4 ms·

For Java projects, we use OWASP dependency check as a Maven plugin, which fails the build if compromised log4j2 deps exist: https://owasp.org/www-project-depend

For Java projects, we use OWASP dependency check as a Maven plugin, which fails the build if compromised log4j2 deps exist: https://owasp.org/www-project-dependency-check/ https://owasp.org/www-project-dependency-check/

suyash 5y ago
this is much better tool from Java developer's perspective.
- kjeetgill 5y ago
  For things you're developing, yea. But when you have other Java services deployed like elasticsearch, hadoop, etc. These scanners are still helpful. I say this from weeks for this log4j ordeal.
  - bhawks 5y ago
    I'm just happy I can use this to let my kids play Minecraft again.