The `gradle` manager uses a custom parser written in JavaScript, similar to many others managers.
It does not call `gradle` directly in order to extract a list of dependencies.

### Executing the Gradle Wrapper

Renovate will only execute the Gradle Wrapper (via `./gradlew` or `gradlew.bat`) if the self-hosted administrator configures [`allowedUnsafeExecutions`](../../../self-hosted-configuration.md#allowedunsafeexecutions) to include the `gradleWrapper` option.
This is required due to [possible supply chain security attack vectors](../../../security-and-permissions.md#trusting-repository-developers) that can occur with the Gradle Wrapper being executed.

### Updating lockfiles

The gradle manager supports gradle lock files in `.lockfile` artifacts, as well as lock files used by the [gradle-consistent-versions](https://github.com/palantir/gradle-consistent-versions) plugin.
During [lock file maintenance](../../../configuration-options.md#lockfilemaintenance), renovate calls `./gradlew :dependencies --write-locks` on the root project and subprojects.
For regular dependency updates, renovate automatically updates lock state entries via the `--update-locks` command line flag.

As the output of these commands can be very large, any text other than errors (in `stderr`) is discarded.

### Dependency verification

Renovate supports [Gradle's dependency verification functionality](https://docs.gradle.org/current/userguide/dependency_verification.html) to ensure that checksums are calculated for your dependencies.

!!! note
  This requires [your self-hosted administrator to allow the Gradle Wrapper to execute](#executing-the-gradle-wrapper).

If Renovate finds a `gradle/verification-metadata.xml` file and either `<verify-metadata>true</verify-metadata>` or `<verify-signatures>true</verify-signatures>` (or both), it updates the content by using the `./gradlew --write-verification-metadata <hashTypes> dependencies` command.
Renovate will check the file for existing hash types (like `sha256`) and use them as `<hashTypes>`.

!!! warning
  Gradle allows verification metadata to use the `md5` and `sha1` algorithms.
  Because those algorithms are prone to collision attacks, Renovate ignores them.
  If Renovate encounters hashes that are generated with `md5` or `sha1` algorithms, Renovate uses `sha256` instead.