Question: I'm trying to exclude org.apache.htrace.shaded.fasterxml.jackson from htrace-core4-4.1.0-incubating.

The code I have in pom.xml is below.

```
<dependency>
  <groupId>org.apache.htrace</groupId>
  <artifactId>htrace-core4</artifactId>
  <version>4.1.0-incubating</version>
  <exclusions>
    <exclusion>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-databind</artifactId>
    </exclusion>
  </exclusions>
</dependency>
<dependency>
  <groupId>com.fasterxml.jackson.core</groupId>
  <artifactId>jackson-databind</artifactId>
  <version>2.9.10.8</version>
</dependency>

```

htrace-core4-4.1.0-incubating uses jackson-2.4.0 which has vulnerabilities. So, I'm trying to exclude it from htrace and add another dependency for jackson.
But, htrace-core is still bringing 2.4.0. Please help me how to upgrade jackson version appropriately.

Answer: 
```xml
<dependency>
  <groupId>org.apache.htrace</groupId>
  <artifactId>htrace-core4</artifactId>
  <version>4.1.0-incubating</version>
</dependency>

```

Has no transient dependencies! ([proof](https://repo1.maven.org/maven2/org/apache/htrace/htrace-htraced/4.1.0-incubating/htrace-htraced-4.1.0-incubating.pom) ... `test` and `provided` are not transient)

You must "pull" it somewhere else/through some other dependency (not shown in this post).

---

Try:

```
mvn dependency:tree -Dincludes=jackson-databind

```

to better analyze.

---

For the lazy guys: With Netbeans and Eclipse (only!?), you can exclude them any (transient, maven) dependency via context menu.
htrace-core4 is a shaded (uber) jar and hence its transitive dependencies cannot be excluded.
You can check the version of the dependency it is (or any other JAR) pulling inside:
`External Libraries/<ParentDependencyYouAreSearching>/META-INF.<VulnerablePackage>/pom.properties`