maven-dependency-audit
starsforks
How to install maven-dependency-audit?
decebals/claude-code-java/maven-dependency-audit
$npx -y skills add decebals/claude-code-java --skill maven-dependency-auditAudit Maven dependencies for outdated versions, security vulnerabilities, and conflicts. Use when user says "check dependencies", "audit dependencies", "outdated deps", or before releases.
SKILL.md
| 1 | # Maven Dependency Audit Skill |
| 2 | |
| 3 | Audit Maven dependencies for updates, vulnerabilities, and conflicts. |
| 4 | |
| 5 | ## When to Use |
| 6 | - User says "check dependencies" / "audit dependencies" / "outdated dependencies" |
| 7 | - Before a release |
| 8 | - Regular maintenance (monthly recommended) |
| 9 | - After security advisory |
| 10 | |
| 11 | ## Audit Workflow |
| 12 | |
| 13 | 1. **Check for updates** - Find outdated dependencies |
| 14 | 2. **Analyze tree** - Find conflicts and duplicates |
| 15 | 3. **Security scan** - Check for vulnerabilities |
| 16 | 4. **Report** - Summary with prioritized actions |
| 17 | |
| 18 | --- |
| 19 | |
| 20 | ## 1. Check for Outdated Dependencies |
| 21 | |
| 22 | ### Command |
| 23 | ```bash |
| 24 | mvn versions:display-dependency-updates |
| 25 | ``` |
| 26 | |
| 27 | ### Output Analysis |
| 28 | ``` |
| 29 | [INFO] The following dependencies in Dependencies have newer versions: |
| 30 | [INFO] org.slf4j:slf4j-api ......................... 1.7.36 -> 2.0.9 |
| 31 | [INFO] com.fasterxml.jackson.core:jackson-databind . 2.14.0 -> 2.16.1 |
| 32 | [INFO] org.junit.jupiter:junit-jupiter ............. 5.9.0 -> 5.10.1 |
| 33 | ``` |
| 34 | |
| 35 | ### Categorize Updates |
| 36 | |
| 37 | | Category | Criteria | Action | |
| 38 | |----------|----------|--------| |
| 39 | | **Security** | CVE fix in newer version | Update ASAP | |
| 40 | | **Major** | x.0.0 change | Review changelog, test thoroughly | |
| 41 | | **Minor** | x.y.0 change | Usually safe, test | |
| 42 | | **Patch** | x.y.z change | Safe, minimal testing | |
| 43 | |
| 44 | ### Check Plugin Updates Too |
| 45 | ```bash |
| 46 | mvn versions:display-plugin-updates |
| 47 | ``` |
| 48 | |
| 49 | --- |
| 50 | |
| 51 | ## 2. Analyze Dependency Tree |
| 52 | |
| 53 | ### Full Tree |
| 54 | ```bash |
| 55 | mvn dependency:tree |
| 56 | ``` |
| 57 | |
| 58 | ### Filter for Specific Dependency |
| 59 | ```bash |
| 60 | mvn dependency:tree -Dincludes=org.slf4j |
| 61 | ``` |
| 62 | |
| 63 | ### Find Conflicts |
| 64 | Look for: |
| 65 | ``` |
| 66 | [INFO] +- com.example:module-a:jar:1.0:compile |
| 67 | [INFO] | \- org.slf4j:slf4j-api:jar:1.7.36:compile |
| 68 | [INFO] +- com.example:module-b:jar:1.0:compile |
| 69 | [INFO] | \- org.slf4j:slf4j-api:jar:2.0.9:compile (omitted for conflict) |
| 70 | ``` |
| 71 | |
| 72 | **Flags:** |
| 73 | - `(omitted for conflict)` - Version conflict resolved by Maven |
| 74 | - `(omitted for duplicate)` - Same version, no issue |
| 75 | - Multiple versions of same library - Potential runtime issues |
| 76 | |
| 77 | ### Analyze Unused Dependencies |
| 78 | ```bash |
| 79 | mvn dependency:analyze |
| 80 | ``` |
| 81 | |
| 82 | Output: |
| 83 | ``` |
| 84 | [WARNING] Used undeclared dependencies found: |
| 85 | [WARNING] org.slf4j:slf4j-api:jar:2.0.9:compile |
| 86 | [WARNING] Unused declared dependencies found: |
| 87 | [WARNING] commons-io:commons-io:jar:2.11.0:compile |
| 88 | ``` |
| 89 | |
| 90 | --- |
| 91 | |
| 92 | ## 3. Security Vulnerability Scan |
| 93 | |
| 94 | ### Option A: OWASP Dependency-Check (Recommended) |
