when tried stand-alone, I learned that those dependencies cannot be really excluded.

core/pom.xml

@@ -158,18 +158,6 @@ THE SOFTWARE.
           <groupId>xml-apis</groupId>
           <artifactId>xml-apis</artifactId>
         </exclusion>
-        <exclusion>
-          <groupId>xalan</groupId>
-          <artifactId>xalan</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.jvnet.hudson</groupId>
-          <artifactId>htmlunit-core-js</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>net.sourceforge.cssparser</groupId>
-          <artifactId>cssparser</artifactId>
-        </exclusion>
       </exclusions>
     </dependency>
     <dependency>