Shadow 8.3.7 brings Gradle 9 support! Note: only Gradle 9 support is being backported to this version. No additional features or crucial bug fixes will be included in the 8.x line. Please migrate to Shadow 9 as soon as possible. https://github.com/GradleUp/shadow/releases/tag/8.3.7

Ahead of OSSRH deprecation (tomorrow), I have just released the first RC of nmcp for your Maven Central publishing needs: https://github.com/GradleUp/nmcp/releases/tag/v1.0.0-rc.0

Shadow 9.0.0-rc1 is out! This release is a major update from the 8.3.x series. The plugin has been fully rewritten in Kotlin, bringing significant improvements to maintainability, performance, and future extensibility. It introduces many new features, enhancements, and bug fixes, and includes several breaking changes. Please review the changelog carefully and consult the [new doc site](https://gradleup.com/shadow/) before upgrading. https://github.com/GradleUp/shadow/releases/tag/9.0.0-rc1

I've told this story before at conferences and events, but never in this format. I figured it was time to dust off some old research I'd done and tell the story with a fresh spin and the context offered by hindsight. Want to know what to do when you find systemic security vulnerabilities impacting the JVM ecosystem? This is how you burn them with fire 🔥 https://medium.com/@jonathan.leitschuh/burn-it-with-fire-how-to-eliminate-an-industry-wide-supply-chain-vulnerability-12515516fb56

New #C06T03MSEAX release 🎉

id("org.gradlex.java-module-packaging") version "1.1"

Combine it with other

org.gradlex

plugins for smooth dependency management and modern Java workflows to build self-contained, installable Java apps with the Java Module System and

jpackage

. 🧩 📦 🚀 Special thanks to JabRef project for collaborating closely on this — they now rely on GradleX plugins to streamline their packaging. 👉 https://github.com/gradlex-org/java-module-packaging

Kotlin Grants program is open for applications till Jul 31: https://kotlinfoundation.org/grants/

gsoc All five Gradle-focused Google Summer of Code projects in the Kotlin Foundation have passed the mid-term evaluation and continue to the next phase! All contributors have delivered some code, including new Gradle plugins and compatibility patches to existing plugins like Detekt or Nebula Lint Plugin. Here are the raw videos for the projects below. We will be sharing public versions in the blog posts later: • Better Reporting and Parallel Verifications in the IntelliJ Platform Gradle Plugin – Gradle Reporting and Parallel Verifications by @Victoria Alajemba • Enhanced Kotlin Code Quality Reporting: Gradle Problems API integration for the Detekt plugin by @Vanessa Johnson • Gradle Convention Plugin for Developing Jenkins Plugins by @Aarav Mahajan • Improving Configuration Cache compatibility in key Gradle plugins, including Nebula Lint Plugin by @Nouran • Improving Maven Central publishing DevEx for Gradle - support for org defaults and pre-publishing artifact verification by @Yongjun Hong If you are interested in learning more, see the Project Pages and the List of GSoC 2025 Deliverables—Mid-Term Evaluation, and join the discussion channels there. Kudos to all contributors and @Jakub Chrzanowski, @sghill, @rahulsom,@Rafael Chaves, @Rodrigo Oliveira,@Reinhold Degenfellner, @Donát Csikós for being mentors this year! 🙇

The 4th release candidate for Gradle 9 is out! 🚀 We want to ship the final version very soon, and we'd appreciate your feedback and any regression reports in GitHub issues or #C06UQDR75EC - https://docs.gradle.org/9.0.0-rc-4/release-notes.html

👋 Hello, team!

Shadow 9.0.0 is out! This release is a major update from the 8.x series. The plugin has been fully rewritten in Kotlin, bringing significant improvements to maintainability, performance, and future extensibility. It introduces many new features, enhancements, and bug fixes, and includes several breaking changes. Please review the changelog carefully and consult the new doc site before upgrading. If you really don't want to upgrade, you can still use the 8.3.x, which is also Gradle 9 compatible. But no additional features or crucial bug fixes will be included in the 8.x line. https://github.com/GradleUp/shadow/releases/tag/9.0.0

Infrastructure as Code plugin suite 2.4.0 is out! See https://iac-gradle.ysb33r.org for docs. With this release, we are effectively feature complete on both OpenTofu & Terraform support. We also support the publication of OpenTofu & Terraform modules as well as document generation via the

terraform-docs

tool. In the support of these tools via Gradle, it mostly out-does

terragrunt

in the mgmt of infrastructure. And it does so in a very gradlesque way. With this plugin suite, you can. • Manage multiple source sets of infrastructure. • Declare (tf) workspaces per source set. • Do 98% of all thing you would do with these tools, with a strong convention i.e. If you have source set called

database

and you have a workspace declared as

production

, you can apply it with a

tfDatabaseApplyProduction

. Behind the scenes, Gradle will switch to the correct workspace, place all of the necessary secrets in the env, run in the correct source directory, and execute your

tofu / terraform

command. Gone are all the accidental errors due to forgetting to change directories or switch workspaces! • You can have dependencies between source sets. For instance, if you have have to ensure that all of your updates to your database infra has to occur before you update your data pipeline infra, you can declare that relationship in the DSL and Gradle ensures that tasks are executed in the correct order for both

apply

and

destroy

cases. • You can even declare relationships between source sets in different subprojects and it will still allow the subprojects to be compatible with Isolated Projects and allow parallel execution where there are no relationships. • You can run infrastructure tests as part of the

check

lifecycle and get an HTML report. P.S. If you thought that Gradle is just for building JVM apps, think again - it is still the best tool out there today for orchestrating the whole pipeline.

