java-vulnerability-manager

name	java-vulnerability-manager
description	Intelligent Java dependency vulnerability detection, triage, and remediation for Maven and Gradle projects. Produces a CVE report with scores, traces vulnerability origins through transitive graphs, and delivers a prioritized fix plan — handling version mediation rules, BOM overrides, exclusions, and shaded-JAR edge cases.
version	2.0.0
kind	pipeline
triggers	["fix vulnerabilities in java project","remove vulnerable dependencies","java cve scan","dependency vulnerability report","owasp dependency check","upgrade vulnerable jars","fix transitive dependency"]
intent	execution
guardrails	["Copy helper scripts to a .vuln/ subfolder at the project root and chmod +x before running.","Always run vuln-scan.sh BEFORE editing pom.xml or build.gradle — it creates the baseline snapshot vuln-validate.sh diffs against.","Never remove a dependency without confirming it is not a direct compile/runtime requirement.","Distinguish transitive from direct before choosing a fix — the wrong approach causes silent runtime failures.","Prefer version-constraint fixes (dependencyManagement / constraints) over blanket exclusions. Exclusions are a last resort.","Run vuln-validate.sh after every fix batch — never batch all fixes without intermediate validation.","Every false positive needs vuln-suppress.sh with a documented rationale. Never suppress silently or hand-edit the XML.","Never downgrade a dependency to resolve a CVE — only upgrade.","If a fix needs a major version bump (breaking API), flag it for human review rather than applying it.","When M2_HOME is set it is the shared Maven local repository — pass it through (-Dmaven.repo.local=\"$M2_HOME\") on every scan and validate run, or resolution differs between the scan and the build."]
resources	["<SKILL_PATH>/scripts/vuln-scan.sh","<SKILL_PATH>/scripts/vuln-trace.sh","<SKILL_PATH>/scripts/vuln-validate.sh","<SKILL_PATH>/scripts/vuln-suppress.sh"]
tools	["bash"]
created_at	2026-05-30T00:00:00.000Z
updated_at	2026-07-29T00:00:00.000Z

Java vulnerability manager

Detect, triage, and remediate dependency CVEs in Maven and Gradle projects.

Scripts

script	role
vuln-scan.sh	Runs OWASP Dependency-Check + Grype, classifies DIRECT vs TRANSITIVE, merges results, writes the triage report and the JSON baseline snapshot.
vuln-trace.sh	For a groupId:artifactId, traces every chain pulling it in, surfaces scope, version conflicts, and existing constraints, and emits the correct Maven/Gradle fix snippet.
vuln-validate.sh	Post-fix: verifies resolution, compiles, tests, re-scans, and diffs CVE count before vs after.
vuln-suppress.sh	Generates documented OWASP suppression XML with category, reviewer, and optional expiry. Supports --list and --expire-check.

Setup — Deploy Helper Scripts

Copy the helper scripts into the project before starting any scan:

mkdir -p .vuln
cp <SKILL_PATH>/scripts/vuln-*.sh .vuln/
chmod +x .vuln/vuln-*.sh

The four scripts and their roles in the workflow:

Script	Purpose	When to run
vuln-scan.sh	OWASP + Grype scan, DIRECT/TRANSITIVE classification, triage report	First — establishes baseline
vuln-trace.sh	Full dependency chain trace, conflict detection, fix snippet generator	For every TRANSITIVE finding
vuln-validate.sh	Compile + test + re-scan + before/after CVE diff	After every fix batch
vuln-suppress.sh	Documented suppression entry generator, expiry auditor	For confirmed false positives

---

Output

vuln-scan.sh writes the full report and a JSON snapshot to the output directory and prints the paths. Work from the triage report; open the raw scanner output only to investigate a specific finding. The JSON snapshot is the handle uses for before/after diffing — do not delete it mid-remediation.