/devkit.java.dependency-audit

allowed-tools: Read, Bash, Grep, Glob, Write
argument-hint: "[scope] [focus] [format]"
description: Validates Java project dependencies with vulnerability scanning, license compliance, and supply chain security analysis. Use when auditing project dependencies or before releases.

Java Dependency Audit and Security Analysis

Overview

Perform comprehensive dependency analysis for Java/Maven/Gradle projects to identify security vulnerabilities, licensing issues, outdated packages, and supply chain risks with actionable remediation strategies.

Validates Java project dependencies with vulnerability scanning, license compliance, and supply chain security analysis. Use when auditing project dependencies or before releases.

Usage

/devkit.java.dependency-audit $ARGUMENTS

Arguments

$1 specifies the scope (optional - defaults to `all`):

• `all` - Complete dependency audit (vulnerabilities, licenses, outdated)
• `security` - Focus on CVEs and security vulnerabilities only
• `licenses` - License compliance and compatibility analysis
• `outdated` - Identify outdated dependencies with update recommendations
• `supply-chain` - Supply chain security risks (typosquatting, maintainer changes)
• `transitive` - Focus on transitive (indirect) dependencies
• `<groupId:artifactId>` - Analyze specific dependency (e.g., `org.springframework.boot:spring-boot-starter`)

$2 specifies the focus area (optional - defaults to `comprehensive`):

• `comprehensive` - All analysis categories
• `critical-only` - Only critical and high severity issues
• `production` - Focus on production runtime dependencies
• `direct` - Only direct dependencies (exclude transitive)
• `cve` - CVE database cross-reference
• `compliance` - License and regulatory compliance

$3 specifies the output format (optional - defaults to `report`):

• `report` - Detailed markdown report
• `summary` - Executive summary with metrics
• `json` - Machine-readable JSON format
• `sarif` - SARIF format for CI/CD integration
• `remediation` - Actionable fix commands and PRs

Execution Instructions

**Agent Selection**: To execute this task, use the following agent with fallback:

• Primary: `developer-kit-javajava-security-expert`
• If not available: Use `developer-kit-java:java-security-expert` or fallback to `general-purpose` agent

Context

• Build system: !`ls -la | grep -E "(pom\.xml|build\.gradle|build\.gradle\.kts)"`
• Current dependencies: !

`if [ -f pom.xml ]; then mvn dependency:list 2>/dev/null | head -30; elif [ -f build.gradle ]; then ./gradlew dependencies 2>/dev/null | head -30; fi`

• Dependency tree depth: !

`if [ -f pom.xml ]; then mvn dependency:tree 2>/dev/null | wc -l; elif [ -f build.gradle ]; then ./gradlew dependencies 2>/dev/null | wc -l; fi`

Audit Analysis Process

1. Dependency Discovery and Inventory

Comprehensive dependency scanning:

**Maven Dependency Analysis**

# List all dependencies with scope
mvn dependency:list -DoutputFile=dependencies.txt

# Full dependency tree
mvn dependency:tree -Dverbose -DoutputFile=dependency-tree.txt

# Dependency convergence check
mvn dependency:analyze -DignoreNonCompile=true

# Dependency resolution analysis
mvn dependency:resolve -Dclassifier=sources

**Gradle Dependency Analysis**

# All configurations
./gradlew dependencies > gradle-dependencies.txt

# Specific configuration
./gradlew dependencies --configuration compileClasspath

# Dependency insight for specific library
./gradlew dependencyInsight --dependency org.springframework.boot:spring-boot-starter

# Build scan for analysis
./gradlew build --scan

**Dependency Classification**

• **Direct dependencies**: Explicitly declared in POM/build.gradle
• **Transitive dependencies**: Required by direct dependencies
• **Provided/Compile**: Runtime classpath dependencies
• **Test dependencies**: Test scope only
• **Optional dependencies**: Conditional dependencies

2. Vulnerability Scanning (CVE Detection)

Check against multiple vulnerability databases:

**OWASP Dependency-Check (Maven)**

# Install and run OWASP Dependency-Check
mvn org.owasp:dependency-check-maven:check

# Generate report with specific format
mvn org.owasp:dependency-check-maven:check \
  -Dformat=HTML,JSON,XML \
  -DfailBuildOnCVSS=7 \
  -DsuppressionFile=owasp-suppressions.xml

# Check specific artifact
mvn org.owasp:dependency-check-maven:check \
  -Dartifact=org.springframework.boot:spring-boot-starter-web:3.2.0

**OWASP Dependency-Check (Gradle)**

# Apply plugin and run
./gradlew dependencyCheckAnalyze

# With custom configuration
./gradlew dependencyCheckAnalyze \
  --info \
  -PfailBuildOnCVSS=7

**Snyk Security Scanning**

# Test for vulnerabilities
snyk test --all-projects

# Test with Maven
snyk test --file=pom.xml

# Test with Gradle
snyk test --file=build.gradle

# Generate JSON report
snyk test --json > snyk-report.json

# Monitor project continuously
snyk monitor

**GitHub Advisory Database**

# Using GitHub CLI
gh api graphql -f query='
{
  securityVulnerabilities(first: 100, ecosystem: MAVEN, package: "org.springframework.boot") {
    nodes {
      advisory {
        summary
        severity
        cvss { score }
        references { url }
      }
      vulnerableVersionRange
      firstPatchedVersion { identifier }
    }
  }
}'

**Severity Analysis**

Categorize vulnerabilities by severity:

• **CRITICAL** (CVSS 9.0-10.0): Immediate action required
• Remote code execution vulnerabilities
• Authentication bypass
• Data exposure without authentication

• **HIGH** (CVSS 7.0-8.9): Priority fix within days
• Privilege escalation
• SQL/NoSQL injection
• Cross-site scripting (XSS)

• **MEDIUM** (CVSS 4.0-6.9): Fix within weeks
• Information disclosure
• Denial of service
• CSRF vulnerabilities

• **LOW** (CVSS 0.1-3.9): Fix in regular updates
• Minor information leakage
• Low-impact vulnerabilities