GradleTest 4.1.0 is out with (preliminary) support for testing Gradle 9.0. See: https://gradletest.ysb33r.org NOTE: Out-of-the-box it will remove 9.x from the test sets if you are not building your plugin with JDK17+. There is a workaround for that, but it currently requires a bit of scaffolding. A future release will take care of it by using Jvm Toolchains and remove the scaffolding.

📣 Gradle 9.1.0 RC1 is out and ready for testing 🔬 https://docs.gradle.org/9.1.0-rc-1/release-notes.html ☕ Full Java 25 support 🔧 Native task graph visualization 💼 Enhanced console output 🐛 Bug fixes Please report any discovered issue on GitHub!

Hi all! I’ve been working with GSOC to integrate the Gradle problems API into Ktlint & Detekt. Free feel to take a look at the linked PRs (work in progresses). I would say Ktlint is closer to being merged in! I’ll have a follow up about Ktlint in the coming days! This is the project page if you want to read a little more about the problems api!

The 2025 edition of Kotlin Developer Survey by JetBrains is live - https://surveys.jetbrains.com/s3/68aaa1b4656e

Asciidoctor Gradle 4.0.5 is out. This is primarily an update from @Justin Van Dort with the removal of

SelfResolvingDependency

. Work on getting Asciidoctor Configuration cache compatible and Gradle 9.x ready, is slowly underway and will be there in the 5.0 release. Don't ask me when - it is done on a best effort basis.

[GSoC / Maven Central Utility Plugins for Gradle] Version 0.1.7 Released! 🚀 Hello everyone! I’d like to introduce a Gradle plugin I developed during the GSoC project. This plugin helps you manage Maven POM metadata more easily and efficiently, making artifact signing, POM validation, and hierarchical POM configuration much simpler. Main features: • Define a POM in the root project and manage it hierarchically • Artifact signature verification • POM validation • Automated checks for required fields In this release (v0.1.7), we’ve: • Fixed issues related to the

license

field • Redefined required fields • Completed the documentation You can check the updates and download the latest plugin here: • https://plugins.gradle.org/plugin/io.github.yonggoose.maven.central.utility.plugin.check • https://plugins.gradle.org/plugin/io.github.yonggoose.maven.central.utility.plugin.project • https://plugins.gradle.org/plugin/io.github.yonggoose.maven.central.utility.plugin.setting • Release notes: https://github.com/YongGoose/Maven-Central-utility-plugins-for-Gradle/releases/tag/v0.1.7 For usage instructions, you can refer to the docs directory for a simple guide: https://github.com/YongGoose/Maven-Central-utility-plugins-for-Gradle/tree/main/docs I’d really appreciate it if you could try it out and share your feedback! Special thanks to my mentor @Oleg Nenashev for continuous guidance and support throughout the project 🙏

earlier this week I gave a public talk about Dependency Management for Java https://docs.google.com/presentation/d/1oYAZuGnDbT2OFVZQJ3ws8l_WFTU7dPH0GLob2FEU_TM/edit?usp=drivesdk

Hacktoberfest signups are live! https://hacktoberfest.com/ In 2025, we are not doing proactive outreach or promotion for Gradle projects, but everyone is welcome to add their Gradle related repositories for Hacktoberfest 🙏 Thanks to all contributors

🚀 Big news for the Gradle community! We're excited to share that Gradle now officially maintains the Gradle image on Docker Hub 🎉 👉 Docker Hub – Gradle This means you'll get: ✅ Trusted, up-to-date Gradle Docker image releases ✅ Support from official Gradle channels including Slack and the Community Forum Thank you to Keegan Witt, who has maintained the Gradle Docker image for years. Try it out:

docker pull gradle:latest

I am happy to announce a 5.0.0-alpha.1 release of Asciidoctor Gradle. There are a number of missing bits in this release, but I wanted it to get out so that people can play with the new DSL model and provide feedback. Firstly, the old DSL from 4.0 is still supported, and you can get using them by appending

classic

to any plugin identifier. For instance if you used

org.asciidoctor.jvm.pdf

, you can use

org.asciidoctor.jvm.pdf.classic

. There have been no big fixes to the classic plugins, beside upgrading some dependencies and having better compatibility with later JDKs. There has been no attempt to make the classic plugins configuration cache compliant. Now on the the new model. Instead not having a mix of configuration spread between extensions and tasks, everything in the new model is configured from a single block

