All application components are identified and are known to be needed.

Purpose: Every library you add to the project raises the attack surface and may impact your security posture. It’s not only true for framework libraries like Struts 2 (e.g. CVE-2017-5638) or Spring MVC (e.g. CVE-2014-0054). It’s also true for util libraries like Apache Commons (e.g. CVE-2015-7501 ) and others.

Solution: Do not include any more dependencies to your project then actually needed. Always document why you need a certain library in the project, so you can remove the dependency if functionality gets deleted.

Find a solution that works best for you like writing comments in a pom.xml file, using Excel or documenting in a tool of your choice.