I have a project with dependency tree like below.

    <dependency>
     <groupId>xxxxx</groupId>
     <artifactId>xxxxxx</artifactId>
     <exclusions>
      <exclusion>
       <groupId>log4j</groupId>
       <artifactId>log4j</artifactId>
      </exclusion>
     </exclusions>
    </dependency>

I excluded log4j 1.2.14 which my dependency xxxxxx uses and added log4j-api and log4j-core as new dependencies.

    <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-api</artifactId>
     <version>2.17.1</version>
     </dependency>
    <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-core</artifactId>
     <version>2.17.1</version>
    </dependency>

Finally, log4j 1.2.14 seems removed from dependency:tree output but when running “mvn clean and install” command it is still downloaded. Is there a way to prevent this version to be downloaded?