Ecosystem · Java · Kotlin · Maven, Gradle

Vulnerabilities in your Maven and Gradle dependencies, without a pipeline.

LibWatch reads pom.xml, your Gradle scripts and your version catalogs, checks every Maven dependency and tracks your Java, Kotlin, Gradle and Android versions.

Analyze a Java or Kotlin project See a sample alert
Read with an AI .md version

What LibWatch reads in the repository

  • pom.xml
  • build.gradle(.kts)
  • settings.gradle(.kts)
  • libs.versions.toml
  • gradle.lockfile

Language version: Java, Kotlin, Gradle, Android plugin, Android SDK

Nothing else: no cloning, no code run.

What LibWatch checks

The dependencies, and the whole build chain

Maven dependencies

Known vulnerabilities

Every dependency checked against OSV, which includes GitHub advisories.

Android

Target SDK and Google Play

The Android target SDK is compared with Google Play requirements.

Health

License policy

Incompatible licenses and unmaintained dependencies.

An alert, in practice

A Maven vulnerability, with the version that fixes it

The vulnerabilities that affect your versions, with the fixed version. Nothing more.

Real severity

CVSS severity and presence in the CISA KEV catalog

What to do

The fixed version, and the affected project

Where

Email, Slack, Zulip or webhook, set per project

field-app · Android

Example · analysis from October 22

  • Android target SDK

    targetSdk 33

    Below Play requirement

  • com.squareup.okhttp3:okhttp

    4.9.0

    Medium severity

  • Kotlin

    2.1.0

    Up to date

Rechecked every night at 2 a.m.

Tracked versions

The versions declared in your Gradle and Maven files are tracked.

  • Java (toolchain)
  • Kotlin
  • Gradle
  • Android Gradle Plugin
  • Android minimum SDK
  • Android target SDK

Get started

Your first report in a few minutes

No pipeline to change.

Connect GitHub or GitLab

Self-hosted GitLab instances included.

Choose your Java and Kotlin repositories

LibWatch finds the files listed above on its own, even in a monorepo.

Read the report, set up alerts

Exploited vulnerabilities first, fixed versions, language end of life.

Learn more

End of life

Your language too

Why LibWatch tracks your language version.

Learn more

SBOM

Export to CycloneDX or SPDX

A machine-readable bill of materials, for your customers and the CRA.

See the export

Pricing

Per project, seats included

From €39 to €299 excl. VAT per month.

See pricing

Frequently asked questions

LibWatch, Java and Kotlin

Do I need to install anything in the project?

No. LibWatch reads dependency files through the GitHub or GitLab API, without adding anything to your pipeline.

Are private registries supported?

Yes. A package from a private registry is identified as such: its name is never sent to a third-party service, and it stays in the project's inventory.

Does LibWatch detect the version installed on the server?

No. LibWatch reads the version declared in the repository (version file, lockfile or manifest). It has no access to your servers.

Your Java and Kotlin projects, checked tonight.

Analyze a project
Hosted in France by OVHcloud