Only the latest release of DepClean is supported with security updates.

Please do not open a public issue for security vulnerabilities.

Instead, report it privately via GitHub private vulnerability reporting. Include:

• A description of the vulnerability and its impact
• Steps to reproduce or a proof of concept
• The affected version(s)

You will receive a response as soon as possible. Once the issue is confirmed and a fix is available, a security advisory will be published and the fix released.

Note that DepClean is a build-time analysis tool: it does not run in production environments, and it does not modify your source code or original pom.xml. Vulnerabilities in DepClean's own dependencies are tracked continuously via Dependabot and SonarCloud.