java-maven-dependency-audit

Run mvn versions:display-dependency-updates to list all dependencies with newer versions available. Use mvn versions:display-plugin-updates to check build plugins, and add -Dincludes=groupId to filter large dependency trees.

Add the OWASP dependency-check-maven plugin to your pom.xml and run mvn dependency-check:check. It generates an HTML report in target/dependency-check-report.html mapping dependencies to CVEs with CVSS severity scores.

Run mvn dependency:tree -Dincludes=groupId:artifactId to see which dependencies pull it in transitively. You can then exclude it with an exclusions block or force a specific version via dependencyManagement.

It means multiple versions of the same library exist in the dependency graph and Maven resolved the conflict by selecting one version. Multiple versions of the same library can cause runtime issues and should be aligned via dependencyManagement.

Run mvn dependency:analyze to report unused declared dependencies that can be removed and used undeclared dependencies that should be explicitly declared in your pom.xml.

Major version updates (x.0.0 changes) require reviewing the changelog and migration guide plus thorough testing. Patch updates are generally safe, minor updates need basic testing, and security fixes should be applied as soon as possible.