Why are deployment JARs packaged in production Quarkus app? - quarkus

Question

A vulnerability scan highlighted the presence of Maven JARs in the Docker image for our Quarkus app which surprised me. These are being picked up from quarkus-app/lib/main. Running mvn quarkus:dependency-tree shows the route by which they're getting included:
[INFO] --- quarkus-maven-plugin:2.2.3.Final:dependency-tree (default-cli) # my-app ---
[INFO] Quarkus application PROD mode build dependency tree:
[INFO] my-group:my-app:pom:1.x-SNAPSHOT
...
[INFO] ├─ io.quarkus:quarkus-undertow-deployment:jar:2.2.3.Final (compile)
...
[INFO] │ ├─ io.quarkus:quarkus-core-deployment:jar:2.2.3.Final (compile)
...
[INFO] │ │ ├─ io.quarkus:quarkus-bootstrap-core:jar:2.2.3.Final (compile)
...
[INFO] │ │ │ ├─ io.quarkus:quarkus-bootstrap-maven-resolver:jar:2.2.3.Final (compile)
[INFO] │ │ │ │ ├─ org.apache.maven:maven-embedder:jar:3.8.1 (compile)
Again, I was surprised to see that it was pulling in deployment JARs as, based on my limited understanding, I would have not expected these to be needed at runtime for a non-mutable production app.
EDIT: The POM just references the extension and then there is a parent POM that references the Quarkus BOM.
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-undertow</artifactId>
</dependency>
If the deployment JARs are needed, why, and, if not, is there a way to exclude them?

Answer 1

As #Ladicek suggested, the cause of this issue was that one of dependencies was referencing the deployment artifact directly (just not the one I posted in the question!). This was then causing the deployment JARs for all of the extensions to be packaged in quarkus-app/lib/main.
Correcting quarkus-logging-json-deployment to quarkus-logging-json fixed the problem.