Maven Dependency Audit

This audits your Maven dependencies by running the standard toolchain commands and organizing the results into a prioritized report. It checks for outdated versions, scans for CVEs with OWASP Dependency-Check, analyzes the dependency tree for conflicts, and flags unused dependencies. The workflow is solid: it categorizes updates by severity, explains what those "(omitted for conflict)" messages actually mean, and gives you a concrete action plan instead of just dumping terminal output. Use it before releases or when someone mentions checking dependencies. The token optimization section is honest about filtering verbose tree output, which matters when you're working with a large project that pulls in half of Maven Central.

skills.sh installs: 308
GitHub stars: 771
last updated: Feb 8, 2026

View on GitHub

Install

$ npx -y skills add decebals/claude-code-java --skill maven-dependency-audit --agent claude-code

Installs into .claude/skills of the current project.

Files

Maven Dependency Audit Skill

Audit Maven dependencies for updates, vulnerabilities, and conflicts.

When to Use

User says "check dependencies" / "audit dependencies" / "outdated dependencies"
Before a release
Regular maintenance (monthly recommended)
After security advisory

Audit Workflow

Check for updates - Find outdated dependencies
Analyze tree - Find conflicts and duplicates
Security scan - Check for vulnerabilities
Report - Summary with prioritized actions

1. Check for Outdated Dependencies

Command

mvn versions:display-dependency-updates

Output Analysis

[INFO] The following dependencies in Dependencies have newer versions:
[INFO]   org.slf4j:slf4j-api ......................... 1.7.36 -> 2.0.9
[INFO]   com.fasterxml.jackson.core:jackson-databind . 2.14.0 -> 2.16.1
[INFO]   org.junit.jupiter:junit-jupiter ............. 5.9.0 -> 5.10.1