为什么 Gradle 在使用排除时不排除传递依赖项？

Question

我正在尝试使用exclude功能排除传递依赖:

api("org.owasp.antisamy:antisamy:1.6.4") {
exclude group: 'org.slf4j', module: 'slf4j-simple'
}

但是它似乎没有做任何事情，依赖项一直显示在类路径中:

./gradlew dependencies

|    +--- org.owasp.antisamy:antisamy:1.6.3 -> 1.6.4
|    |    +--- commons-codec:commons-codec:1.15
|    |    +--- net.sourceforge.nekohtml:nekohtml:1.9.22
|    |    +--- org.apache.httpcomponents:httpclient:4.5.13
|    |    |    --- commons-logging:commons-logging:1.2
|    |    +--- org.apache.httpcomponents:httpcore:4.4.14
|    |    +--- org.apache.xmlgraphics:batik-css:1.14
|    |    |    +--- org.apache.xmlgraphics:batik-shared-resources:1.14
|    |    |    +--- org.apache.xmlgraphics:batik-util:1.14
|    |    |    |    +--- org.apache.xmlgraphics:batik-constants:1.14
|    |    |    |    |    --- org.apache.xmlgraphics:batik-shared-resources:1.14
|    |    |    |    +--- org.apache.xmlgraphics:batik-i18n:1.14
|    |    |    |    |    --- org.apache.xmlgraphics:batik-shared-resources:1.14
|    |    |    |    --- org.apache.xmlgraphics:batik-shared-resources:1.14
|    |    |    +--- org.apache.xmlgraphics:xmlgraphics-commons:2.6
|    |    |    |    +--- commons-io:commons-io:1.3.1 -> 2.11.0
|    |    |    |    --- commons-logging:commons-logging:1.0.4 -> 1.2
|    |    |    --- xml-apis:xml-apis-ext:1.3.04
|    |    +--- org.slf4j:slf4j-api:1.7.31 -> 1.7.32
|    |    +--- org.slf4j:slf4j-simple:1.7.31 -> 1.7.32

这里有什么问题吗?

Answer 1

另一个依赖项包含了该工件(奇怪的是，它没有在依赖项报告中指出)，我不得不从两个定义中排除它:

api("org.owasp.antisamy:antisamy:1.6.4") {
exclude group: 'org.slf4j', module: 'slf4j-simple'
}
api("org.owasp.esapi:esapi:2.2.3.1") {
exclude group: 'org.slf4j', module: 'slf4j-simple'
}