Yes https://github.com/s4u/pgpverify-maven-plugin https://github.com/s4u/pgpverify-maven-plugin There's also this, https://jeremylong.github.io/DependencyChe

Yes https://github.com/s4u/pgpverify-maven-plugin https://github.com/s4u/pgpverify-maven-plugin There's also this, https://jeremylong.github.io/DependencyCheck/dependency-check-maven/configuration.html https://jeremylong.github.io/DependencyCheck/dependency-chec... Because you want to know when a dependency has a vulnerability, even when the developers are legit.