To illustrate this issue, I created a sample project here: https://github.com/johnlinp/misc-demo/tree/master/maven-dependency-analyze-dnsjava
The dependency tree is like this:
I didn't use any code directly from the artifact dnsjava in my app. I only used ApacheJMeter_http. However, the command mvn dependency:analyze will report a used undeclared dependency: dnsjava.
It seems that the problem came from the line:
If I change it into map.put("create", null); or even map.put("UPDATE", null);, the problem will disappear. Therefore, I think there might be something to do with the string "update".
Note that this issue is not reproducible in maven-dependency-plugin:2.8.