> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/supported-languages/supported-languages-list/java-and-kotlin.md).

# Java and Kotlin

Snyk support for Java and Kotlin with Snyk Code and Snyk Open Source, including SCM import, CLI and IDE testing, and Maven and Gradle

## Applicability and integration

{% hint style="info" %}
Java and Kotlin are supported for Snyk Code and Snyk Open Source.
{% endhint %}

Available integrations:

* SCM import
* CLI and IDE: test or monitor your app

{% hint style="info" %}
**Release status**

Improved Gradle SCM scanning is in Early Access. For more information, visit [SCM integrations for Java and Kotlin](/supported-languages/supported-languages-list/java-and-kotlin/git-repositories-with-maven-and-gradle.md).
{% endhint %}

## Technical specifications

Snyk supports Java analysis for Java versions up to SE 25 and is designed to process code from newer Java versions where feasible.

### Supported frameworks and libraries

For Java and Kotlin, Snyk supports the following frameworks and libraries:

{% columns %}
{% column %}

* Amazon AWS SDK
* Amazon AWS SDK DynamoDB, including the Enhanced Client
* Android Standard Library
* Apache Camel
* Apache Commons
* Apache Commons Collections
* Apache Commons FileUpload
* Apache CXF
* Apache Tomcat
* Apache XML
* apache.mahout
* bouncycastle
* com.azure.ai.openai
* com.google.ai.client.generativeai
* com.google.cloud.vertexai.generativeai
* com.google.re2j
* com.google.gwt
* Dropwizard
* elasticsearch
* FasterXML Jackson
* Flyway
* Google API Client
* Google Cloud BigQuery
* Google Guava
* Google OAuth Client
* grpc-java
* hibernate
* http4k
* io.jsonwebtoken
* Jakarta EE
* Jakarta XML Services
* Java EE
* Java Servlet
* Java Servlet (javax)
* Java Server Pages
* Java Standard Edition
* javalin
* Jax-RS
* JAXB
* Jolokia
* jooq
  {% endcolumn %}

{% column %}

* Kryo
* Micronaut
* mongo-java-driver
* MSAL4J
* Netty
* okhttp3
* org.apache.hc.client5
* org.apache.http.client
* org.apache.sling
* org.apache.tools.zip
* org.codehaus.plexus
* org.dom4j.io
* Playframework
* rxhttp
* SAP Commerce (Hybris)
* Seam logger
* SnakeYaml
* Spongycastle
* Spring AI
* Spring boot
* Spring Cloud Config
* Spring Data MongoDB
* Spring Security OAuth2 Client
* Spring Web, MVC and JDBC
* Spring WebFlux
* Struts
* Vaadin
* Vert.x
* XStream

Kotlin only:

* Android Standard Library
* com.aallam.openai
* com.expediagroup.graphql.server
* Javalin
* Ktor
* Kotlin Standard Library
* khttp
  {% endcolumn %}
  {% endcolumns %}

For SAP Commerce (Hybris), Snyk Code analyzes FlexibleSearch queries for SQL injection. This is supported for Java only. Snyk Code recognizes values supplied through query parameter binding as safe and does not report them.

For Google Cloud BigQuery, Snyk Code recognizes query parameters created with `QueryParameterValue.of()` as safe and does not report them for SQL injection. This is supported for Java only.

### Supported package managers and package registries <a href="#supported-package-managers-and-package-registries" id="supported-package-managers-and-package-registries"></a>

* Supported package managers: [Maven](https://maven.apache.org) and [Gradle](https://gradle.org), with the following supported versions:
  * Maven: `3.*`, `4.*`. For more information, visit the [Snyk Maven plugin readme](https://github.com/snyk/snyk-mvn-plugin#support).
  * Gradle: `4.*`, `5.*`, `6.*`, `7.*`, `8.*`, `9.*`. For more information, visit the [Snyk Gradle plugin readme](https://github.com/snyk/snyk-gradle-plugin#support).
* Supported package registry: [maven.org](https://maven.org/) (Maven Central Repository)

## Java and Kotlin for Snyk Code

For an overview of the supported security rules, visit [Java rules](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-code/snyk-code-security-rules/java-rules) and [Kotlin rules](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-code/snyk-code-security-rules/kotlin-rules).

