For some reason Github sent up an alert about a 2014 vulnerability in picketlink-common, which WildFly does not use. But when double checking, a couple PL artifact refs can be found by grepping the boms. Both are exclusions, but lets just get rid of them to avoid wasting more time looking into what they are if these kinds of alerts get sent up.