A Maven relocation is a small POM at an artifact's old coordinates that points to its new ones, so existing builds keep working. A scanner that matches advisories only by the old group and artifact names could miss records filed under the new name. You can test this directly.
What a relocation is
Maven guidance says it is sometimes necessary to relocate artifacts, for example when a project moves from one groupId to another. Instead of changing published files, the project publishes a relocation POM at the old coordinates with a distributionManagement and relocation section. Maven resolves the artifact from the new location and issues a warning telling the user to update.
The guide gives a real example. Apache Ant moved from ant:ant to org.apache.ant:ant starting with version 1.7.0, with a relocation POM published at the old coordinates.
Two details matter for scanning. Repository data is treated as immutable, so Maven does not re-download POM files it already has. And each new release needs its own relocation POM at the old coordinates until users have moved on.
Why scanners might trip
Advisory records for Maven use group and artifact names. After a move, new advisories usually carry the new coordinates, and old ones carry the old. Your project may declare the old name for years.
Possible results:
- The scanner reads the declared old name, finds advisories filed under it, and misses any filed under the new name.
- It resolves the relocation and sees the new name, then misses older records filed under the old one.
- It handles both and reports each correctly.
We have not tested specific tools, and you should not assume either outcome. Treat this as a question to put to a vendor and a test to run once.
A relocation test
- Find a library in your own project that has moved coordinates. Check the dependency tree and look for the relocation warning in the build log.
- Run the scanner on the project, and note which name it reports for that library.
- Search the advisory sources for both the old and the new coordinates and list the records under each.
- Confirm the scanner reports the union, or that it explains which name it used.
- If the old coordinates are still declared, update them to the new ones. The build warning exists for that reason.
What to ask a vendor
- Does the tool read the effective POM after relocation, or the declared one?
- Does the report show which coordinates were matched?
- How are advisories filed under both names deduplicated?
For other naming traps see what a shaded jar is and why scanners miss it.
Safeguard's SBOM and dependency scanning records the resolved component identity, and you can try a pom at https://gold.safeguard.sh/scan.
Quick check
What does Maven do when it meets a relocation?
It resolves the artifact from the new coordinates and issues a warning telling the user to update their dependency.
Should I keep the old coordinates?
No. Update to the new ones when you see the warning, so scanners and advisories line up with what you use.
Sources
Last reviewed: 19 October 2026.
