Skip to main content

Find and fix vulnerable dependencies

org.openrewrite.java.dependencies.DependencyVulnerabilityCheck

This software composition analysis (SCA) tool detects and upgrades dependencies with publicly disclosed vulnerabilities. This recipe both generates a report of vulnerable dependencies and upgrades to newer versions with fixes. This recipe by default only upgrades to the latest patch version. If a minor or major upgrade is required to reach the fixed version, this can be controlled using the maximumUpgradeDelta option. Vulnerability information comes from the GitHub Security Advisory Database, which aggregates vulnerability data from several public databases, including the National Vulnerability Database maintained by the United States government. Upgrades dependencies versioned according to Semantic Versioning. ## Customizing Vulnerability Data This recipe can be customized by extending DependencyVulnerabilityCheckBase and overriding the vulnerability data sources: - baselineVulnerabilities(ExecutionContext ctx): Provides the default set of known vulnerabilities. The base implementation loads vulnerability data from the GitHub Security Advisory Database CSV file using ResourceUtils.parseResourceAsCsv(). Override this method to replace the entire vulnerability dataset with your own curated list. - supplementalVulnerabilities(ExecutionContext ctx): Allows adding custom vulnerability data beyond the baseline. The base implementation returns an empty list. Override this method to add organization-specific vulnerabilities, internal security advisories, or vulnerabilities from additional sources while retaining the baseline GitHub Advisory Database. Both methods return List<Vulnerability> objects. Vulnerability data can be loaded from CSV files using ResourceUtils.parseResourceAsCsv(path, Vulnerability.class, consumer) or constructed programmatically. To customize, extend DependencyVulnerabilityCheckBase and override one or both methods depending on your needs. For example, override supplementalVulnerabilities() to add custom CVEs while keeping the standard vulnerability database, or override baselineVulnerabilities() to use an entirely different vulnerability data source. Last updated: 2025-12-05T0835.

Recipe source​

This recipe is only available to users of Moderne.

This recipe is available under the Moderne Proprietary License.

Options​

TypeNameDescriptionExample
StringscopeOptional. Match dependencies with the specified scope. Default is runtime. An explanation of what each scope means can be found in the Apache Maven documentation. Valid options: compile, test, runtime, providedruntime
BooleanoverrideTransitiveOptional. When enabled transitive dependencies with vulnerabilities will have their versions overridden. By default only direct dependencies have their version numbers upgraded.false
UpgradeDeltamaximumUpgradeDeltaOptional. The maximum difference to allow when suggesting a dependency version upgrade. Patch version upgrades are the default and safest option, as patch releases assert full backwards compatibility with no breaking changes. Minor version upgrades can introduce new features but do not typically include breaking changes. Major version upgrades will typically require code changes above and beyond this recipe. Valid options: patch, minor, majorpatch
StringminimumSeverityOptional. Only fix vulnerabilities with a severity level equal to or higher than the specified minimum. Vulnerabilities are classified as low, moderate, high, or critical based on their potential impact. Default is low, which includes all severity levels. Valid options: low, moderate, high, criticalmoderate
StringcvePatternOptional. Only fix vulnerabilities matching this regular expression pattern. This allows filtering to specific CVEs or CVE ranges. For example, CVE-2023-.* will only check for CVEs from 2023, `CVE-(20222023)-.*will check for CVEs from 2022 or 2023,CVE-2021-44228

Used by​

This recipe is used as part of the following composite recipes:

Examples​

Example 1​

DependencyVulnerabilityCheckMavenTest#transitive

Parameters​
ParameterValue
scopenull
overrideTransitivetrue
maximumUpgradeDeltanull
minimumSeveritynull
cvePatternnull
Before​
pom.xml
<project>
  <groupId>com.mycompany.app</groupId>
  <artifactId>my-app</artifactId>
  <version>1</version>
  <dependencies>
    <dependency>
      <groupId>org.openrewrite</groupId>
      <artifactId>rewrite-java</artifactId>
      <version>7.0.0</version>
    </dependency>
  </dependencies>
</project>
After​
pom.xml
<project>
  <groupId>com.mycompany.app</groupId>
  <artifactId>my-app</artifactId>
  <version>1</version>
  <dependencyManagement>
    <dependencies>
      <!-- CVE-2020-36518, CVE-2021-46877, CVE-2022-42003, CVE-2022-42004 -->
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
        <version>2.12.7.1</version>
      </dependency>
      <!-- CVE-2021-47621 -->
      <dependency>
        <groupId>io.github.classgraph</groupId>
        <artifactId>classgraph</artifactId>
        <version>4.8.112</version>
      </dependency>
    </dependencies>
  </dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.openrewrite</groupId>
      <artifactId>rewrite-java</artifactId>
      <version>7.0.0</version>
    </dependency>
  </dependencies>
</project>
Example 2​

DependencyVulnerabilityCheckGradleTest#transitive

Parameters​
ParameterValue
scopenull
overrideTransitivetrue
maximumUpgradeDeltanull
minimumSeveritynull
cvePatternnull
Before​
build.gradle
plugins { id 'java' }
repositories { mavenCentral() }

dependencies {
    implementation 'org.openrewrite:rewrite-java:7.0.0'
}
After​
build.gradle
plugins { id 'java' }
repositories { mavenCentral() }

dependencies {
    constraints {
        implementation('io.github.classgraph:classgraph:4.8.112') {
            because 'CVE-2021-47621'
        }
        implementation('com.fasterxml.jackson.core:jackson-databind:2.12.7.1') {
            because 'CVE-2020-36518, CVE-2021-46877, CVE-2022-42003, CVE-2022-42004'
        }
    }

    implementation 'org.openrewrite:rewrite-java:7.0.0'
}
Unchanged​
public class A {}

Usage​

This recipe has no required configuration options. Users of Moderne can run it via the Moderne CLI:

You will need to have configured the Moderne CLI on your machine before you can run the following command.

shell
mod run . --recipe DependencyVulnerabilityCheck

If the recipe is not available locally, then you can install it using:

mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:3.23.0

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Maven metadata failures​

org.openrewrite.maven.table.MavenMetadataFailures

Attempts to resolve maven metadata that failed.

Column NameDescription
Group idThe groupId of the artifact for which the metadata download failed.
Artifact idThe artifactId of the artifact for which the metadata download failed.
VersionThe version of the artifact for which the metadata download failed.
Maven repositoryThe URL of the Maven repository that the metadata download failed on.
SnapshotsDoes the repository support snapshots.
ReleasesDoes the repository support releases.
FailureThe reason the metadata download failed.