Find out where transitive dependencies are coming from

[SimonCockx]

Is there a way of finding out where a transitive dependency is coming from? (e.g., by showing a dependency tree)

Background

I am trying to address vulnerabilities that were found in some of our dependencies by running

mvn org.owasp:dependency-check-maven:check -DfailBuildOnCVSS=7

Most of the dependencies that show up are actually transitive dependencies, so they are actually not directly present in our project. To find out where they are coming from, I tried running mvn dependency:tree, but due to the way Tycho works, all dependencies that Tycho fetches show up as direct dependencies, so I've no idea where they're coming from.

Is there a way of finding out where a transative dependency is coming from? E.g., a Tycho-way of running mvn dependency:tree?

[laeubi]

Is there a way of finding out where a transative dependency is coming from? E.g., a Tycho-way of running mvn dependency:tree?

Yes (since Tycho 3.0.0), see
https://github.com/eclipse-tycho/tycho/blob/master/RELEASE_NOTES.md#new-tycho-p2-plugindependency-tree-mojo