如何排除Maven插件自动引入的jsoup 1.10.2依赖？

算力阿峰

2026-7-8

Maven插件依赖排除jsoup 1.10.2的可行方案

问题背景

项目基于JDK11（无法升级），pom.xml中某个org.apache.maven.plugins下的插件自动引入了存在安全漏洞的jsoup 1.10.2，需要排除该依赖。

解决步骤

1. 定位jsoup的引入来源

先执行以下命令，精准定位是哪个插件引入了jsoup：

mvn dependency:tree -Dincludes=org.jsoup:jsoup

命令输出会展示完整的依赖链，从中找到对应的org.apache.maven.plugins插件及其直接依赖（jsoup的上层依赖）。

2. 方案一：手动排除插件中的jsoup依赖

找到目标插件后，在插件配置中添加<dependencies>块，对包含jsoup的直接依赖设置排除规则。例如，假设是maven-war-plugin通过maven-shared-utils引入jsoup，修改后的插件配置如下：

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-war-plugin</artifactId>
    <version>3.3.2</version>
    <dependencies>
        <dependency>
            <groupId>org.apache.maven.shared</groupId>
            <artifactId>maven-shared-utils</artifactId>
            <version>3.3.4</version> <!-- 替换为插件实际依赖的版本 -->
            <exclusions>
                <exclusion>
                    <groupId>org.jsoup</groupId>
                    <artifactId>jsoup</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
    </dependencies>
</plugin>

3. 方案二：升级插件版本（优先推荐）

多数插件的新版本会主动升级依赖库以修复漏洞。检查目标插件兼容JDK11的最新版本，例如maven-war-plugin的3.4.0+版本已将jsoup升级到安全版本。直接升级插件版本即可自动解决问题：

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-war-plugin</artifactId>
    <version>3.4.0</version> <!-- 替换为兼容JDK11的最新版本 -->
</plugin>

4. 验证排除效果

修改完成后，重新执行mvn dependency:tree -Dincludes=org.jsoup:jsoup，确认jsoup 1.10.2已被排除或替换为安全版本。

附用户原始pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.application</groupId>
    <artifactId>SemanticFramework</artifactId>
    <packaging>war</packaging>
    <version>1.0.0-SNAPSHOT</version>
    <name>SemanticFramework Jersey Webapp</name>
    <build>
        <finalName>SemanticFramework</finalName>
        <plugins>
                <!-- https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-war-plugin -->
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-war-plugin</artifactId>
                    <version>3.3.2</version>
                </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.11.0</version>
            </plugin>
            <!-- Run the application using "mvn embedded-glassfish:run" -->
            <plugin>
                <groupId>org.glassfish</groupId>
                <artifactId>maven-embedded-glassfish-plugin</artifactId>
                <version>${glassfish.version}</version>
                <configuration>
                    <goalPrefix>embedded-glassfish</goalPrefix>
                    <app>C:/Users/mariarousi/eclipse-workspace/target/${project.build.finalName}.war</app>
                    <autoDelete>true</autoDelete>
                    <port>8080</port>
                </configuration>
                <dependencies>
                    <dependency>
                        <groupId>com.sun.jersey</groupId>
                        <artifactId>jersey-servlet</artifactId>
                        <version>${project.version}</version>
                    </dependency>
                    <dependency>
                        <groupId>javax.servlet</groupId>
                        <artifactId>javax.servlet-api</artifactId>
                        <version>3.0.1</version>
                    </dependency>
                </dependencies>
            </plugin>
            <plugin>
                <groupId>org.apache.tomcat.maven</groupId>
                <artifactId>tomcat7-maven-plugin</artifactId>
                <version>2.2</version>
            </plugin>
        </plugins>
    </build>
    <dependencies>
        <dependency>
            <groupId>com.thoughtworks.xstream</groupId>
            <artifactId>xstream</artifactId>
            <version>1.4.20</version>
        </dependency>
         <dependency>
            <groupId>org.codehaus.jettison</groupId>
            <artifactId>jettison</artifactId>
            <version>1.5.4</version>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-servlet</artifactId>
            <version>${jersey.version}</version>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-json</artifactId>
            <version>${jersey.version}</version>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.8.2</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-client</artifactId>
            <version>${jersey.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>2.13.5</version>
        </dependency>
        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
            <artifactId>httpclient</artifactId>
            <version>4.5.13</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.extras</groupId>
            <artifactId>glassfish-embedded-web</artifactId>
            <version>${glassfish.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>com.google.code.gson</groupId>
            <artifactId>gson</artifactId>
            <version>2.9.0</version>
        </dependency>
        <dependency>
            <groupId>org.json</groupId>
            <artifactId>json</artifactId>
            <version>20230227</version>
        </dependency>
        <dependency>
            <groupId>com.mashape.unirest</groupId>
            <artifactId>unirest-java</artifactId>
            <version>1.4.9</version>
        </dependency>
        <dependency>
            <groupId>org.apache.jena</groupId>
            <artifactId>apache-jena-libs</artifactId>
            <type>pom</type>
            <version>4.2.0</version>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-client</artifactId>
            <version>1.19.4</version>
        </dependency>
        <dependency>
            <groupId>com.openlink.virtuoso</groupId>
            <artifactId>virtjdbc4</artifactId>
            <version>4.0</version>
            <scope>system</scope>
            <systemPath>${project.basedir}/virtjdbc4.jar</systemPath>
        </dependency>
        <dependency>
            <groupId>com.openlink.virtuoso</groupId>
            <artifactId>virt_jena3</artifactId>
            <version>3.0</version>
            <scope>system</scope>
            <systemPath>${project.basedir}/virt_jena3.jar</systemPath>
        </dependency>
        <dependency>
            <groupId>com.squareup.okhttp3</groupId>
            <artifactId>okhttp</artifactId>
            <version>5.0.0-alpha.3</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/com.googlecode.json-simple/json-simple -->
        <dependency>
            <groupId>com.googlecode.json-simple</groupId>
            <artifactId>json-simple</artifactId>
            <version>1.1.1</version>
        </dependency>
    </dependencies>
    <properties>
        <jersey.version>1.19</jersey.version>
        <glassfish.version>3.1.1</glassfish.version>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>
</project>

内容的提问来源于stack exchange，提问作者alexandros vassiliades