Keep vulnerable transitive versions out of the dependency tree

[Jordanh1996]

Background

The release workflow's audit gate still fails after #191: it reports jackson 2.14.1 / 2.17.3, commons-io 2.9.0 and commons-lang3 3.11 / 3.12.0, versions that build-info-*, file-specs-java, xray-client-java and others request but Gradle already upgrades to the versions this build declares.

Description

A component metadata rule removes other modules' requests for jackson-core, jackson-databind, commons-io and commons-lang3, all declared directly at fixed versions (jackson-core is now declared explicitly, since jackson-databind's own request for it is removed too). The resolved runtime classpath is unchanged; only the old versions leave the dependency tree.

Tests

The runtimeClasspath jar list is identical before and after, and gradle dependencies no longer shows any older request of the four libraries.

---

• All tests passed. If this feature is not already covered by the tests, I added new tests.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 152bf5db-9cc6-4b7b-81e2-13dcc2cfaa33

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[Jordanh1996]

Closing: jf's graph already contains only the resolved versions (verified with the gate's jf 2.91.0), so these requests never reach the scan. The gate's violations come from the server-side watch.