Exclude org.apache.htrace.shaded.fasterxml.jackson from htrace-core4

Question

I'm trying to exclude org.apache.htrace.shaded.fasterxml.jackson from htrace-core4-4.1.0-incubating.

The code I have in pom.xml is below.

<dependency>
  <groupId>org.apache.htrace</groupId>
  <artifactId>htrace-core4</artifactId>
  <version>4.1.0-incubating</version>
  <exclusions>
    <exclusion>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-databind</artifactId>
    </exclusion>
  </exclusions>
</dependency>
<dependency>
  <groupId>com.fasterxml.jackson.core</groupId>
  <artifactId>jackson-databind</artifactId>
  <version>2.9.10.8</version>
</dependency>

htrace-core4-4.1.0-incubating uses jackson-2.4.0 which has vulnerabilities. So, I'm trying to exclude it from htrace and add another dependency for jackson. But, htrace-core is still bringing 2.4.0. Please help me how to upgrade jackson version appropriately.

Answer 1

<dependency>
  <groupId>org.apache.htrace</groupId>
  <artifactId>htrace-core4</artifactId>
  <version>4.1.0-incubating</version>
</dependency>

Has no transient dependencies! (proof ... test and provided are not transient)

You must "pull" it somewhere else/through some other dependency (not shown in this post).

---

Try:

mvn dependency:tree -Dincludes=jackson-databind

to better analyze.

---

For the lazy guys: With Netbeans and Eclipse (only!?), you can exclude them any (transient, maven) dependency via context menu.