Hi,
We use Swagger to document our apis which uses Classgraph as a dependency, there was a vulnerability into the 4.8.95 so we upgrade to the last 4.8.177.
We can deploy our war exploded (dev) or not (prod) into Wildfly 30.0.0.FINAL
When the war is exploded, exploded jars are not scanned (loaded)
When the war is not exploded, all works fine.

Best regards.