maven-dependency-audit

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Maven Dependency Audit Skill

Maven依赖审计技能

Audit Maven dependencies for updates, vulnerabilities, and conflicts.

审计Maven依赖的更新、漏洞和冲突。

When to Use

何时使用

User says "check dependencies" / "audit dependencies" / "outdated dependencies"
Before a release
Regular maintenance (monthly recommended)
After security advisory

用户说“检查依赖”/“审计依赖”/“过期依赖”
发布前
定期维护（建议每月）
安全公告发布后

Audit Workflow

审计工作流

Check for updates - Find outdated dependencies
Analyze tree - Find conflicts and duplicates
Security scan - Check for vulnerabilities
Report - Summary with prioritized actions

检查更新 - 查找过期的依赖
分析依赖树 - 查找冲突和重复
安全扫描 - 检查漏洞
报告 - 按优先级排序的行动摘要

1. Check for Outdated Dependencies

1. 检查过期依赖

Command

命令

bash

mvn versions:display-dependency-updates

bash

mvn versions:display-dependency-updates

Output Analysis

输出分析

[INFO] The following dependencies in Dependencies have newer versions:
[INFO]   org.slf4j:slf4j-api ......................... 1.7.36 -> 2.0.9
[INFO]   com.fasterxml.jackson.core:jackson-databind . 2.14.0 -> 2.16.1
[INFO]   org.junit.jupiter:junit-jupiter ............. 5.9.0 -> 5.10.1

[INFO] The following dependencies in Dependencies have newer versions:
[INFO]   org.slf4j:slf4j-api ......................... 1.7.36 -> 2.0.9
[INFO]   com.fasterxml.jackson.core:jackson-databind . 2.14.0 -> 2.16.1
[INFO]   org.junit.jupiter:junit-jupiter ............. 5.9.0 -> 5.10.1

Categorize Updates

更新分类

Category	Criteria	Action
Security	CVE fix in newer version	Update ASAP
Major	x.0.0 change	Review changelog, test thoroughly
Minor	x.y.0 change	Usually safe, test
Patch	x.y.z change	Safe, minimal testing

类别	标准	操作
安全	新版本中修复了CVE	尽快更新
主版本	x.0.0变更	查看变更日志，全面测试
次版本	x.y.0变更	通常安全，测试
补丁	x.y.z变更	安全，最小测试

Check Plugin Updates Too

也检查插件更新

bash

mvn versions:display-plugin-updates

bash

mvn versions:display-plugin-updates

2. Analyze Dependency Tree

2. 分析依赖树

Full Tree

完整树

bash

mvn dependency:tree

bash

mvn dependency:tree

Filter for Specific Dependency

过滤特定依赖

bash

mvn dependency:tree -Dincludes=org.slf4j

bash

mvn dependency:tree -Dincludes=org.slf4j

Find Conflicts

查找冲突

Look for:

[INFO] +- com.example:module-a:jar:1.0:compile
[INFO] |  \- org.slf4j:slf4j-api:jar:1.7.36:compile
[INFO] +- com.example:module-b:jar:1.0:compile
[INFO] |  \- org.slf4j:slf4j-api:jar:2.0.9:compile (omitted for conflict)

Flags:

```
(omitted for conflict)
```
- Version conflict resolved by Maven
```
(omitted for duplicate)
```
- Same version, no issue
Multiple versions of same library - Potential runtime issues

寻找：

[INFO] +- com.example:module-a:jar:1.0:compile
[INFO] |  \- org.slf4j:slf4j-api:jar:1.7.36:compile
[INFO] +- com.example:module-b:jar:1.0:compile
[INFO] |  \- org.slf4j:slf4j-api:jar:2.0.9:compile (omitted for conflict)

标记：

```
(omitted for conflict)
```
- Maven已解决的版本冲突
```
(omitted for duplicate)
```
- 相同版本，无问题
同一库的多个版本 - 潜在的运行时问题

