Maven 安装相同依赖项的多个版本

Question

Maven plugins (maven-compiler-plugin:3.8.1 and maven-surefire-plugin:3.0.0-M3) seem to be downloading multiple versions of the same dependency (plexus-utils) when running mvn clean package, even if I specify the latest version of plexus-utils in the dependencies. This doesn't cause any errors, but any version of plexus-utils prior to 3.0.16 is vulnerable to command injection. Is there a way that I can stop this from happening?

EDIT: As per the suggestion below I tried including an exclusion, but I think this is only supported for dependencies and not plugins.

             <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.8.1</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.codehaus.plexus</groupId>
                        <artifactId>plexus-utils</artifactId>
                    </exclusion>
                </exclusions>
            </plugin>

Answer 1

While you cannot exclude dependencies for plugins (as you can with other dependencies), you can specify the exact version that will be used for a particular plugin.

If you have a parent POM, or any other linked POMs, you may need to add this to each plugin or dependency where this is used:

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-compiler-plugin</artifactId>
    <version>3.8.1</version>
    <dependencies>
        <dependency>
            <groupId>org.codehaus.plexus</groupId>
            <artifactId>plexus-utils</artifactId>
            <version>3.0.16</version>
        </dependency>
    </dependencies>
</plugin>

Answer 2

For me i have just specified below maven build plugin,

spring-boot-maven-plugin

and i forced my version

<plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <includeSystemScope>true</includeSystemScope>
                </configuration>
                <dependencies>
                    <dependency>
                        <groupId>commons-codec</groupId>
                        <artifactId>commons-codec</artifactId>
                        <version>1.14</version>
                    </dependency>
                </dependencies>
            </plugin>

But still it was showing the older library version for "plexus-utils" and "commons-codec".

Then looking at jenkins logs, it was actually running other plugin like

1. maven-surefire-plugin

2. maven-install-plugin

3. maven-compiler-plugin

So i need to add these plugin and forced my dependency in each.

<plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <dependencies>
                    <dependency>
                        <groupId>org.codehaus.plexus</groupId>
                        <artifactId>plexus-utils</artifactId>
                        <version>3.3.0</version>
                    </dependency>
                    <dependency>
                        <groupId>commons-codec</groupId>
                        <artifactId>commons-codec</artifactId>
                        <version>1.14</version>
                    </dependency>
                </dependencies>
            </plugin>