Sebastian Poxhofer
c32e2391a0
Refs #45216 The object counterpart to `prefer-coerce-array`: `x ?? {}` becomes `coerceObject(x)`. The rule flags a `??` whose default is a bare `{}` literal, so a populated default or an asserted `({} as Foo)` still passes; a `x ?? y ?? {}` chain maps onto `coerceObject(x, y)`. Every hit across `lib/` converted cleanly, so no disable comments were needed.
The gradle manager uses a custom parser written in JavaScript, similar to many others managers.
It does not call gradle directly in order to extract a list of dependencies.
Executing the Gradle Wrapper
Renovate will only execute the Gradle Wrapper (via ./gradlew or gradlew.bat) if the self-hosted administrator configures allowedUnsafeExecutions to include the gradleWrapper option.
This is required due to possible supply chain security attack vectors that can occur with the Gradle Wrapper being executed.
Updating lockfiles
The gradle manager supports gradle lock files in .lockfile artifacts, as well as lock files used by the gradle-consistent-versions plugin.
During lock file maintenance, renovate calls ./gradlew :dependencies --write-locks on the root project and subprojects.
For regular dependency updates, renovate automatically updates lock state entries via the --update-locks command line flag.
As the output of these commands can be very large, any text other than errors (in stderr) is discarded.
Dependency verification
Renovate supports Gradle's dependency verification functionality to ensure that checksums are calculated for your dependencies.
!!! note This requires your self-hosted administrator to allow the Gradle Wrapper to execute.
If Renovate finds a gradle/verification-metadata.xml file and either <verify-metadata>true</verify-metadata> or <verify-signatures>true</verify-signatures> (or both), it updates the content by using the ./gradlew --write-verification-metadata <hashTypes> dependencies command.
Renovate will check the file for existing hash types (like sha256) and use them as <hashTypes>.
!!! warning
Gradle allows verification metadata to use the md5 and sha1 algorithms.
Because those algorithms are prone to collision attacks, Renovate ignores them.
If Renovate encounters hashes that are generated with md5 or sha1 algorithms, Renovate uses sha256 instead.