dependabot / dependabot/dependabot-core
Dependabot clobbers custom Gradle distributionUrl
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
Gradle
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
_No response_
### dependabot.yml content
_No response_
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
Probably a followup to #15336 / #15312.
When updating a Gradle wrapper URL, I would hope that Dependabot would maintain a custom distributionUrl domain instead of reverting to Gradle's.
If a given `gradle-wrapper.properties` has a line like this:
```properties
distributionUrl=https\://jfrog.example.com/artifactory/example-gradle-services-remote/distributions/gradle-9.4.1-bin.zip
```
Today, Dependabot changes that to this:
```properties
distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
```
I would hope to see Dependabot change it to this instead:
```properties
distributionUrl=https\://jfrog.example.com/artifactory/example-gradle-services-remote/distributions/gradle-9.6.0-bin.zip
```
### Native package manager behavior
I think Gradle's native behavior matches Dependabot's, but that doesn't make it good.
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Start by locating the Gradle wrapper update path and the referenced gradle-wrapper.properties example; compare how the distributionUrl changes when the Gradle version is updated. Done means a custom domain such as jfrog.example.com is retained while the Gradle version changes, with the behavior verified for the shown URL.
Written by the indexing model from the issue text.
Assessment
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100