Very new to springboot and JAVA, I am working on a SpringBoot app (v-3.3.0) which is talking to Azure blob storage containers to push data on to them. I am using maven build tool to generate the jar file of the application. I have updated the versions of the packages to the latest ones and one of them which I could see is azure-json which is being used internally. The problem is azure-json even though I am using the latest version at the moment (1.1.0) creates a jar in the BOOT-INF/lib folder and is dependent on or using jackson-core from com.fasterxml.jackson.core v 2.13.2. This transitive dependency (jackson-core – 2.13.x) has a vulnerability detected in one of our code scan engines.

To resolve this I have tried explicitly declaring azure-json in the pom.xml adding an exclusion to the jackson-core dependency. And, explicitly adding jackson-core separately to the latest version atm which is (2.17.1) or so. This is not working and the vulnerability still exists.
I have also tried excluding the same at the plugin level (from: spring-boot-maven-plugin) section but without any success. Tried using the mvn dependency:tree command to check but that version never shows up. When I check the external libraries section using IntelliJ Idea, I do see the azure-json dependency and digging in, I can see a ref to jackson-core version 2.13.x inside a pom.xml file. But not able to exclude the same so that it uses the latest version.

Any help eliminate this dependency issue will be appreciated. Also please suggest if you see any issues with the POM file below:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.3.0</version>
    </parent>
    <organization>
        <name>Org Name</name>
        <url>https://org.url</url>
    </organization>

    <groupId>package.namespace</groupId>
    <artifactId>app-name</artifactId>
    <version>0.0.1</version>

    <name>Service Name</name>
    <description>Service Desc.</description>
    <properties>
        <java.version>17</java.version>
        <spring-cloud-azure.version>5.13.0</spring-cloud-azure.version>
        <logback.contrib.version>0.1.5</logback.contrib.version>
        <jackson.version>2.17.1</jackson.version>
        <jackson-bom.version>2.17.1</jackson-bom.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <exclusions>
                <exclusion>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-tomcat</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-jetty</artifactId>
        </dependency>
        <dependency>
            <groupId>com.azure.spring</groupId>
            <artifactId>spring-cloud-azure-starter-storage</artifactId>
            <version>${spring-cloud-azure.version}</version>
        </dependency>
        <dependency>
            <groupId>com.azure</groupId>
            <artifactId>azure-storage-blob</artifactId>
            <version>12.26.0</version>
        </dependency>
        <dependency>
            <groupId>com.azure</groupId>
            <artifactId>azure-json</artifactId>
            <version>1.1.0</version>
            <exclusions>
                <exclusion>
                    <groupId>com.fasterxml.jackson.core</groupId>
                    <artifactId>jackson-core</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>com.azure</groupId>
            <artifactId>azure-identity</artifactId>
            <exclusions>
                <exclusion>
                    <artifactId>azure-json</artifactId>
                    <groupId>com.azure</groupId>
                </exclusion>
                <exclusion>
                    <artifactId>jna-platform</artifactId>
                    <groupId>net.java.dev.jna</groupId>
                </exclusion>
                <exclusion>
                    <artifactId>jna</artifactId>
                    <groupId>net.java.dev.jna</groupId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>com.azure</groupId>
            <artifactId>azure-identity-broker</artifactId>
            <exclusions>
                <exclusion>
                    <artifactId>jna-platform</artifactId>
                    <groupId>net.java.dev.jna</groupId>
                </exclusion>
                <exclusion>
                    <artifactId>jna</artifactId>
                    <groupId>net.java.dev.jna</groupId>
                </exclusion>
                <exclusion>
                    <artifactId>msal4j</artifactId>
                    <groupId>com.microsoft.azure</groupId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.13.2</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>io.micrometer</groupId>
            <artifactId>micrometer-registry-prometheus</artifactId>
        </dependency>
        <dependency>
            <groupId>com.azure</groupId>
            <artifactId>azure-core-serializer-json-jackson</artifactId>
            <version>1.4.13</version>
        </dependency>
    </dependencies>
    <dependencyManagement>
        <dependencies>

            <dependency>
                <groupId>org.ow2.asm</groupId>
                <artifactId>asm</artifactId>
                <version>9.6</version>
            </dependency>

            <dependency>
                <groupId>com.azure.spring</groupId>
                <artifactId>spring-cloud-azure-dependencies</artifactId>
                <version>${spring-cloud-azure.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>com.azure</groupId>
                <artifactId>azure-core</artifactId>
                <version>1.49.1</version>
            </dependency>
            <dependency>
                <groupId>com.azure</groupId>
                <artifactId>azure-core-http-netty</artifactId>
                <version>1.15.0</version>
                <exclusions>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-all</artifactId>
                <version>4.1.110.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-handler-proxy</artifactId>
                <version>4.1.110.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport</artifactId>
                <version>4.1.110.Final</version>
            </dependency>
            <dependency>
                <groupId>com.azure</groupId>
                <artifactId>azure-sdk-bom</artifactId>
                <version>1.2.24</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>ch.qos.logback.contrib</groupId>
                <artifactId>logback-jackson</artifactId>
                <version>${logback.contrib.version}</version>
            </dependency>

            <dependency>
                <groupId>ch.qos.logback.contrib</groupId>
                <artifactId>logback-json-classic</artifactId>
                <version>${logback.contrib.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <excludeGroupIds>com.fasterxml.jackson.core</excludeGroupIds>
                    <excludeArtifactIds>jackson-core</excludeArtifactIds>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>0.8.8</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                    </execution>
                    <!-- attached to Maven test phase -->
                    <execution>
                        <id>report</id>
                        <phase>test</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>
</project>

Thanks much!