maven
Safeguard articles tagged "maven" — guides, analysis, and best practices for software supply chain and application security.
32 articles
Log4j Maven Dependency: How to Find, Fix, and Pin It Safely
A practical guide to the Log4j Maven dependency: how to detect log4j-core in your tree, why 2.17.1 is the version to target, and how to pin it for good.
xercesImpl: XXE Risks in Java XML Parsing and How to Configure It
The xercesImpl Maven artifact turns up transitively in thousands of Java builds. Here is its real CVE history, why XXE is your configuration's fault, and the hardening block to paste.
Maven Release Plugin Hardening
The Maven Release Plugin is the oldest piece of release automation most Java shops still run. A look at the hardening steps it usually needs.
Reachability Analysis for Java: A 2026 Deep Dive
Java reachability under classpath reality: reflection, Spring autowiring, shaded JARs, Log4Shell, and what modern tools actually resolve versus over-approximate.
Maven Central Sigstore Migration Status
Maven Central's move from GPG to Sigstore is genuinely underway in 2026. Here is where the transition actually stands and what Java shops should do now.
How to Generate SBOMs From Maven Projects
Produce accurate CycloneDX SBOMs from Maven builds using the official plugin, handle multi-module reactors, and ship attested SBOMs alongside your JARs.
Java Maven and Gradle Dependency Security
How to secure your Java dependency chain across Maven and Gradle builds, from signature verification to repository management.
Maven and Gradle dependency supply chain attacks in the J...
How attackers exploit Maven Central and the Gradle Plugin Portal — dependency confusion, malicious artifacts, and plugin takeovers — and how to defend Java builds.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.