org.reflections 0.9.10.redhat-3 depends on javassist 3.19.0.GA-redhat-1.
but the productized ip-bom downgrades javassist to 3.18.2...
Note: org.reflections 0.9.10. depends on javassist 3.18.2-GA
So the redhat productized version deliberately upgraded javassist. This could be for any reason, such as a security fix.
On community, it's probably a good idea that we upgrade javassist to 3.19, especially on master to avoid future trouble.
or even 3.21.0-GA directly