v3.1.0

Version 3.1.0

Highlights

New report section: Vulnerabilities

Lists known security vulnerabilities (CVEs) for the artifacts on the classpath, one row per advisory. For every artifact that can be identified by its Maven coordinates, JarHC looks up known security advisories from a public vulnerability database and reports the CVE, affected artifacts, CVSS severity, a short description, and a link to the advisory.

Analyze artifacts in isolation

The new command line option --isolated-scan analyzes every artifact on the classpath separately. This is useful for a classpath that contains multiple versions of the same library, or for a set of independent libraries such as plugins of a framework.

Other changes

Application

• Support the Java system properties jarhc.repository.url, jarhc.repository.username, and jarhc.repository.password to configure the Maven repository.
• Log an INFO message when an artifact cannot be identified by its checksum.

Report

• Add new section "Vulnerabilities", placed after "JAR Files".

Dependencies

• Merge the "Status" column into the "Direct dependencies" column, so each direct dependency is shown together with its status on the same line. This produces clearer diff reports.

HTML report

• Auto-expand the section targeted by the URL anchor, so deep links and bookmarks to collapsed sections open the right section automatically.
• Use central.sonatype.com instead of search.maven.org for checksum-based links.

Code

• Use Google's deps.dev API to identify artifacts by their checksum.
• Update plexus-utils to version 3.6.1 to fix CVE-2025-67030.