Skip to content

Upgrade Dependency Scanning Gradle support to 7.6 or 8.x

Problem to solve

The default dependency scanning job uses gradle 7.3.3 (december 2021). This is now reporting additional vulnerabilities related to a google gson dependency for all of our 500+ projects (used in some of the default quality plugins included with gradle, like PMD). I'd like to request upgrading gradle to 7.6 or 8.x, as this older version also means new features in version 8 cannot be used.

I've considered the alternative of using a gradle wrapper, however this makes the job a lot slower as the job will also need to download the entire wrapper, adding quite some time and internet access to a job that already takes 60-90 seconds.

Implementation plan

  • upgrade the default version of Gradle (currently 7.3.3) to the latest 7.x (7.6.4) when using Java 17
  • upgrade the version gradle (currently 8.4) to the latest 8.x (8.8) when using Java 21ase.
  • update the Dependency Scanning documentation (check various section where gradle is mentioned)
  • update the tests (we can probably clean them up and remove old releases there)
Edited by Olivier Gonzalez