BOM
Safeguard articles tagged "BOM" — guides, analysis, and best practices for software supply chain and application security.
2 articles
When the BOM Picks Your Versions: How Long Spring Boot Takes to Ship Security Fixes
Spring Boot patch releases upgrade managed libraries only at the patch level. Across 56 Boot releases and 2025-2026 Maven advisories, same-minor fixes arrived a median 23 days after reaching Maven Central, while 70 cases needed a newer minor that no patch release will take. What Boot 4.0.8 and 4.1.1 manage today, how to override versions, and a checker.
Spring Dependency Management Supply Chain
Spring Boot's dependency management is the unsung hero of the Java ecosystem, and it is also a supply chain seam worth understanding. Here is how BOMs, starters, and transitive version coercion shape what actually ships.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.