The output of mvn dependency:tree is long… Therefore, I created an excerpt with the sections referencing asm. There are only those references…
[INFO] <project-name>:jar:<project-version>
...
[INFO] +- <module-name>:<module-version>:compile
...
[INFO] | +- org.apache.commons:commons-digester3:jar:3.2:compile
[INFO] | | +- cglib:cglib:jar:2.2.2:compile
[INFO] | | | \- asm:asm:jar:3.3.1:compile
[INFO] | | +- commons-beanutils:commons-beanutils:jar:1.8.3:compile
[INFO] | | \- commons-logging:commons-logging:jar:1.1.1:compile
...
[INFO] +- org.ow2.asm:asm:jar:9.8:compile
...
I make use of Apache’s commons-digester3 - latest version 3.2 - which has an indirect dependency on asm version 3.3.1 for processing XML configuration files.
Should you need more context, let me know.