Chainguard Libraries for Java on

Chainguard Libraries for Java overview

Tue, 25 Mar 2025 08:04:00 +0000

Chainguard Libraries for Java provides enhanced security for the Java ecosystem by rebuilding dependencies from Maven Central and other common repositories with the latest patches and comprehensive supply chain protection. This service addresses critical vulnerabilities in the vast Java/JVM ecosystem that spans hundreds of projects from organizations like the Apache Software Foundation, Eclipse Foundation, and numerous independent maintainers.

Chainguard Libraries for Java provides access to all open source libraries commonly used. New releases of common libraries or artifacts requested by customers are added to the growing index by an automated system. The number of included libraries continues to grow. These artifacts are accessible through the Chainguard Repository, a single endpoint for package retrieval that supports configurable security policies for both Chainguard-built and upstream packages.

Global configuration

Tue, 25 Mar 2025 08:04:00 +0000

Java and JVM library consumption in a large organization is typically managed by a repository manager. Commonly used repository manager applications are Cloudsmith, Google Artifact Registry, JFrog Artifactory, and Sonatype Nexus Repository. The repository manager acts as a single point of access for developers and development tools to retrieve the required libraries.

The recommended approach is to use the upstream fallback feature of Chainguard Repository, which allows you to configure your repository manager with a single upstream pointed at https://libraries.cgr.dev/java/ without a separate fallback to Maven Central. The Chainguard Repository handles fallback and policy enforcement; your repository manager handles local caching and access control. Chainguard retrieves packages from the public Maven Central repository on your behalf when upstream fallback is enabled. This includes protections such as malware scanning and a cooldown period for newly published packages.

Configure Java build tools

Tue, 25 Mar 2025 08:04:00 +0000

Chainguard Libraries for Java works with your existing build tools — Maven, Gradle, and Bazel — through a repository configuration change. This page is a reference for configuring each supported build tool. It covers repository access, authentication, cache clearing, and minimal example projects.

Apply these changes on every workstation and build server that builds your applications or downloads libraries, including CI/CD infrastructure such as Jenkins, TeamCity, or GitHub Actions.

The https://libraries.cgr.dev/java/ endpoint is also the Chainguard Repository endpoint for Java. By default, it serves only Chainguard-built artifacts. When upstream fallback is enabled for your organization, the same endpoint can also serve requested versions from Maven Central under Chainguard security controls.

Manage and update dependencies

Tue, 25 Mar 2025 08:04:00 +0000

Chainguard Libraries for Java operates transparently after configuring your repository manager or your build tool, automatically providing security-enhanced versions of your Maven dependencies. After you configure Chainguard Libraries for Java, use this page for recurring maintenance tasks.

Chainguard Libraries serves Chainguard-built artifacts when they are available. When upstream fallback is enabled, an artifact that Chainguard has not yet built may first be served through Chainguard’s upstream tier. With build pinning, the exact package version remains pinned to the artifact tier your organization first received, so a previously downloaded upstream artifact is not immediately replaced when Chainguard publishes a built equivalent.

Migrating a Java project to Chainguard Libraries

Thu, 02 Jul 2026 00:00:00 +0000

Chainguard Libraries for Java provides a curated repository of packages rebuilt from upstream sources and scanned for malware. Because Chainguard Libraries uses the standard Maven repository format, switching an existing project requires only a repository configuration change — no changes to your application code or dependency versions.

This guide walks through migrating an existing Java project to Chainguard Libraries, covering the two most common setups:

Direct access — your build tool connects directly to libraries.cgr.dev. This option is faster for initial evaluation and smaller-scale setups.
Repository manager — your build tool connects to a repository manager (Cloudsmith, Google Artifact Registry, JFrog Artifactory, or Sonatype Nexus), which proxies requests to Chainguard Libraries.

To follow along with a ready-made project instead of your own, use the Chainguard Libraries for Java demo repository. It provides Maven and Gradle example projects, including a minimal Spring Boot application and CVE remediation demos.