Github user MikeThomsen commented on the issue:
https://github.com/apache/nifi/pull/2956
Did a `mvn dependency:tree` on the bundle and only `neo4j-java-driver` was
new for the whole build. Checked it out so we seem to be good on the
dependencies being at least compatibly licensed.---