### Supported file formats

For Java and Kotlin, Snyk Code supports the following file formats:

* For Java: `.java`, `.jsp`, `.jspx`
* For Kotlin: `.kt`

### Available features

* Reports
* Interfile analysis: fully supported for Kotlin
* Interfile analysis: partially supported for Android

### Template file analysis

Snyk Code parses template files and follows data from your application code into the template, so it reports a cross-site scripting vulnerability that becomes exploitable only where the template renders its output.

For Java and Kotlin, Snyk Code supports the following template engines:

* FreeMarker
* Thymeleaf
* Velocity

For file extensions and the full set of supported language and template engine combinations, visit [Template file analysis](/supported-languages/technical-specifications-and-guidance.md#template-file-analysis).

## Java and Kotlin for Snyk Open Source

### Supported file formats

For Java and Kotlin, Snyk Open Source supports the following file formats:

* For Maven: `pom.xml`
* For Gradle: `build.gradle`, `build.gradle.kts`

### Available features

* Reports
* License scanning
* Fix PRs (for Gradle, only fix advice is available)
* Test your app's software bill of materials (SBOM) and packages using `pkg:maven` PURLs through the [SBOM test](https://docs.snyk.io/developer-tools/snyk-cli/snyk-cli/commands/sbom-test) CLI command

## Validating, monitoring, alerting, and gating for Java and Kotlin

For SCM integrations, you can [run PR Checks](https://docs.snyk.io/scan-fix-and-prevent/prevent/pull-request-checks) to validate submitted changes to code and open source packages before merging. Snyk can also retest and alert on the default branch on a scheduled basis. You can see the results on the **Projects** page.

For continuous integration/continuous delivery (CI/CD) integrations, Snyk can passively monitor and provide a QA gate by failing build checks during testing for policy violations.

Snyk provides flexible capabilities, including:

* [Gradle plugins](https://snyk.io/blog/gradle-plugin-by-snyk-gradle-dependencies-scanning/) (Community project)
* [Maven plugins](https://snyk.io/blog/snyk-maven-plugin-integrated-security-vulnerability-scanning-for-developers/)
* Dedicated plugins for Jenkins, CircleCI, and others (visit the relevant marketplaces)
* [GitHub Actions](https://snyk.io/blog/building-a-secure-pipeline-with-github-actions/)
* The Snyk CLI, which you can use in most CI/CD systems (visit the [examples](https://github.com/snyk-labs/snyk-cicd-integration-examples))
  * Fail the build based on criteria using options or the [snyk-filter](https://docs.snyk.io/developer-tools/snyk-cli/snyk-cli/scan-and-maintain-projects-using-the-cli/cli-tools/snyk-filter) tool
  * [Containerized](https://hub.docker.com/r/snyk/snyk) versions of the Snyk CLI
* Partner platforms: Azure, Bitbucket, and AWS have built-in pipes and components for use with Snyk. For Java, Snyk recommends using the SCM integration with Bitbucket Cloud or using the CLI instead of the prepackaged Bitbucket Pipe.

Using the Kubernetes integration, Snyk can monitor container images and their open-source or Linux-based packages used in production, and notify you of known vulnerabilities in applications in production. This feature is available only for Enterprise plans.

Where a production integration does not exist, use the [snyk monitor](https://docs.snyk.io/developer-tools/snyk-cli/snyk-cli/commands/monitor) CLI command to take a snapshot and monitor what is being pushed to production (available for all plans).

## Java support for BOM

Maven supports [bill of materials (BOM) POM files](https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#bill-of-materials-bom-poms) to centralize dependency versions known to work together.

A BOM file includes:

* a `pom` packaging type: `<packaging>pom</packaging>`
* a `dependencyManagement` section

Third-party projects can provide BOM files to simplify dependency management. Common examples include the following:

* [spring-data-bom](https://github.com/spring-projects/spring-data-bom): The Spring team provides a BOM for the Spring Data project.
* [jackson-bom](https://github.com/FasterXML/jackson-bom): The Jackson project provides a BOM for Jackson dependencies.

