:exclusions are lost when :transitive true

[darin-reify]

When building an uberjar with :transitive true, parental :exclusions are lost when lifting dependencies up to the root-level.

It's worth noting that the bad library was a transitive dep of one of the source deps getting added to the uberjar. The setup looks something like:

;; source-lib/deps.edn
{:deps 
 ;; this contains `com.fasterxml/aalto-xml` which breaks `org.clojure/data.xml`
 {io.netty/netty-all {:mvn/version "some-version"}}}

;; app/deps.edn
{:deps
 {org.clojure/data.xml {:mvn/version "0.2.0-alpha6"}
  company/source-lib {:git/url ...
                      :git/sha ...
                      ;; because this is a transitive dep and `:exclusions` aren't propagated,
                      ;; `io.netty/netty-all` would be brought up as a top-level dep without
                      ;; this exclusion and re-include the bad dep.
                      :exclusions [com.fasterxml/aalto-xml]}}}

I've just excluded netty-all as an interim fix. however, adding something like below worked for me poking around locally:

:exclusions (into #{} (comp
                       (mapcat identity)
                       (mapcat #(get-in default-libs [% :exclusions])
                  (:parents coords))

[seancorfield]

Fixed on main and will be in next release, whenever that happens.