  Vulnerabilities from third-party libraries (TPLs) have been unveiled to
threaten the Maven ecosystem. Despite patches being released promptly after
vulnerabilities are disclosed, the libraries and applications in the community
still use the vulnerable versions, which makes the vulnerabilities persistent
in the Maven ecosystem (e.g., the notorious Log4Shell still greatly influences
the Maven ecosystem nowadays from 2021). Both academic and industrial
researchers have proposed user-oriented standards and solutions to address
vulnerabilities, while such solutions fail to tackle the ecosystem-wide
persistent vulnerabilities because it requires a collective effort from the
community to timely adopt patches without introducing breaking issues.
  To seek an ecosystem-wide solution, we first carried out an empirical study
to examine the prevalence of persistent vulnerabilities in the Maven ecosystem.
Then, we identified affected libraries for alerts by implementing an algorithm
monitoring downstream dependents of vulnerabilities based on an up-to-date
dependency graph. Based on them, we further quantitatively revealed that
patches blocked by upstream libraries caused the persistence of
vulnerabilities. After reviewing the drawbacks of existing countermeasures, to
address them, we proposed a solution for range restoration (Ranger) to
automatically restore the compatible and secure version ranges of dependencies
for downstream dependents. The automatic restoration requires no manual effort
from the community, and the code-centric compatibility assurance ensures smooth
upgrades to patched versions. Moreover, Ranger along with the ecosystem
monitoring can timely alert developers of blocking libraries and suggest
flexible version ranges to rapidly unblock patch versions. By evaluation,
Ranger could restore 75.64% of ranges which automatically remediated 90.32% of
vulnerable downstream projects.
