Java Supply Chain Security

Version boundary

Target Spring Boot 3 with Spring Framework 6 and Spring Security 6. Resolve the actual Boot BOM and dependency graph first. Do not transplant Boot 4 coordinates or unmanaged framework versions into Boot 3. The offline Python helper is version-independent and requires Python 3.10+.

Inspect before executing

A build can execute plugins, annotation processors, wrapper downloads and tests. Review an unfamiliar repository's build and CI configuration before running it in an isolated environment without secrets. Do not run untrusted pull-request code in privileged release jobs. Obtain approval for dependency changes, publishing, external uploads or other actions outside the requested review.

Dependency and release workflow