spring-boot-starter-patterns

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The documents include explicit Maven wrapper distributionUrl entries (https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip and https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/4.0.0-rc/apache-maven-4.0.0-rc-bin.zip) which are fetched at runtime by ./mvnw and download/execute remote Maven binaries (remote code execution).