Xml-apis-ext same hash multiple version other risk level

Sonatype Lifecycle & Repository Firewall
,
1

Our developer used xml-apis-ext Version: 1.3.04 which has a Apache license.
However NexusIQ flags V2.5.0 which has no license.
Hash is the same:
sha1sum xml-apis-ext*
41a8b86b358e87f3f13cf46069721719105aff66 xml-apis-ext-2.5.0.jar
41a8b86b358e87f3f13cf46069721719105aff66 xml-apis-ext.jar (1.3.04 version with license in it!)
url maven:
https://mvnrepository.com/artifact/org.clojars.pallix/xml-apis-ext/2.5.0
https://mvnrepository.com/artifact/xml-apis/xml-apis-ext/1.3.04
How to solve this?
Our company will fail the build on License-none (which is 2.5.0)

2

Hi Frank,

Please raise support questions relating to Nexus IQ Server at https://support.sonatype.com, we’ll be happy to help you there!

Regards,

Rich

3

done and thanks Rich