If you aren’t depending on it directly it may be a transitive dependency (one of of the external artifacts you depend on may in turn depend on it; maybe one of your dependencies has a malformatted pom file?)