maven
Safeguard articles tagged "maven" — guides, analysis, and best practices for software supply chain and application security.
38 articles
nimbus-jose-jwt: JWT Handling in Java Done Right
com.nimbusds:nimbus-jose-jwt is the JVM's workhorse JOSE library. Here is how to configure it so algorithm confusion, weak validation, and its one recent CVE never reach production.
How to Verify Java Builds and Artifacts (java verify)
Verifying Java means more than running tests. It covers Maven's verify phase, JAR signature checks, and confirming dependency integrity before you ship.
The Spring Boot BOM: A Security-First Guide to Version Management
The Spring Boot BOM pins hundreds of transitive versions for you. Used well it closes CVEs fast; used carelessly it hides an end-of-life framework in your build.
maven-assembly-plugin: A Security Guide
The maven-assembly-plugin bundles your project into distributable archives. It builds archives rather than extracting them, which shapes exactly which supply chain risks apply to it.
com.fasterxml.jackson.databind: Maven Coordinates, Modules, and Version Strategy
com.fasterxml.jackson.databind is the Java package, not the Maven groupId, and that mixup breaks builds weekly. Here are the correct coordinates, the module map, and a version strategy that survives audits.
How to Install Maven on Windows, macOS, and Linux
A step-by-step guide to install Maven on any OS, verify the install, and avoid the JAVA_HOME and PATH mistakes that trip up most first-time setups.
jackson-core Maven: What It Is and Where the Risk Lives
jackson-core is the low-level streaming engine behind Jackson, added via Maven. Here is what the artifact does, why it is safer than jackson-databind, and how to keep the whole stack patched.
spring-context: The Dependency at the Heart of Spring (and Its CVEs)
spring-context is the artifact that gives you Spring's ApplicationContext, and it drags four more Spring modules into your build. Here is what it does, what it pulls in, and the CVEs that have hit it.
SnakeYAML in Maven: How to Use It Safely and Avoid CVE-2022-1471
Adding SnakeYAML as a Maven dependency is fine, but parsing untrusted YAML with the default constructor is not. Here is how to pin a safe version and lock down deserialization.
Java Security Scanner: How It Works and What to Use
A Java security scanner combines static analysis of your own code with dependency scanning of your Maven and Gradle tree. Here is how each layer works and how to wire them into a build.
How to Use a Java Package Manager Safely: A Security Review of Maven and Gradle
A Java package manager pulls in far more code than most teams realize. Here is how Maven and Gradle actually resolve dependencies, where the risk lives, and how to lock it down.
org.json Maven: A Security Guide
The org.json Maven dependency ships a small JSON parser with a history of denial-of-service bugs. Here is how to pin a safe version and catch it transitively.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.