This is a tragic correctness bug that impacts at least 2.7 and 2.8. To reproduce:
mkdir repro && cd repro
echo "apply plugin: 'java'" > build.gradle
mkdir -p src/main/java
echo "public class T {}" > src/main/java/T.java
gradle jar
unzip -l build/repro.jar
# NOTE: T.class is present in jar
rm src/main/java/T.java
gradle jar
# NOTE: gradle claims jar is "up to date"
unzip -l build/repro.jar
# NOTE: T.class is still present. Cry deeply.
A clean fixes the issue, but the lack of correctness here is extremely confusing to the user when encountered. Moreover, once a bad artifact is produced, it could easily poison the caches of other tools or build environments that use gradle with the expectation of a properly reproducible build (as happened to me).
Given the severity of this issue, the ease with which it is reproduced, and the sheer volume of potentially impacted users, I think this is an extremely high-severity bug.