Analyze Unused Dependencies

分析未使用的依赖

bash

mvn dependency:analyze

Output:

[WARNING] Used undeclared dependencies found:
[WARNING]    org.slf4j:slf4j-api:jar:2.0.9:compile
[WARNING] Unused declared dependencies found:
[WARNING]    commons-io:commons-io:jar:2.11.0:compile

bash

mvn dependency:analyze

输出：

[WARNING] Used undeclared dependencies found:
[WARNING]    org.slf4j:slf4j-api:jar:2.0.9:compile
[WARNING] Unused declared dependencies found:
[WARNING]    commons-io:commons-io:jar:2.11.0:compile

3. Security Vulnerability Scan

3. 安全漏洞扫描

Option A: OWASP Dependency-Check (Recommended)

方案A：OWASP Dependency-Check（推荐）

Add to pom.xml:

xml

<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>9.0.7</version>
</plugin>

Run:

bash

mvn dependency-check:check

Output: HTML report in

target/dependency-check-report.html

添加到pom.xml：

xml

<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>9.0.7</version>
</plugin>

运行：

bash

mvn dependency-check:check

输出：

target/dependency-check-report.html

中的HTML报告

Option B: Maven Dependency Plugin

方案B：Maven依赖插件

bash

mvn dependency:analyze-report

bash

mvn dependency:analyze-report

Option C: GitHub Dependabot

方案C：GitHub Dependabot

If using GitHub, enable Dependabot alerts in repository settings.

如果使用GitHub，请在仓库设置中启用Dependabot警报。

Severity Levels

严重级别

CVSS Score	Severity	Action
9.0 - 10.0	Critical	Update immediately
7.0 - 8.9	High	Update within days
4.0 - 6.9	Medium	Update within weeks
0.1 - 3.9	Low	Update at convenience

CVSS分数	严重性	操作
9.0 - 10.0	严重	立即更新
7.0 - 8.9	高	数天内更新
4.0 - 6.9	中	数周内更新
0.1 - 3.9	低	方便时更新

4. Generate Audit Report

4. 生成审计报告

Output Format

输出格式

markdown

undefined

markdown

undefined

Dependency Audit Report

依赖审计报告

Project: {project-name} Date: {date} Total Dependencies: {count}

项目： {project-name} 日期： {date} 总依赖数： {count}

Security Issues

安全问题

Dependency	Current	CVE	Severity	Fixed In
log4j-core	2.14.0	CVE-2021-44228	Critical	2.17.1

依赖	当前版本	CVE	严重性	修复版本
log4j-core	2.14.0	CVE-2021-44228	严重	2.17.1

Outdated Dependencies

过期依赖

Major Updates (Review Required)

主版本更新（需要审查）

Dependency	Current	Latest	Notes
slf4j-api	1.7.36	2.0.9	API changes, see migration guide

依赖	当前版本	最新版本	备注
slf4j-api	1.7.36	2.0.9	API变更，请参阅迁移指南

Minor/Patch Updates (Safe)

次版本/补丁更新（安全）

Dependency	Current	Latest
junit-jupiter	5.9.0	5.10.1
jackson-databind	2.14.0	2.16.1

依赖	当前版本	最新版本
junit-jupiter	5.9.0	5.10.1
jackson-databind	2.14.0	2.16.1

Conflicts Detected

检测到的冲突

slf4j-api: 1.7.36 vs 2.0.9 (resolved to 2.0.9)

slf4j-api: 1.7.36 与 2.0.9（已解析为2.0.9）

Unused Dependencies

未使用的依赖

commons-io:commons-io:2.11.0 (consider removing)

commons-io:commons-io:2.11.0（考虑移除）

Recommendations

建议

Immediate: Update log4j-core to fix CVE-2021-44228
This sprint: Update minor/patch versions
Plan: Evaluate slf4j 2.x migration

