<div dir="ltr"><div>>I'm no Maven expert but I can pretty much say that if the chain of POM dependencies is followed, that should be pulling in commons-collection-3.2.2 by virtue of the opensaml-parent-3.3.0 POM pointing to the java-parent-project->v3 POM that's tagged 10, which has that version pegged.<br><div class="gmail-HOEnZb"></div></div><div><br></div><div>There is a double dependency (directly and via velocity):</div><div><br></div><a href="https://mvnrepository.com/artifact/net.shibboleth/parent-v3/10">https://mvnrepository.com/artifact/net.shibboleth/parent-v3/10</a><br><div><br></div><div>Refers to:</div><div><br></div><div><a href="https://mvnrepository.com/artifact/org.apache.velocity/velocity/1.7">https://mvnrepository.com/artifact/org.apache.velocity/velocity/1.7</a><br></div><div><br></div><div>Refers to:</div><div><br></div><div><a href="https://mvnrepository.com/artifact/commons-collections/commons-collections/3.2.1">https://mvnrepository.com/artifact/commons-collections/commons-collections/3.2.1</a><br></div><div><br></div><div>And the velocity dependency has no exclusion for the commons-collections.</div><div><br></div></div>