Skip to main content

Find and fix vulnerable dependencies

org.openrewrite.java.dependencies.DependencyVulnerabilityCheck

This software composition analysis (SCA) tool detects and upgrades dependencies with publicly disclosed vulnerabilities. This recipe both generates a report of vulnerable dependencies and upgrades to newer versions with fixes. This recipe by default only upgrades to the latest patch version. If a minor or major upgrade is required to reach the fixed version, this can be controlled using the maximumUpgradeDelta option. Vulnerability information comes from the GitHub Security Advisory Database, which aggregates vulnerability data from several public databases, including the National Vulnerability Database maintained by the United States government. Upgrades dependencies versioned according to Semantic Versioning. Last updated: 2025-04-21T1102.

Recipe source​

This recipe is only available to users of Moderne.

This recipe is available under the Moderne Proprietary License.

Options​

TypeNameDescriptionExample
StringscopeOptional. Match dependencies with the specified scope. Default is runtime. An explanation of what each scope means can be found in the Apache Maven documentation. Valid options: compile, test, runtime, providedruntime
BooleanoverrideTransitiveOptional. When enabled transitive dependencies with vulnerabilities will have their versions overridden. By default only direct dependencies have their version numbers upgraded.false
UpgradeDeltamaximumUpgradeDeltaOptional. The maximum difference to allow when suggesting a dependency version upgrade. Patch version upgrades are the default and safest option, as patch releases assert full backwards compatibility with no breaking changes. Minor version upgrades can introduce new features but do not typically include breaking changes. Major version upgrades will typically require code changes above and beyond this recipe. Valid options: patch, minor, majorpatch

Example​

Parameters​
ParameterValue
scopenull
overrideTransitivetrue
maximumUpgradeDeltanull
Before​
build.gradle
plugins { id 'java' }
repositories { mavenCentral() }

dependencies {
    implementation 'org.openrewrite:rewrite-java:7.0.0'
}
After​
build.gradle
plugins { id 'java' }
repositories { mavenCentral() }

dependencies {
    constraints {
        runtimeOnly('io.github.classgraph:classgraph:4.8.112') {
            because 'CVE-2021-47621'
        }
        implementation('com.fasterxml.jackson.core:jackson-databind:2.12.7.1') {
            because 'CVE-2020-36518, CVE-2021-46877, CVE-2022-42003, CVE-2022-42004'
        }
    }

    implementation 'org.openrewrite:rewrite-java:7.0.0'
}
Unchanged​
public class A {}

Usage​

This recipe has no required configuration options. Users of Moderne can run it via the Moderne CLI:

You will need to have configured the Moderne CLI on your machine before you can run the following command.

shell
mod run . --recipe DependencyVulnerabilityCheck

If the recipe is not available locally, then you can install it using:

mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:3.7.0

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Maven metadata failures​

org.openrewrite.maven.table.MavenMetadataFailures

Attempts to resolve maven metadata that failed.

Column NameDescription
Group idThe groupId of the artifact for which the metadata download failed.
Artifact idThe artifactId of the artifact for which the metadata download failed.
VersionThe version of the artifact for which the metadata download failed.
Maven repositoryThe URL of the Maven repository that the metadata download failed on.
SnapshotsDoes the repository support snapshots.
ReleasesDoes the repository support releases.
FailureThe reason the metadata download failed.