docker-java-transport-zerodep version 3.7.1 is currently the latest available release. The artifact still embeds Maven metadata referencing HttpCore5 5.3.6 and HttpCore5-h2:5.3.6, and no newer transport artifact is available with an updated HttpCore5 version.
Although httpcore5 and [httpcore5](httpcore5-h2:5.3.6) was excluded from the project's POM, exclusions only affect Maven dependency resolution and do not modify the contents of the published docker-java-transport-zerodep-3.7.1.jar. As a result, OWASP Dependency Check continues to detect the embedded metadata referencing HttpCore5 5.3.6 and HttpCore5-h2:5.3.6 and reports CVE-2026-54399 and CVE-2026-54428.
This is a metadata-based detection and is a known limitation of dependency scanners when analyzing embedded Maven metadata within packaged JARs.
docker-java-transport-zerodepversion 3.7.1 is currently the latest available release. The artifact still embeds Maven metadata referencing HttpCore5 5.3.6 and HttpCore5-h2:5.3.6, and no newer transport artifact is available with an updated HttpCore5 version.Although
httpcore5and[httpcore5](httpcore5-h2:5.3.6)was excluded from the project's POM, exclusions only affect Maven dependency resolution and do not modify the contents of the publisheddocker-java-transport-zerodep-3.7.1.jar. As a result, OWASP Dependency Check continues to detect the embedded metadata referencing HttpCore5 5.3.6 and HttpCore5-h2:5.3.6 and reports CVE-2026-54399 and CVE-2026-54428.This is a metadata-based detection and is a known limitation of dependency scanners when analyzing embedded Maven metadata within packaged JARs.