asciidoc

. In here all of the toolchains, asciidoctor extensions, output formatters, source sets etc. are defined. The model takes care of creating all of the necessary tasks behind the scenes and a build script author has no need to touch the task configuration at all. This is also a step in the direction of a future declarative Gradle DSL. The way the model is structured, it even allows for

asciidoctor.js

and

asciidoctorj

to be mixed. You can for instance, produce the docbook output with

asciidoctor.js

and pdf output with

asciidoctorj

from the same source set. You may ask why one would want to do this, but this allows for working (nearly transparently) with backends that are only supported on specific engines. Some highlights from the new model: - Hopefully have fixed a lot of the issues with GEMs etc. that have plagued people in the past. - Support for adding extensions from NPM modules should be alot easier now. - Kroki support for both asciidoctorj and asciidoctor.js - Reveal.js support for both asciidoctorj and asciidoctor.js Compatibility: Minimum of Gradle 7.3.3. Using asciidoctorj on the new model and the classic plugins requires JDK11 as a minimum. Asciidoctor.js support still needs a minimum of JDK8. The following is not yet supported on the new model: - Extensions written with the Groovy DSL module. - Asciidoctor.js does not work on Windows yet. - Multi-language support. -

gradle-relative-srcdir

. - Source mapping is still off. It needs to be turned on in the DSL. In future it might becomes the default for asciidoctorj. - Downloading PDF themes for repositories other than Github & Gitlab. - There is a bug in Gitlab downloads for PDF themes. To read more please see the documentation is at https://docs.asciidoctor.org/gradle-plugin/5.0/. Please raise any issues you come across at https://github.com/asciidoctor/asciidoctor-gradle-plugin. Be aware that priority will be given to issues on the new model over ones in the classic plugins.

Simplified JRuby plugin 2.2.0 is out with one headline feature. It has first class support for

<http://gem.coop|gem.coop>

. If this is your thing, just use

<http://ruby.coop|ruby.coop>()

instead of

ruby.gems()

https://jruby-gradle.ysb33r.org/jruby-simple/2.2.0/rubygem-repositories.html#_customising_gem_repositories P.S. For Asciidoctor Gradle people, this will be in the 5.0.0-alpha.2 release.

A whole slew of plugins just got released. Cloud CI 5.1.0 Doxygen 2.1.0 Git Publish 0.5.0 GNU Make 2.1.0 GradleTest 4.2.0 IaC (Terraform, OpenTofu, TfDocs) 2.5.0 Ivypot 2.1.0 Javascript Ecosystem 5.0.0-alpha.2 Operating System 2.1.0 Simplified JRuby 2.3.0 (Better support for some problematic GEMs). And along the way Grolifant was updated to 5.5.1

I've just released v3.3.0 of the Dependency Analysis Gradle Plugin (DAGP)

A bit more news here. For years @Marcin Erdmann maintained the Webdriver Binaries plugin and did a jolly good job with it. As things go with OSS projects, sometimes single maintainers develop other priorities in life and project upkeep falls behind. So I am happy to announce that we have taken over the Webdriver Binaries plugin, made it compatible with configuration-cache and Gradle 9 and released it under a new plugin id

org.ysb33r.webdriver-binaries

with version

4.0.0

. You can find the documentation here, and the new project home is here. Contributions will be welcomed of-course. Please read the release notes before upgrading, as there are a number of breaking changes in the DSL.

Paper: Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order arxiv.org/pdf/2407.18760

🥇 Today was the first release of the Gradle Utilities plugin. It provides an extension called

grolifantOps

which contains quite a number of useful utilities for buildscript authors. People that authored plugins using Grolifant as a library might be familiar with a number of them already, but this plugin is aimed that at those that need more power when actually authoring `build.gradle(.kts)`files. All of the functionality is not yet described in the documentation, but you can get a good taste of some of the things already, by reading https://utilities-gradle.ysb33r.org/utilities-gradle-plugin/1.0.0/usage.html. The docs has the wrong plugin id, but the plugin portal is correct

org.ysb33r.utilities

. I hope that this functionality will be really useful to some.

⬇️ Sticking to the theme of small utility plugins,

grabatool 1.0.0

has been released. It has updated to handle Gradle

7.3.3 - 9.2.0

, and the DSL has been simplified.

grabatool

has only one purpose - allow build script authors to download arbitrary SDK, distributions and standalone executables, cache them, and make the appropriate locations available as providers. Nothing is downloaded until a provider is realised. If you used the old

0.5.0

you'll need to make some changes to your buildscript, but hopefully it will be clear enough in the docs on how to upgrade. Documentation is here: https://grabatool.ysb33r.org.

I received a notification from the Add support for updating gradle wrapper #2223 GitHub issue, which belongs to dependabot, stating the ticket was moved from Planned to Done.