Security

https://maven.apache.org/guides/mini/guide-encryption.html
https://maven.apache.org/guides/mini/guide-deployment-security-settings.html
https://owasp.org/www-project-dependency-check/
https://docs.github.com/en/code-security/dependabot
https://docs.renovatebot.com/

supply chain security:
    control repositories
    control versions
    scan dependencies
    protect credentials
    keep release artifacts immutable

1. identify vulnerable jar and fixed version
2. locate dependency path with dependency:tree
3. upgrade direct dependency or BOM first
4. if blocked, override transitive dependency in dependencyManagement
5. use exclusion only when the jar must be removed
6. run tests and smoke test
7. verify scanner result
8. document reason in PR or release note

./mvnw dependency:tree -Dincludes=org.example:vulnerable-lib
./mvnw versions:display-dependency-updates

<plugin>
  <groupId>org.owasp</groupId>
  <artifactId>dependency-check-maven</artifactId>
  <version>10.0.3</version>
  <executions>
    <execution>
      <goals>
        <goal>check</goal>
      </goals>
    </execution>
  </executions>
  <configuration>
    <failBuildOnCVSS>7</failBuildOnCVSS>
  </configuration>
</plugin>

./mvnw dependency-check:check

use:
    regular dependency update PR
    grouped patch updates
    separate major version updates
    security PR priority

policy:
    use company mirror/proxy
    block unknown external repositories
    separate snapshot and release repositories
    require credentials only in settings.xml

do not commit:
    settings.xml with passwords
    repository tokens
    signing private keys
    .env files

use:
    CI secrets
    mounted settings.xml
    Docker BuildKit secret

rules:
    no RELEASE / LATEST
    no open version ranges
    explicit plugin versions
    Maven Wrapper committed
    build image or JDK version pinned

rules:
    keep TLS verification enabled
    import company CA into truststore
    pass truststore through MAVEN_OPTS or JAVA_TOOL_OPTIONS
    rotate repository tokens and signing keys