Which Maven Enforcer rules help with dependency security?

Three Maven Enforcer rules do the most for dependency hygiene. DependencyConvergence fails when a library resolves to different versions on different paths. RequireUpperBoundDeps fails when the chosen version is lower than one a dependency needs. BannedDependencies fails when a forbidden artifact appears anywhere in the tree.

Definitions

The Maven Enforcer Plugin runs rules during the build and can stop it. Each rule is a small check configured in the POM under the enforce goal.

The three rules

dependencyConvergence. The error lists the paths to the conflicting versions. By default provided and test scopes are excluded, and all other errors are reported. You can narrow it with includes, excludes and excludedScopes.

requireUpperBoundDeps. Maven normally picks the declared or nearest version. That can leave an older version on the classpath while another library needs a newer one. This rule catches it. Defaults skip test and provided scopes.

bannedDependencies. Patterns follow groupId, then optional artifactId, version, type, scope and classifier, with wildcards. A bare version such as 1.2 means that version and above, and [1.2] means exactly that version. SearchTransitive defaults to true, so transitive entries are checked too. An includes list carves out exceptions to the excludes.

Configuration sketch

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-enforcer-plugin</artifactId>
  <version>3.6.3</version>
  <executions>
    <execution>
      <id>enforce-deps</id>
      <goals>
        <goal>enforce</goal>
      </goals>
      <configuration>
        <rules>
          <dependencyConvergence/>
          <requireUpperBoundDeps/>
          <bannedDependencies>
            <excludes>
              <exclude>commons-lang:commons-lang</exclude>
            </excludes>
            <message>Use commons-lang3 instead.</message>
          </bannedDependencies>
        </rules>
      </configuration>
    </execution>
  </executions>
</plugin>

The plugin version shown matches the current docs at the time of writing. Use the latest your team has approved.

What these rules do not do

They check consistency and bans. They do not know about advisories. A converged tree can converge on a vulnerable version. Pair them with scanning.

Rolling out without pain

1. Run the rules with the fail option set to false first and read the output.
2. Fix conflicts with dependencyManagement, see Maven BOMs.
3. Enable fail mode once the tree is clean.
4. Add banned entries as you decide, such as artifacts your policy forbids.

Try it yourself

Click through it at your own pace, or open it full screen.

See how a gate blocks a change. Enforcer plays the same role inside the build.

Where Safeguard fits

Safeguard policies and gates can block pull requests based on findings, which covers the advisory side that Enforcer does not. Try the free scan.

Quick check

Sources

• Maven Enforcer: dependencyConvergence
• Maven Enforcer: requireUpperBoundDeps
• Maven Enforcer: bannedDependencies

Last reviewed: 19 October 2026.