dependabot / dependabot/dependabot-core

Dependabot clobbers custom Gradle distributionUrl

Open
#15,428 2 comments 0 reactions 0 assignees View on GitHub
L: java:gradle T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

Gradle

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

_No response_

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

Probably a followup to #15336 / #15312.

When updating a Gradle wrapper URL, I would hope that Dependabot would maintain a custom distributionUrl domain instead of reverting to Gradle's.

If a given `gradle-wrapper.properties` has a line like this:
```properties
distributionUrl=https\://jfrog.example.com/artifactory/example-gradle-services-remote/distributions/gradle-9.4.1-bin.zip
```

Today, Dependabot changes that to this:
```properties
distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
```

I would hope to see Dependabot change it to this instead:
```properties
distributionUrl=https\://jfrog.example.com/artifactory/example-gradle-services-remote/distributions/gradle-9.6.0-bin.zip
```

### Native package manager behavior

I think Gradle's native behavior matches Dependabot's, but that doesn't make it good.

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating the Gradle wrapper update path and the referenced gradle-wrapper.properties example; compare how the distributionUrl changes when the Gradle version is updated. Done means a custom domain such as jfrog.example.com is retained while the Gradle version changes, with the behavior verified for the shown URL.

Written by the indexing model from the issue text.

Assessment

Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.