title: Dependency in effective pom but not in dependency tree, is it being used?
body: <p>I saw other similar questions but none of them had the answer I was looking for.</p>
  <p>My question is related to the Log4j2 vulnerability recently.</p>
  <p>I have a Maven Spring boot project where I did not switch the default logging system to Log4j2. When I run <code>mvn dependency:tree</code> I only see the log4j-to-slf4j jar and log4j-api jar but not the log4j-core jar, so according to <a href="https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot" rel="nofollow noreferrer">https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot</a> I assume my app is not affected.</p>
  <p>But when i generate the effective POM I see the following</p>
  <pre><code>&lt;dependency&gt;
    &lt;groupId&gt;org.apache.logging.log4j&lt;/groupId&gt;
    &lt;artifactId&gt;log4j-core&lt;artifactId&gt;
    &lt;version&gt;2.14.0&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  <p>I see many other dependencies in the effective POM like log4j-couchdb which the app is definitely not using (the app is not using database), so my thinking is a dependency that is in effective POM does not mean it is packaged to the app jar and used?</p>
  <p>When I read up on definitions of effective POM, I got the feeling that whatever is in effective POM is being packaged and used by the app, so I am confused. Hope someone can help me on this. Thanks!</p>