Dependency version conflict，The packaged JAR should have only one of these versions？

[lihaoran93]

Whether need to exclude one of the versions？

[stevespringett]

It appears the BOM actually includes both versions. Check your BOM to verify. Then check the artifacts created from the build to verify whether or not both versions are included or not. Maven sometimes does this.

[msymons]

I have come across so many instances where a BOM includes multiple versions of the same dependency. I find that the analyze command in cyclonedx-cli is very useful here as it explicitly identifies the clashes. The same information will be displayed in Dependency-Track.. but can be a bit harder to spot in a larger project.

$ ./cyclonedx-win-x86.exe analyze --input-file my-bom.xml --output-format text --multiple-component-versions
Components with multiple versions:

javax.ws.rs-api versions: 2.0.1 2.1.1

A small tweak to dependencyManagement and the next build gives a "clean" BOM.

[lihaoran93]

Thanks， Perhaps I have the wrong starting point, as I have been trying to reduce the false positive rate of detected risks:

eg. Unused dependencies in the POM do not want to detect risk.