party gradlephant Today we launched the Gradle Security Subscription: gradle.org/security-subscription! Of course, I wrote a blog post about it. Short version for this channel: nothing changes for open source Gradle. Same EOL policy, same security fixes under it. The subscription adds SLA-backed fixes, coverage for versions past EOL, and embargoed disclosure for orgs that need contractual guarantees. The post also gets into why the toolchain is worth attacking in the first place, with receipts.

> Gradle ships some of the strongest supply chain protections available in a modern build system, dependency verificationand repository content filtering among them. Does Gradle have a SLSA level it has achieved for it's build artifacts? What about the artifacts produced by a Gradle build? > A vulnerability reported against a bundled component is not necessarily exploitable through Gradle, and where it is, the severity is not necessarily the same. A vulnerability rated high against a dependency may rate lower once scored against how Gradle actually uses it. Our security team publishes that impact analysis, the adjusted CVSS score, and the reasoning behind it. Is this being published as a document following the VEX Specification? Ideally leveraging something like OpenVEX?

Hey Jonathan,

Is this being published as a document following the VEX Specification?

We are actively looking into this. No concrete ETA at this stage.

💭 I might adjust the support matrix of my plugins to match those (i.e. remove support for all 6.x and 7.x beyond 7.6.6)

VEX is generally the standard the industry is headed in for machine readable "this doesn't impact us and here is why"