| 95 | |
| 96 | Add to pom.xml: |
| 97 | ```xml |
| 98 | <plugin> |
| 99 | <groupId>org.owasp</groupId> |
| 100 | <artifactId>dependency-check-maven</artifactId> |
| 101 | <version>9.0.7</version> |
| 102 | </plugin> |
| 103 | ``` |
| 104 | |
| 105 | Run: |
| 106 | ```bash |
| 107 | mvn dependency-check:check |
| 108 | ``` |
| 109 | |
| 110 | Output: HTML report in `target/dependency-check-report.html` |
| 111 | |
| 112 | ### Option B: Maven Dependency Plugin |
| 113 | ```bash |
| 114 | mvn dependency:analyze-report |
| 115 | ``` |
| 116 | |
| 117 | ### Option C: GitHub Dependabot |
| 118 | If using GitHub, enable Dependabot alerts in repository settings. |
| 119 | |
| 120 | ### Severity Levels |
| 121 | |
| 122 | | CVSS Score | Severity | Action | |
| 123 | |------------|----------|--------| |
| 124 | | 9.0 - 10.0 | Critical | Update immediately | |
| 125 | | 7.0 - 8.9 | High | Update within days | |
| 126 | | 4.0 - 6.9 | Medium | Update within weeks | |
| 127 | | 0.1 - 3.9 | Low | Update at convenience | |
| 128 | |
| 129 | --- |
| 130 | |
| 131 | ## 4. Generate Audit Report |
| 132 | |
| 133 | ### Output Format |
| 134 | |
| 135 | ```markdown |
| 136 | ## Dependency Audit Report |
| 137 | |
| 138 | **Project:** {project-name} |
| 139 | **Date:** {date} |
| 140 | **Total Dependencies:** {count} |
| 141 | |
| 142 | ### Security Issues |
| 143 | |
| 144 | | Dependency | Current | CVE | Severity | Fixed In | |
| 145 | |------------|---------|-----|----------|----------| |
| 146 | | log4j-core | 2.14.0 | CVE-2021-44228 | Critical | 2.17.1 | |
| 147 | |
| 148 | ### Outdated Dependencies |
| 149 | |
| 150 | #### Major Updates (Review Required) |
| 151 | | Dependency | Current | Latest | Notes | |
| 152 | |------------|---------|--------|-------| |
| 153 | | slf4j-api | 1.7.36 | 2.0.9 | API changes, see migration guide | |
| 154 | |
| 155 | #### Minor/Patch Updates (Safe) |
| 156 | | Dependency | Current | Latest | |
| 157 | |------------|---------|--------| |
| 158 | | junit-jupiter | 5.9.0 | 5.10.1 | |
| 159 | | jackson-databind | 2.14.0 | 2.16.1 | |
| 160 | |
| 161 | ### Conflicts Detected |
| 162 | - slf4j-api: 1.7.36 vs 2.0.9 (resolved to 2.0.9) |
| 163 | |
| 164 | ### Unused Dependencies |
| 165 | - commons-io:commons-io:2.11.0 (consider removing) |
| 166 | |
| 167 | ### Recommendations |
| 168 | 1. **Immediate:** Update log4j-core to fix CVE-2021-44228 |
| 169 | 2. **This sprint:** Update minor/patch versions |
| 170 | 3. **Plan:** Evaluate slf4j 2.x migration |
| 171 | ``` |
| 172 | |
| 173 | --- |
| 174 | |
| 175 | ## Common Scenarios |
| 176 | |
| 177 | ### Scenario: Check Before Release |
| 178 | ```bash |
| 179 | # Quick check |
| 180 | mvn versions:display-dependency-updates -q |
| 181 | |
| 182 | # Full audit |
| 183 | mvn versions:display-dependency-updates && \ |
| 184 | mvn dependency:analyze && \ |
| 185 | mvn dependency-check:check |
| 186 | ``` |
| 187 | |
| 188 | ### Scenario: Find Why Dependency is Included |
| 189 | ```bash |
| 190 | mvn dependency:tree -Dincludes=commons-logging |
| 191 | ``` |
| 192 | |
| 193 | ### Scenario: Force Specific Version (Resolve Conflict) |
| 194 | ```xml |
| 195 | <dependencyManagement> |
| 196 | <dependencies> |
| 197 | <dependency> |
| 198 | <groupId>org.slf4j</groupId> |
| 199 | <artifactId>slf4j-api</artifactId> |
| 200 | <version>2.0.9</version> |
| 201 | </dependency> |
| 202 | </dependencies |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
