Dependency Management

implementation is a declaration bucket — isCanBeResolved is false — so it has no resolution result. Resolve compileClasspath or runtimeClasspath, which extend from it.

The dependencies {} block is where you declare a module's dependencies. Inside it you call a configuration name like implementation(...) with the dependency coordinates (group:name:version) to attach a dependency to that configuration.

testImplementation adds a dependency to the test compile + runtime classpath (e.g. JUnit, Mockito). testRuntimeOnly adds it only to the test runtime classpath (e.g. the JUnit Platform launcher engine). Test classpaths also extend the main ones.

Attach an exclude block to that one dependency, naming the unwanted artifact by group and/or module. Only that dependency's transitive graph is affected.

It's the shorthand for a module's coordinates: group (org), name (artifact), version. You declare it inside a configuration, e.g. implementation("org.apache.commons:commons-lang3:3.14.0").

Alignment forces all modules of one library family (e.g. all jackson-* artifacts) to resolve to the same version, instead of a mix, avoiding runtime incompatibilities between modules built to be released together.

A version catalog is a central, typed list of dependency coordinates and versions shared across a build. Gradle auto-creates the libs catalog from gradle/libs.versions.toml if that file exists.

It's Gradle's version catalog: a TOML file at gradle/libs.versions.toml listing dependency coordinates and versions in one place. Its four tables are [versions], [libraries], [bundles], and [plugins].

A dynamic version lets Gradle pick which version to resolve (e.g. '1.+', 'latest.release'). A changing version is one fixed coordinate whose artifacts can change over time (e.g. '-SNAPSHOT'), so the same version number may hold different content.

platform() imports a Maven BOM so its version constraints apply to your dependencies, letting you declare those dependencies without versions and keep them aligned.

By default Gradle picks the highest requested version of the module and uses that single version everywhere on the classpath. This is 'highest-version-wins' conflict resolution.

It pins Guava to exactly that version for the whole configuration, overriding whatever version conflict resolution would otherwise pick — even if another dependency wants a higher one.

Dependency locking pins the exact versions a configuration resolves to, saving them in a lockfile. With dynamic versions or version ranges, builds can drift over time; locking makes resolution reproducible across machines and over time.

Dependency substitution lets you swap one dependency for another during resolution — for example, replacing a published external module with a local project so you build and test against your own source instead of a release.

A capability is a label (group:name:version) saying 'I provide this feature'. By default a module provides one capability matching its GAV. Two modules offering the same capability conflict, even if they are different modules — like log4j and log4j-over-slf4j both providing logging.

Gradle stores downloaded artifacts and metadata under GRADLE_USER_HOME/caches/modules-2 (default ~/.gradle). The cache avoids re-downloading the same dependency on every build, speeding things up and enabling offline reuse.

It's declaring repositories once for the whole build inside settings.gradle.kts using dependencyResolutionManagement { repositories {} }, instead of repeating repositories {} in every project's build.gradle.kts.

It tells Gradle which repositories can or cannot supply which modules, using a content {} block with includeGroup/excludeGroup. This avoids pointless lookups and speeds up resolution.

Declare the repo with a url and a credentials { username; password } block. Don't hardcode the secrets — read them from gradle.properties or environment variables instead.

A repository is a source Gradle downloads dependency artifacts and metadata from. You declare them in a repositories {} block, e.g. mavenCentral(), so Gradle knows where to look for the modules you depend on.

Resolve the configuration with an artifactView that requests the transform's to attribute, e.g. configurations.runtimeClasspath.get().incoming.artifactView { attributes.attribute(artifactType, "classes") }.artifacts. Requesting that attribute makes Gradle insert the transform.

You call dependencies.registerTransform(MyTransform) { ... } and declare from.attribute(...) and to.attribute(...). Gradle uses those attributes to know which artifacts the transform can convert and what it produces.

Call outputs.file(name) or outputs.dir(name) to get a location, then write your derived content there. Outputs must be either the input artifact itself or a path under the directory Gradle gives you — never an arbitrary location.

A TransformAction converts an input artifact into one or more derived output files. You implement the transform(outputs) method and mark the input file with @InputArtifact so Gradle injects it.

You register transforms inside a project's dependencies { registerTransform(...) } block, usually from a plugin's apply. The registration is scoped to that project; to share, apply the plugin (or a convention/settings plugin) to every project that needs it.

Gradle records an expected hash (e.g. sha256) for each downloaded artifact in verification-metadata.xml. On every build it re-hashes the file and fails if it differs, proving the artifact wasn't tampered with or swapped.

It's an XML file at gradle/verification-metadata.xml that lists trusted checksums and/or signatures for every dependency and plugin Gradle resolves. When present and enabled, Gradle verifies each artifact against it before use.

PGP verification checks that a dependency's .asc signature file was produced by a trusted publisher's private key, proving authenticity. A checksum only proves the bytes match a recorded hash, not who produced them.

When you change dependencies, re-run --write-verification-metadata to append new entries, review the diff in your PR, and commit it. If you skip this, the build fails with 'artifact not in verification metadata'. Regenerating blindly can silently trust tampered artifacts.

Run the build with --write-verification-metadata <checksums>, e.g. ./gradlew build --write-verification-metadata sha256. Gradle resolves all dependencies and writes their computed checksums into gradle/verification-metadata.xml.