7.7.3 version of Vaadin:update-theme goal under vaadin-maven-plugin downloading many unknown jars(50+) . How to restrict them?

Question

we are using Vaadin 7.7.3 framework along with sprint boot integration. The themes are added to the src/main/webapp/vaadin/themes path. We have a goal as below,

<groupId>com.vaadin</groupId>
<artifactId>vaadin-maven-plugin</artifactId>
<version>${vaadin.plugin.version}</version>
<executions>
<execution>
<goals>
<goal>update-theme</goal>
<goal>update-widgetset</goal>
<goal>compile</goal>
<goal>compile-theme</goal>
</goals>

POM.xml similar to https://github.com/vaadin/tutorial/blob/v7/pom.xml.

When the "update-theme" is executed, number of jars are getting referenced/requested which are not part of pom configuration like below,

`vaadin-maven-plugin:7.7.3:update-theme (default) @ retail-utils ---
[DEBUG] Dependency collection stats: {ConflictMarker.analyzeTime=1, ConflictMarker.markTime=0, ConflictMarker.nodeCount=420, ConflictIdSorter.graphTime=0, ConflictIdSorter.topsortTime=0, ConflictIdSorter.conflictIdCount=123, ConflictIdSorter.conflictIdCycleCount=0, ConflictResolver.totalTime=4, ConflictResolver.conflictItemCount=270, DefaultDependencyCollector.collectTime=2217, DefaultDependencyCollector.transformTime=5}
[DEBUG] com.vaadin:vaadin-maven-plugin:jar:7.7.3:
[DEBUG]   org.apache.maven:maven-compat:jar:3.0.5:compile
[DEBUG]   org.apache.maven:maven-model-builder:jar:3.0.5:compile
[DEBUG]   org.apache.maven:maven-settings:jar:3.0.5:compile
[DEBUG]   org.codehaus.plexus:plexus-interpolation:jar:1.14:compile
[DEBUG]   org.sonatype.sisu:sisu-inject-plexus:jar:2.3.0:compile
[DEBUG]   org.sonatype.sisu:sisu-inject-bean:jar:2.3.0:compile
[DEBUG]   org.sonatype.sisu:sisu-guice:jar:no_aop:3.1.0:compile
[DEBUG]   org.sonatype.sisu:sisu-guava:jar:0.9.9:compile
[DEBUG]   org.codehaus.plexus:plexus-component-annotations:jar:1.5.5:compile
[DEBUG]   org.apache.maven.wagon:wagon-provider-api:jar:2.4:compile
[DEBUG]   org.apache.maven:maven-core:jar:3.0.5:compile
[DEBUG]   org.apache.maven:maven-settings-builder:jar:3.0.5:compile
[DEBUG]   org.apache.maven:maven-repository-metadata:jar:3.0.5:compile
[DEBUG]   org.apache.maven:maven-aether-provider:jar:3.0.5:compile
[DEBUG]   org.sonatype.aether:aether-spi:jar:1.13.1:compile
[DEBUG]   org.sonatype.aether:aether-impl:jar:1.13.1:compile
[DEBUG]   org.sonatype.aether:aether-api:jar:1.13.1:compile
[DEBUG]   org.sonatype.aether:aether-util:jar:1.13.1:compile
[DEBUG]   org.sonatype.plexus:plexus-sec-dispatcher:jar:1.3:compile
[DEBUG]   org.sonatype.plexus:plexus-cipher:jar:1.4:compile
[DEBUG]   org.apache.maven:maven-model:jar:3.0.5:compile
[DEBUG]   org.apache.maven:maven-artifact:jar:3.0.5:compile
[DEBUG]   org.apache.maven:maven-plugin-api:jar:3.0.5:compile
[DEBUG]   org.apache.maven.reporting:maven-reporting-api:jar:3.0:compile
[DEBUG]   org.apache.maven.reporting:maven-reporting-impl:jar:2.1:compile
[DEBUG]   org.apache.maven:maven-project:jar:2.0.10:compile
[DEBUG]  org.apache.maven:maven-profile:jar:2.0.10:compile
[DEBUG]  org.apache.maven:maven-artifact-manager:jar:2.0.10:compile
[DEBUG]   org.apache.maven:maven-plugin-registry:jar:2.0.10:compile
[DEBUG]   org.apache.maven.doxia:doxia-core:jar:1.1.2:compile
[DEBUG]   commons-httpclient:commons-httpclient:jar:3.1:compile
[DEBUG]   commons-validator:commons-validator:jar:1.2.0:compile
[DEBUG]   commons-beanutils:commons-beanutils:jar:1.7.0:compile
[DEBUG]   commons-digester:commons-digester:jar:1.6:compile
[DEBUG]   oro:oro:jar:2.0.8:compile
[DEBUG]    org.codehaus.plexus:plexus-container-default:jar:1.5.5:compile
[DEBUG]   org.apache.xbean:xbean-reflect:jar:3.4:compile
[DEBUG]   log4j:log4j:jar:1.2.12:compile
[DEBUG]   commons-logging:commons-logging-api:jar:1.1:compile
[DEBUG]   com.google.collections:google-collections:jar:1.0:compile
[DEBUG]   org.apache.maven.doxia:doxia-sink-api:jar:1.6:compile
[DEBUG]  org.apache.maven.doxia:doxia-logging-api:jar:1.6:compile
[DEBUG]   org.apache.maven.doxia:doxia-site-renderer:jar:1.6:compile
[DEBUG]   org.apache.maven.doxia:doxia-decoration-model:jar:1.6:compile
[DEBUG]   org.apache.maven.doxia:doxia-module-xhtml:jar:1.6:compile
[DEBUG]   org.apache.maven.doxia:doxia-module-fml:jar:1.6:compile
[DEBUG]   org.codehaus.plexus:plexus-i18n:jar:1.0-beta-7:compile
[DEBUG]   org.codehaus.plexus:plexus-velocity:jar:1.1.7:compile`

Can you anyone how to restrict or exclude these jars from downloading? we have tried approaches and none of them worked. approach:1

`<configuration>
        <excludes>
        <exclude>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
        </exclude>
        </excludes>
    </configuration>`

approach:2

`<plugin>
<groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-enforcer-plugin</artifactId>
        <version>3.0.0-M3</version>
            <executions>
            <execution>
                <id>enforce-banned-dependencies</id>
                    <goals>
                    <goal>enforce</goal>
                    </goals>
                    <configuration>
                        <rules>
                        <bannedDependencies>
                            <excludes>
                                     <exclude>log4j:log4j</exclude>
                            </excludes>
                        </bannedDependencies>
                        </rules>
                        <fail>true</fail>
                    </configuration>
                    </execution>
                </executions>
        </plugin>`

approach:3

`<configuration>
    <artifactSet>
        <excludes>
            <exclude>log4j:log4j</exclude>
            <exclude>org.freemarker:freemarker</exclude>
            <exclude>org.jboss.resteasy:resteasy-jaxrs</exclude>
            <exclude>com.fasterxml.jackson.core:jackson-databind</exclude>
            <exclude>xalan:xalan</exclude>
        </excludes>
    </artifactSet>
</configuration>`

Please let us know how to restrict or exclude the jars from requesting/downloading