DevOps

Getting Started with Sonatype Vulnerability Analysis

June 2018 - devel - Fedora Mailing-Lists

CS544_Project/tag_count.txt at master · weichenzhao/CS544_Project · GitHub

Some Maven dependencies are absent · Issue #95 · jfrog/jfrog-vscode-extension · GitHub

java - Debug into Maven Dependency Source w/IntelliJ - Stack Overflow