java-vulnerability-manager

What problem does it solve?

Manually identifying, prioritizing, and fixing vulnerable dependencies in Java Maven and Gradle projects is extremely time-consuming and error-prone, especially when dealing with transitive dependencies, complex version mediation rules, BOM overrides, and edge cases like shaded JARs or classifier artifacts that can lead to missed vulnerabilities or broken builds after fixes.

Core Features & Use Cases

• Automated Dual-Scanner Triage: Runs OWASP Dependency-Check and Grype scans, deduplicates findings, classifies vulnerabilities as direct or transitive, and produces a prioritized CVE report with CVSS scores and fix version recommendations.
• Dependency Origin Tracing: Maps full dependency chains for transitive vulnerabilities, detects version conflicts, identifies BOM/parent POM control, and generates ready-to-paste fix snippets for Maven or Gradle.
• Safe Remediation Workflow: Guides users through low-risk fix strategies (direct upgrades, BOM bumps, dependency management pins, constraints) with mandatory post-fix validation to catch regressions like missing runtime classes or broken compiles.
• Use Case: For a team with a critical Text4Shell (CVE-2022-42889) vulnerability in a transitive commons-text dependency, the skill traces the exact dependency chain, generates the correct dependencyManagement pin, validates the fix, and can integrate the scan into CI to prevent reintroduction.

Quick Start

Use the java-vulnerability-manager skill to scan your Java Maven or Gradle project for dependency CVEs, get a prioritized fix plan, and validate that applied fixes resolve vulnerabilities without breaking your build.