Does the advisory database cover other maven repositories?

Open

#2,900 opened on Oct 31, 2023 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 25/100

Issue type: Feature
Clarity: Needs clarification
Activity status: Stale
Tech stack: java
Domain: security

Research direction

Start by comparing the Atlassian repository URL with the corresponding Maven Central path and review how the advisory database currently identifies Java packages. Check the Maven repositories listed in the linked MVN Repository page, then define which additional repositories are in scope and how coverage would be verified; the issue provides no files or tests to run.

Written by the indexing model from the issue text.

Description

As best as I can tell, most of the current Java packages cover Maven Central and not other maven repositories

For example the Atlassian maven repo
https://packages.atlassian.com/content/repositories/atlassian-public/com/atlassian/
contains confluence Java packages where Maven Central does not
https://repo.maven.apache.org/maven2/com/atlassian/

If we look at the MVN Repository site, we can see the top maven repositories
https://mvnrepository.com/repos
(there are shockingly more of these than I expected)

Thanks in advance

Dominant language: No language data
Stars: 2.5k
Forks: 772
Avg merge: 3d 15h
Merged PRs (30d): 46

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[GOOD FIRST ISSUE]: Clean Up Frontend Authentication Page & Context Open

good first issue

Difficulty 1/5 Under an hour Newbie friendliness 95/100

AOSSIE-Org/DebateAI#582 · 2 comments · Opened Sep 24, 2026
Bump transitive axios to >=1.18.0 to address GHSA-hcpx-6fm6-wx23 Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

coinbase/cdp-sdk#828 · Opened Sep 24, 2026
Bump protobufjs to >=7.5.5 to address GHSAs (transitive via @oasisprotocol/client) Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

oasisprotocol/oasis-sdk#2523 · Opened Sep 24, 2026
Refuse a published or short `METRICS_TOKEN`, as the other credentials are Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

linagora/openrag#1041 · Opened Sep 24, 2026
Add Jorge’s new GPG key and sops updatekeys on existing secrets Open

cost:cheap severity:medium

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

fairagro/m4.2_sql_to_arc#227 · Opened Sep 24, 2026

More Security issues