maven-lockfile

Lockfiles for Maven. Pin your dependencies. Build with integrity.

Explore on GitHub Read Hacker News discussions

3Distinct people

3Mentions

0Explicit recommenders

71GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Lockfiles for Maven. Pin your dependencies. Build with integrity.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by 3-hour interval3 dated mentions

Observed mentions: 2025-03-15 03:22:50 UTC to 2025-03-16 20:51:00 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Comments
Mar 15, 03:00	2025-03-15 03:00:00 UTC	2025-03-15 06:00:00 UTC	2	2
Mar 15, 06:00	2025-03-15 06:00:00 UTC	2025-03-15 09:00:00 UTC	0	0
Mar 15, 09:00	2025-03-15 09:00:00 UTC	2025-03-15 12:00:00 UTC	0	0
Mar 15, 12:00	2025-03-15 12:00:00 UTC	2025-03-15 15:00:00 UTC	0	0
Mar 15, 15:00	2025-03-15 15:00:00 UTC	2025-03-15 18:00:00 UTC	0	0
Mar 15, 18:00	2025-03-15 18:00:00 UTC	2025-03-15 21:00:00 UTC	0	0
Mar 15, 21:00	2025-03-15 21:00:00 UTC	2025-03-16 00:00:00 UTC	0	0
Mar 16, 00:00	2025-03-16 00:00:00 UTC	2025-03-16 03:00:00 UTC	0	0
Mar 16, 03:00	2025-03-16 03:00:00 UTC	2025-03-16 06:00:00 UTC	0	0
Mar 16, 06:00	2025-03-16 06:00:00 UTC	2025-03-16 09:00:00 UTC	0	0
Mar 16, 09:00	2025-03-16 09:00:00 UTC	2025-03-16 12:00:00 UTC	0	0
Mar 16, 12:00	2025-03-16 12:00:00 UTC	2025-03-16 15:00:00 UTC	0	0
Mar 16, 15:00	2025-03-16 15:00:00 UTC	2025-03-16 18:00:00 UTC	0	0
Mar 16, 18:00	2025-03-16 18:00:00 UTC	2025-03-16 21:00:00 UTC	1	1

What Hacker News says

3 sources

bboreham·Mar 16, 2025

It seems to me that pinning to a sha was not sufficient; the Renovate bot was updating actions referenced by sha. Example: https://github.com/chains-project/maven-lockfile/pull/1111/f... This appears to be governed by the `pinGitHubActionDigests` helper configured in `renovate.json`.

In Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

mdaniel·Mar 15, 2025

heh, timing is everything https://github.com/chains-project/maven-lockfile/issues/1085... > After some cleanup the changed-files (https://github.com/tj-actions/changed-files) action seems to be more work to remove. It would be awesome if it could be added to the allowlist > Done. Allowed all versions of this action. Should I pin it to one version in the allowlist (won't be convenient if renovate updates this dependency)?

In Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

themgt·Mar 15, 2025

This is hilarious, the maven-lockfile project "Lockfiles for Maven. Pin your dependencies. Build with integrity" appears to have auto-merged a PR for the compromised action commit. So the real renovate bot immediately took the exfiltration commit from the fake renovate bot and started auto-merging it into other projects: https://github.com/chains-project/maven-lockfile/pull/1111

In Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos