Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Maven orders qualifiers as alpha, beta, milestone, rc, snapshot, release, then sp, and trims trailing zeros. Why that affects vulnerable range checks.
Maven compile, runtime, test, provided and import map to Gradle implementation, api, runtimeOnly, compileOnly and platform. A table and what to check.
A Maven SBOM should list resolved versions, not those in pom.xml. See how dependency mediation and dependencyManagement change what really ships.
Start at the root POM that lists modules, then check each module's parent. Aggregator and parent POMs differ, and scanning the wrong one misses code.
Run a repository manager as a caching proxy instead of copying Maven Central. Maven allows one mirror per repository, and mirrorOf star routes everything.
Library authors use optional, consumers use exclusions. Knowing who holds each tool helps teams settle who removes an unwanted transitive dependency.
Four built in Maven Enforcer rules stop moving versions, snapshots and version clashes from reaching a release. What each does and how to configure them.
Set project.build.outputTimestamp, upgrade plugins, and test with artifact:compare. Maven 3.10.0 and 4.0.0-beta-5 turn reproducible mode on by default.
When two imported BOMs manage the same artifact, Maven uses the first import declared. Here is how that creates team disputes and how to settle them.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
