java-dependency-audit

To audit Java dependencies for vulnerabilities, run this skill against a Maven or Gradle project. It inventories direct and transitive dependencies, scans for CVEs, analyzes version conflicts, and generates an upgrade plan with pinned versions and risk notes.

An SBOM, or Software Bill of Materials, is a comprehensive inventory of components in a project. You need an SBOM for Java projects during security reviews or CVE responses to support license metadata collection and assess dependency risk.

Yes, the Java dependency audit supports both Maven and Gradle build systems. It requires a valid pom.xml or build.gradle file to inventory direct and transitive dependencies and produce a prioritized upgrade plan.

To generate an upgrade plan with pinned versions, run the audit on your Java project. It produces an actionable plan detailing what to upgrade, why, associated risk notes, and a pinned versions strategy to guide upgrade sprints.

The best way to analyze duplicate dependencies and license metadata is using a dedicated SCA skill. It inventories transitive dependencies, detects duplicates, and performs best-effort license metadata collection based on available tool support.

Yes, license metadata collection during a Java vulnerability scan is best-effort and depends on available tool support. While the scan reliably detects CVEs and version conflicts, license details may be incomplete if the underlying tool lacks coverage.