trivy扫描出了mvn dependency:tree中不存在的jar

Dependency appears in Trivy but not when running maven tree. #2287

Dependency appears in Trivy but not when running maven tree. · Issue #2287 · aquasecurity/trivy · GitHub

方法：

step 1: 用这个命令，可以打印出详细的路径

trivy -d rootfs --offline-scan --format cyclonedx ./target/app.jar

trivy -d rootfs --offline-scan --format table ./target/app.jar

step 2: ctrl+f 搜索对应依赖，找到对应路径