---

立即： 更新log4j-core以修复CVE-2021-44228
当前迭代： 更新次版本/补丁版本
计划： 评估slf4j 2.x迁移

---

Common Scenarios

常见场景

Scenario: Check Before Release

场景：发布前检查

bash

undefined

bash

undefined

Quick check

快速检查

mvn versions:display-dependency-updates -q

Full audit

全面审计

mvn versions:display-dependency-updates &&
mvn dependency:analyze &&
mvn dependency-check:check

undefined

mvn versions:display-dependency-updates &&
mvn dependency:analyze &&
mvn dependency-check:check

undefined

Scenario: Find Why Dependency is Included

场景：查找依赖为何被包含

bash

mvn dependency:tree -Dincludes=commons-logging

bash

mvn dependency:tree -Dincludes=commons-logging

Scenario: Force Specific Version (Resolve Conflict)

场景：强制特定版本（解决冲突）

xml

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>2.0.9</version>
        </dependency>
    </dependencies>
</dependencyManagement>

xml

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>2.0.9</version>
        </dependency>
    </dependencies>
</dependencyManagement>

Scenario: Exclude Transitive Dependency

场景：排除传递依赖

xml

<dependency>
    <groupId>com.example</groupId>
    <artifactId>some-library</artifactId>
    <version>1.0</version>
    <exclusions>
        <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
        </exclusion>
    </exclusions>
</dependency>

xml

<dependency>
    <groupId>com.example</groupId>
    <artifactId>some-library</artifactId>
    <version>1.0</version>
    <exclusions>
        <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
        </exclusion>
    </exclusions>
</dependency>

Token Optimization

Token优化

Use
```
-q
```
(quiet) flag for less verbose output
Filter with
```
-Dincludes=groupId:artifactId
```
when looking for specific deps
Run commands separately and summarize findings
Don't paste entire dependency tree - summarize conflicts

使用
```
-q
```
（静默）标志减少输出
在查找特定依赖时使用
```
-Dincludes=groupId:artifactId
```
过滤
分别运行命令并总结发现
不要粘贴整个依赖树 - 总结冲突

Quick Commands Reference

快速命令参考

Task	Command
Outdated deps	`mvn versions:display-dependency-updates`
Outdated plugins	`mvn versions:display-plugin-updates`
Dependency tree	`mvn dependency:tree`
Find specific dep	`mvn dependency:tree -Dincludes=groupId`
Unused deps	`mvn dependency:analyze`
Security scan	`mvn dependency-check:check`
Update versions	`mvn versions:use-latest-releases`
Update snapshots	`mvn versions:use-latest-snapshots`

任务	命令
过期依赖	`mvn versions:display-dependency-updates`
过期插件	`mvn versions:display-plugin-updates`
依赖树	`mvn dependency:tree`
查找特定依赖	`mvn dependency:tree -Dincludes=groupId`
未使用的依赖	`mvn dependency:analyze`
安全扫描	`mvn dependency-check:check`
更新版本	`mvn versions:use-latest-releases`
更新快照	`mvn versions:use-latest-snapshots`

Update Strategies

更新策略

Conservative (Recommended for Production)

保守（推荐用于生产）

Update patch versions freely
Update minor versions with basic testing
Major versions require migration plan

自由更新补丁版本
使用基本测试更新次版本
主版本需要迁移计划

Aggressive (For Active Development)

激进（用于活跃开发）

bash

undefined

bash

undefined

Update all to latest (use with caution!)

全部更新到最新（请谨慎使用！）

mvn versions:use-latest-releases mvn versions:commit # or versions:revert

undefined

mvn versions:use-latest-releases mvn versions:commit # 或 versions:revert

undefined

Selective

选择性

bash

undefined

bash

undefined

Update specific dependency

更新特定依赖

mvn versions:use-latest-versions -Dincludes=org.junit.jupiter

undefined

mvn versions:use-latest-versions -Dincludes=org.junit.jupiter

undefined