Clone Tools
  • last updated a few seconds ago
Constraints: committers
Constraints: files
Constraints: dates
Introduce a checksum file cache service

This service is responsible for caching the checksums computed from

local file system. Because it's also used for dependency verification

writing and checking, this cache uses the existing infrastructure which

makes sure that if a file is updated locally, we expire the entry in

the cache.

This is done because there are lots of places in the code where we

used the legacy `HashUtil` class, which has no caching whatsoever.

It's, however, quite common to have a build which generates sha1

checksums multiple times for the same file. For example, during


    • -8
    • +14
  1. … 101 more files in changeset.
Write capabilities in available-at variants

This is required because variant selection will use the local attributes

and capabilities, adding the real module as a dependency in the current


    • -2
    • +5
  1. … 1 more file in changeset.
Gradle module metadata: forbid no version at all

With this change, it becomes illegal to create a Gradle Module Metadata

file that has depedencies or constraints declared without any version at

all across all variants.

    • -15
    • +41
  1. … 5 more files in changeset.
Fix publication warning report

An output is no longer presented if all warnings are silenced by variant


Fixes #11111

  1. … 3 more files in changeset.
Add sha-256 and sha-512 checksums to `maven-publish`

This commit adds the SHA-256 and SHA-512 checksums in:

- Gradle Module Metadata

- uploads to Maven repositories using the `maven-publish` plugin

The upload of those additional files is failsafe, just in case some

repositories don't support those checksum files.

    • -0
    • +4
  1. … 33 more files in changeset.
Preserve all warnings of type 'variant unsupported'

  1. … 1 more file in changeset.
Add validation at publication time

This commit introduces validation when generating Gradle

Module Metadata:

- check that there's at least one variant published

- each variant must have at least one attribute

- there shouldn't be duplicate variant names

- each variant must have a different (attributes,capabilities)


Closes #10736

    • -4
    • +94
  1. … 11 more files in changeset.
Rename inheritStrictVersions() -> endorseStrictVersions() (#10755)

This name change more clearly communicates the semantics of the

feature from a users point of view.

This commit also removes all mentions of 'inheriting' AND 'forSubgraph'.

There have been some leftovers in documentation/comments that

would have been misleading in the future. To make sure we catch all,

this also updates all variable/method/package names.

    • -3
    • +3
  1. … 70 more files in changeset.
Tweaks in metadata warnings headers and footers

  1. … 4 more files in changeset.
Improve publication warning message

* Clarify this impacts POM and Ivy format, not Gradle Module Metadata

* Clean up tests

  1. … 4 more files in changeset.
Preserve strictly when publishing resolved version

* When the initial version declaration uses `strictly`, then the

resolved version will also be defined as `strictly`.

Fixes #10533

    • -10
    • +9
  1. … 1 more file in changeset.
Fix skipping of empty versions

* When no version is specified, the entire `version` block is to be

skipped. This was not the case due to a type mismatch.

* However if a resolved version is to be written, then the block should

never be skipped.

    • -11
    • +11
  1. … 1 more file in changeset.
Updates to terminology for clarity

- `inheritStrictConstraints` -> `inheritStrictVersions`

- `notInheritStrictConstraints` -> `doNotInheritStrictVersions`

    • -1
    • +1
  1. … 31 more files in changeset.
Rework `forSubgraph` as implied by `strictly`

This commit removes a dedicated `forSubgraph` flag

on version constraints, so that it is _implied_ by

strict version constraints. This simplifies the behavior

of `strictly`, making it closer to the intuitive semantics,

while maintaining the ability to fail the build if a

consumer brings an incompatible version in the graph.

As a consequence, _strict dependencies_ now express that

the producer preference overrides whatever is found in

its own dependency graph. It is closer to the "nearest

first" semantics of Maven, while not having its drawbacks

(ordering in particular).

    • -5
    • +1
  1. … 77 more files in changeset.
Add API for silencing publication warnings

* API is per variant or all warnings

Fixes #9378

Fixes #10431

  1. … 6 more files in changeset.
Rework publication compatibility warnings

* Group by variant

* Isolate variant level warnings

Issue #9378

    • -0
    • +61
    • -25
    • +50
  1. … 4 more files in changeset.
Turn 'multiple publications with same coordinates' error into warning

This reduces the severity of the error detection introduced in #9466.

Although this situation is technically an error that should be avoided

as it causes information loss in the published result, in some testing

scenarios builds may rely on this behavior. So instead of failing,

Gradle now prints a warning message.

  1. … 2 more files in changeset.
Support dependency artifact selectors in Gradle Module Metadata

This is a compatibility feature for combining GMM and pure pom/ivy


    • -15
    • +43
  1. … 13 more files in changeset.
Add 'inheritConstraints' to Gradle Module Metadata

Adds test coverage for consuming and publishing.

    • -1
    • +1
  1. … 12 more files in changeset.
Introduce constraint inheritance API

    • -0
    • +6
  1. … 40 more files in changeset.
Add `forSubgraph()` API to version constraints

    • -0
    • +4
  1. … 20 more files in changeset.
De-incubate a number of dependency management related APIs

  1. … 113 more files in changeset.
Fix resolved versions of substituted dependencies

This commit fixes an inconsistency when publishing resolved

versions of a component. If that component happens to be

substituted, which would be strange for a first level dependency

but nevertheless possible, then we wouldn't find the target

module in the resolution result, and the outcome would be that

POM/IVY/Gradle Module metadata files would all have an empty

version for a substituted dependency.

With the change, we will now also look for dependencies in

the resolution result, and if one matches the original dependency

coordinates, then we use its resolved component as the result.

This allows us to _substitute_ the result with complete coordinates

in the metadata files.

Fixes nebula-plugins/gradle-nebula-integration#62

    • -12
    • +23
    • -0
    • +89
    • -0
    • +120
  1. … 9 more files in changeset.
Fix a small variable name typo

Signed-off-by: Emmanuel Guérin <>

Remove class cycle in publishing module

    • -0
    • +30
  1. … 1 more file in changeset.
Detect duplicate publications for `ivy-publish`

  1. … 7 more files in changeset.
Validate publication and repository names when publishing

The repository and publication names are used to construct task names when publishing.

This change adds validation to prevent invalid names such as "bad:name" being used.

Fixes #5533

  1. … 2 more files in changeset.
Use Java8 features in publishing plugins

  1. … 2 more files in changeset.
Add missing @Override to all modules

Signed-off-by: Paul Merlin <>

    • -0
    • +4
  1. … 996 more files in changeset.
Rename writer/parser classes for consistency

    • -0
    • +532
    • -532
    • +0
  1. … 19 more files in changeset.