[fleizean]

Summary

Adds Maven Central as a registry. You can compare versions of groupId:artifactId packages (com.google.guava:guava, com.fasterxml.jackson.core:jackson-databind, ...) and see their advisories, health and behaviour data. Dependency-file audits (pom.xml, Gradle version catalogs and lockfiles) come in a follow-up PR.

Why

Java is one of the largest ecosystems and was the only one shown as "coming soon": the maven registry row has been seeded disabled since the start. Maven is also the best-covered ecosystem on the security side: OSV, deps.dev and Socket all support it.

Changes

• Versions: MavenService reads maven-metadata.xml from repo1.maven.org.
  • New VersionScheme.Maven and MavenVersion port Maven's ComparableVersion: alpha < beta < milestone < rc < snapshot < release (ga, final) < sp < other qualifiers. 1.0.0 equals 1-ga, and m1 means milestone 1.
  • alpha, beta, milestones, rc, snapshots, preview, ea and dev count as pre-releases.
  • Qualifiers such as Guava's -jre and -android do not count as pre-releases.
• Publish dates: read from the Central search API (search.maven.org/solrsearch). It gets a 10 s client of its own, because a slow answer only costs the dates, not the page. A date that is still missing comes from the Last-Modified header of the version's .pom.
• Repository: read from the POM's scm URL, connection, developer connection, project URL and issue tracker, in that order.
  • Up to four parent POMs are followed.
  • ${...} properties are filled in, with the child's values winning and project.* naming the artifact itself.
  • A parent's address only counts when the parent shares the artifact's group, or when the address is built from the artifact's own properties. This keeps generic corporate parents from pointing at the wrong repository.
  • Everything is read once per request scope.
• Release notes: MavenRegistryClient uses GitHubFirstScrapingStrategy (PublishesReleaseNotes = false). GitHubScraperService now:
  • tries the artifact id as a tag prefix (jackson-databind-2.17.0);
  • matches 6.4.0.Final / 5.3.0.RELEASE / x.GA to a 6.4.0 or v6.4.0 tag.
• Exclude patterns: they are plain substring matches, and final and release are active by default, so every Hibernate and pre-5.3 Spring release would have been hidden. ListedVersionsRegistryClient.FilteredSpelling lets Maven drop those release-equivalent suffixes before the patterns are checked. The version itself keeps its registry spelling.
• Names: RegistryNames.Maven = "maven" and a groupId:artifactId grammar. The group has no empty parts, because its dots become folders.
• Security: OSV Maven, deps.dev MAVEN (group:artifact), Socket pkg:maven/group/artifact@version.
• Registry row: the seeder now enables the existing maven row (seeded disabled while Maven had no client), or adds it when missing. Fresh databases seed it enabled. The Packagist start-up check moved into the same EnsureRegistryAsync helper.
• Frontend:
  • Maven <dependency> and Gradle implementation(...) snippets.
  • The Central link uses group/artifact.
  • Rose badges and home examples.
  • Maven added to the SEO, privacy and terms copy.
• Tests: tests that used maven as the example of an unknown registry now use cargo. The test registry factory and the registry-name tests include Maven.

Notes for reviewers

• The seeder re-enables the maven row on every start-up, as it already does for pypi. Disabling Maven later from the admin panel would not stick until that line is removed.
• Not verified locally: no build, test or live request against Maven Central was run. CI is the check.
• Known gaps:
  • Apache projects tag rel/commons-lang-3.14.0 and keep notes in JIRA, so their notes will mostly be empty.
  • Guava lists -jre and -android variants side by side in the version list.
  • search.maven.org is known to be slow at times; dates then come from Last-Modified or stay empty in the version list.

Checklist

• The pull request targets develop and is about one thing
• Commit messages follow Conventional Commits (feat(scope): ..., fix(scope): ...)
• CI is green (backend tests, frontend build and tests, dependency gate)
• Schema changes are EF Core migrations generated by the tool, not hand-edited
• A changed backend DTO has its TypeScript twin updated in src/frontend/src/app/core/models
• New dependencies are justified and their lock files are updated in the same commit
• No secrets, tokens or personal data in code, logs or this description
• Code comments are kept to a minimum; the reasoning lives in this description