diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md index 4da4a7de5688..6372083c866b 100644 --- a/data/reusables/dependabot/supported-package-managers.md +++ b/data/reusables/dependabot/supported-package-managers.md @@ -122,11 +122,18 @@ For more information about using {% data variables.product.prodname_dependabot_v {% data variables.product.prodname_dependabot %} doesn't run Gradle but supports updates to the following files: * `build.gradle`, `build.gradle.kts` (for Kotlin projects) +* `gradle/wrapper/gradle-wrapper.properties` (for Gradle wrapper) * `gradle/libs.versions.toml` (for projects using a standard Gradle version catalog) * `gradle.lockfile` (for projects using Gradle dependency locking) * `gradle/wrapper/gradle-wrapper.properties` (for the Gradle Wrapper) * Files included via the `apply` declaration that have `dependencies` in the filename. Note that `apply` does not support `apply to`, recursion, or advanced syntaxes (for example, Kotlin's `apply` with `mapOf`, filenames defined by property). +{% data variables.product.prodname_dependabot %} runs Gradle to update the Gradle Wrapper: +* `gradle/wrapper/gradle-wrapper.properties` +* `gradlew` +* `gradlew.bat` +* `gradle/wrapper/gradle-wrapper.jar` + {% data variables.product.prodname_dependabot %} uses information from the `pom.xml` file of dependencies to add links to release information in update pull requests. If the information is omitted from the `pom.xml` file, then it cannot be included in {% data variables.product.prodname_dependabot %} pull requests, see [AUTOTITLE](/code-security/dependabot/ecosystems-supported-by-dependabot/optimizing-java-packages-dependabot). For {% data variables.product.prodname_dependabot_security_updates %}, Gradle support is limited to manual uploads of the dependency graph data using the {% data variables.dependency-submission-api.name %}. For more information about the {% data variables.dependency-submission-api.name %}, see [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api). @@ -134,6 +141,7 @@ For {% data variables.product.prodname_dependabot_security_updates %}, Gradle su > [!NOTE] > * When you upload Gradle dependencies to the dependency graph using the {% data variables.dependency-submission-api.name %}, all project dependencies are uploaded, even transitive dependencies that aren't explicitly mentioned in any dependency file. When an alert is detected in a transitive dependency, {% data variables.product.prodname_dependabot %} isn't able to find the vulnerable dependency in the repository, and therefore won't create a security update for that alert. > * {% data variables.product.prodname_dependabot_version_updates %} will, however, create pull requests when the parent dependency is explicitly declared as a direct dependency in the project's manifest file. +> * When updating the Gradle Wrapper, {% data variables.product.prodname_dependabot %} uses `gradle-wrapper` for the dependency name. ### Helm Charts