Example of a BOM file:

{% code title="Example 1 - BOM file" %}

```xml
<project ...>
    <modelVersion>4.0.0</modelVersion>
    <groupId>snyk</groupId>
    <artifactId>snyk-bom</artifactId>
    <version>1.0</version>
    <packaging>pom</packaging>
    <name>Snyk Bill Of Materials</name>
    
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>log4j</groupId>
                <artifactId>log4j</artifactId>
                <version>1.2.12</version>
            </dependency>
            <dependency>
                <groupId>commons-logging</groupId>
                <artifactId>commons-logging</artifactId>
                <version>1.1.1</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
</project>
```

{% endcode %}

The `dependencyManagement` section contains dependency elements. Each dependency is a lookup reference for Maven to determine the version to select for transitive (and direct) dependencies.

A dependency defined in the `dependencyManagement` section is only a lookup reference. Maven does not add it to the dependency tree of the Project.

You can run `mvn dependency:tree` on the previous BOM example to show that Maven does not treat the contents as dependencies of the file itself.

You can import this BOM into a Project POM as a parent. You do not need to specify the `log4j` version, because the Project POM inherits it from the BOM:

{% code title="Example 2 - Project POM" %}

```xml
<project ...>
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>snyk</groupId>
        <artifactId>snyk-bom</artifactId>
        <version>1.0</version>
    </parent>
    
    <groupId>snyk</groupId>
    <artifactId>snyk-project</artifactId>
    <version>1.0.0-SNAPSHOT</version>
    <packaging>jar</packaging>
    <name>Snyk Project</name>
    <dependencies>
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
        </dependency>
     </dependencies>
</project>
```

{% endcode %}

Snyk applies the versions in the BOM `dependencyManagement` lookup to any dependencies declared in Project POMs that import it as a `parent`.

When Snyk scans BOM files, Snyk does not consider the `dependencyManagement` contents to be dependencies of that file. They are only lookups.

For the previous examples, Snyk analyzes and treats the files as follows:

* BOM file: Snyk does not create a Snyk Project for this file because it has no dependencies.
* Project POM: Snyk creates a Project with a single dependency, `log4j`, with `v1.2.12`. Snyk applies the rules from the parent BOM to identify the correct version for `log4j`. The dependency `commons-logging` is not included, as it is not directly declared in the Project POM.

{% hint style="info" %}
This example uses `log4j 1.x` to demonstrate BOM version inheritance. log4j 1.x is end-of-life and has known vulnerabilities, so Snyk does not recommend using it.
{% endhint %}

{% hint style="info" %}
If a BOM has direct dependencies outside `dependencyManagement`, then Snyk creates a Project for that BOM.
{% endhint %}

Snyk also offers fix advice, including recommendations to upgrade vulnerable packages through the [Fix PR feature](https://docs.snyk.io/scan-fix-and-prevent/fix/pull-requests#snyk-fix-prs).

Snyk can create Fix PRs only for dependencies whose versions are managed in the POM file where Snyk reports the vulnerability.

If the version or dependency is managed in a parent BOM, then even though Snyk sees that it could fix the vulnerable path by changing the version, it cannot apply the fix.

Visit the following resources for Java developers on security topics and best practices:

* [Snyk Blog](https://snyk.io/blog/)
* [Securing your modern software supply chain](https://snyk.io/blog/software-supply-chain-security/)
* [Snyk for secure Java development](https://snyk.io/blog/snyk-for-secure-java-development/)
* [Advanced IntelliJ debugger features](https://snyk.io/blog/advanced-intellij-debugger-features/)
* [Spring4shell: the zero day RCE Spring Framework explained](https://snyk.io/blog/spring4shell-zero-day-rce-spring-framework-explained/)
* [Log4j vulnerability explained: Prevent Log4Shell RCE by updating to version 2.17.1](https://snyk.io/blog/log4j-rce-log4shell-vulnerability-cve-2021-44228/)
* [Best practices for managing Java dependencies](https://snyk.io/blog/best-practices-for-managing-java-dependencies/)
* [Exploring the Spring security authorization bypass (CVE-2022-31692)](https://snyk.io/blog/spring-security-authorization-bypass-cve-2022-31692/)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.snyk.io/supported-languages/supported-languages-list/java-and-kotlin.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.