Use case: Find a dangling dependency from a CVC/OWASP security bulletin in a huge codebase that has thousands of transitive dependencies

One knows that the dependency is used somewhere (it’s downloaded to the Gradle cache after all!), but from where exactly is hard to tell, if you have multiple assembly points / external libraries.

1. loop over every subproject and run the dependencies task on it 2. define a task by a different name,

allprojects { task reallyDependencies { dependsOn 'dependencies' } }

3. add a constraint

allprojects { dependencies { constraints { } } }

that blocks the dependency, try to build and see what breaks 4. build with build scan and it should be visible

maybe more options but that's just what I could come up with for now