Gradle is happy to announce a technical partnership with GitHub focusing on multiple areas, starting with supply chain security and developer experience. With this partnership, we establish a direct connection between organizations and plan to cooperate on integrations between GitHub and Gradle to p…

I hope this means dependabot will soon start working correctly. Instead of thinking that version catalog dependencies are all actually used… and ideally making correct pull requests with lockfiles. Definately security issues shouldn’t be created if the deps aren’t used. P.S. I’d be ok with PR’s tha…

Now addressed - Dependabot support for Gradle lockfiles is now generally available - GitHub Changelog

Gradle partners with GitHub on supply chain security

News Blog + Comments

onenashev (Oleg Nenashev) April 18, 2024, 7:15am 2

We’re live! Thanks to all contributors who participated in the release and GitHub Actions evaluation, and kudos to @daz who did most of the implementation and documentation for this project!

Topic		Replies	Views
Avoiding the Next Supply Chain Disaster with GitHub and Gradle Blog + Comments	3	42	February 26, 2026
Testing Gradle dependencies for security vulnerabilities News	2	1770	August 3, 2017
Detecting Maven-Hijack-style risks in Gradle builds with the Dependency Analysis Gradle Plugin Blog + Comments	5	63	December 10, 2025
Need a lockfile, but do not want to use it Help/Discuss	18	2663	September 30, 2024
8.4 Build Tool	2	824	October 4, 2023

Gradle partners with GitHub on supply chain security

Related topics