Incorrect latest version of Apache commons compress

[asthagarg2428]

The report is showing incorrect latest version of apache compress however on the official website it's 1.22

• org.apache.commons:commons-compress [1.21 -> 3.1.7.2]
  http://commons.apache.org/compress/

Can you please help me here, why is it showing the wrong 3.1.7.2 version? and how can I be sure to rely on the report about the data?

[ben-manes]

The report queries your repositories which contains a maven-metadata.xml file with the versions. Someone released a custom build and you will need to use Gradle’s features to restrict the resolution.

What repositories are you using?

[asthagarg2428]

I’m using many internal libraries and apart from that I’m using https://jitpack.io
In the internal libraries, we are not creating any custom build for apache compress with this 3.1.x.x version

[ben-manes]

You can use —info —refresh-dependencies to see the Gradle logs for its resolution. You might have something on your private repository, that’s not uncommon. Otherwise I’d need a minimal reproduction to debug with

[ben-manes]

plugins {
  id 'com.github.ben-manes.versions' version '0.46.0'
  id 'java'
}

repositories {
  maven { url 'https://jitpack.io' }
  gradlePluginPortal()
  mavenCentral()
  jcenter()
  google()
}

dependencies {
  implementation 'org.apache.commons:commons-compress:1.21'
}

ben: groovy $ gradle dU --refresh-dependencies

> Task :dependencyUpdates

------------------------------------------------------------
: Project Dependency Updates (report to plain text file)
------------------------------------------------------------

The following dependencies are using the latest milestone version:
 - com.github.ben-manes.versions:com.github.ben-manes.versions.gradle.plugin:0.46.0

The following dependencies have later milestone versions:
 - org.apache.commons:commons-compress [1.21 -> 1.22]
     https://commons.apache.org/proper/commons-compress/

Gradle release-candidate updates:
 - Gradle: [7.5.1 -> 8.0.1]

Generated report file build/dependencyUpdates/report.txt

[asthagarg2428]

Oh thanks for checking this in a sample project on your end, I was just about to add the old apache dependency in a new project.
Well, that definitely means we have a custom build on our side, let me check