Software Engineering
Classport brings runtime dependency tracking to Java for supply chain security
Researchers introduce a system that embeds dependency metadata into Java class files, enabling applications to reveal which packages are actually in use during execution.
Java applications have long lacked a built-in way to observe which dependencies are active during runtime—a critical gap in software supply chain security. A new research blueprint called Classport bridges this gap by encoding dependency information directly into Java class files, making it possible to introspect and track which packages are being used as code executes.
The Problem#
Understanding dependency usage at runtime is essential for modern software security practices. Knowing which libraries are truly exercised during execution helps teams detect vulnerabilities, manage bloat, and respond to supply chain attacks. Yet Java provides no native mechanism for this kind of runtime visibility, leaving developers with incomplete visibility into their applications' actual dependency footprint.
How Classport Works#
Classport addresses this by embedding metadata about dependencies into the compiled Java class files themselves. When a Java application runs, this embedded information can be retrieved and queried, revealing which dependencies are currently active. The approach treats dependency introspection as a first-class concern in the Java compilation and runtime pipeline.
Validation#
The researchers validated their approach on six real-world Java projects, demonstrating that the system can reliably identify which dependencies are in use during program execution. The results show the feasibility of the approach across varied production code bases.