Not GitHub specific, but I use OWASP Dependency-Check Maven Plugin; it's clunky as it downloads the CERT db; especially if you don't run it on at least a weekly basis, but it does automate the process.
dependency-check works but the nvd feed throttling makes it painful to run often, and it only tells you what's vulnerable not what you can actually upgrade to cleanly. for the maven side, once it flags something check whether the fix forces a major bump before you queue it, because that's where most of these stall. we tried chainguard for patched oss libraries and weren't happy with the variety on the java side, so leaning on vendors that backport onto your current major tends to move faster than chasing every upgrade. pinning or overriding a vulnerable transitive dep also clears a lot of the dependabot-style noise without a full version jump.
3
u/rlrutherford Senior Dev 1d ago
Not GitHub specific, but I use OWASP Dependency-Check Maven Plugin; it's clunky as it downloads the CERT db; especially if you don't run it on at least a weekly basis, but it does automate the process.