Updated `dependabot`'s docs to add `Gradle Wrapper` #39954

gmazzo · 2025-08-20T13:04:46Z

Why:

dependabot/dependabot-core#12891 requires also to mention in the docs that now we'll support Gradle Wrapper in the gradle manager

Closes:

What's being changed (if available, include any code snippets, screenshots, or gifs):

Check off the following:

A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
The changes in this PR meet the docs fundamentals that are required for all content.
All CI checks are passing and the changes look good in the review environment.

welcome · 2025-08-20T13:04:50Z

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

github-actions · 2025-08-20T13:05:19Z

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
`code-security/reference/supply-chain-security/supported-ecosystems-and-repositories.md`	fpt ghec ghes@ 3.19 3.18 3.17 3.16 3.15 3.14	fpt ghec ghes@ 3.19 3.18 3.17 3.16 3.15 3.14	from reusable

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

Sharra-writes · 2025-08-21T20:32:45Z

@gmazzo Thanks for opening a PR! 🎉

It looks like this is still a draft. Could you ping me when this is ready? Then, I'll get it up for review ⚡

github-actions · 2025-09-23T16:30:39Z

A stale label has been added to this pull request because it has been open 30 days with no activity. If you think this pull request should remain open, please add a new comment.

gmazzo · 2025-09-23T21:26:02Z

This is still waiting for dependabot/dependabot-core#12891

yeikel · 2025-11-04T21:45:25Z

I think that we may want to leave this as a draft as long as this is an experiment as it may cause confusion otherwise

gmazzo · 2025-11-04T21:50:40Z

I think that we may want to leave this as a draft as long as this is an experiment as it may cause confusion otherwise

I was planning to move it to ready once the main PR is merged, and just let them decide when to merge this one. But I don't know how coordinated are dependabot and GH docs people 🤔

yeikel · 2025-11-04T23:23:17Z

I think that we may want to leave this as a draft as long as this is an experiment as it may cause confusion otherwise

I was planning to move it to ready once the main PR is merged, and just let them decide when to merge this one. But I don't know how coordinated are dependabot and GH docs people 🤔

It is a mutual effort, but I don't think that folks here will be tracking things like feature flags before deciding when to merge. As per the plan, the goal is to enable globally in ~1 week if things go as planned.

I'd suggest to not merge this yet to avoid confusions for non-beta-enabled users

You've done wonderful work so far. I can help track when to enable it here 🚀

data/reusables/dependabot/supported-package-managers.md

yeikel · 2025-11-16T01:52:18Z

I also sent gmazzo#2 as another suggestion we can incorporate

schelombitko-bumble · 2026-01-15T18:33:06Z

Is there anything still blocking this?

kbukum1

LGTM

Copilot

Pull request overview

This pull request adds documentation for Gradle Wrapper support in Dependabot's supported package managers list. The change is related to a feature addition in the dependabot-core repository (PR #12891) that adds support for updating Gradle Wrapper versions.

Changes:

Added gradle/wrapper/gradle-wrapper.properties to the list of files that Dependabot supports for Gradle updates

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

yeikel · 2026-01-16T22:30:02Z

Let's please ensure that the changes of

gmazzo#1
gmazzo#2

(Or similar wording) is also included before this is merged

Clarified the terminology for the Gradle wrapper in the documentation.

* Updated `dependabot`'s docs to add `Gradle Wrapper` * Explain the dependency name for the Gradle Wrapper * Reword --------- Co-authored-by: Guillermo Mazzola <gmazzo65@gmail.com>

* Updated `dependabot`'s docs to add `Gradle Wrapper` * Document that Gradle runs when updating the Gradle Wrapper * Remove empty line --------- Co-authored-by: Guillermo Mazzola <gmazzo65@gmail.com>

gmazzo · 2026-01-28T09:43:31Z

Is there anything still blocking this?

Hey @kbukum1 @schelombitko-bumble, just incorporated @yeikel suggestions. Since now it's 100% rolled out, I think we can move forward with this as well.

kbukum1 · 2026-02-02T21:40:45Z

@gmazzo ,

Updating the doc accordingly.

yeikel · 2026-02-02T22:06:09Z

@gmazzo ,

Updating the doc accordingly.

Do you have any other feedback or can we ask the doc team for a second review round?

kbukum1 · 2026-02-02T22:08:11Z

@gmazzo ,
Updating the doc accordingly.

Do you have any other feedback or can we ask the doc team for a second review round?

We generally create internal doc and it is going through their review. I initiated the PR using copilot but currently it is having issue because pipelines are not working. When it is working I will check it if everything is ok, the doc team will review it.

kbukum1 · 2026-02-02T22:17:52Z

data/reusables/dependabot/supported-package-managers.md

+* `gradlew`
+* `gradlew.bat`
+* `gradle/wrapper/gradle-wrapper.jar`
+


Maybe we can change it something like the following

{% data variables.product.prodname_dependabot %} supports updates to the following files without needing to run Gradle: - `build.gradle`, `build.gradle.kts` (for Kotlin projects) - `gradle/libs.versions.toml` (for projects using a standard Gradle version catalog) - `gradle.lockfile` (for projects using Gradle dependency locking) - Files included via the `apply` declaration that have `dependencies` in the filename. Note that `apply` does not support `apply to`, recursion, or advanced syntaxes (for example, Kotlin's `apply` with `mapOf`, filenames defined by property). {% data variables.product.prodname_dependabot %} runs Gradle to update the Gradle Wrapper: - `gradle/wrapper/gradle-wrapper.properties` - `gradlew` - `gradlew.bat` - `gradle/wrapper/gradle-wrapper.jar`

Feel free to craft any wording that fits better here.

@gmazzo
Thanks. It will be great if you guys can review it since docs are important from user perspective.

CC: @yeikel

Just added suggestion here. Let me know what do you think.

https://github.com/github/docs/pull/39954/changes#r2756374494

kbukum1 · 2026-02-02T22:23:03Z

@gmazzo ,

@gmazzo ,
Updating the doc accordingly.

Do you have any other feedback or can we ask the doc team for a second review round?

We generally create internal doc and it is going through their review. I initiated the PR using copilot but currently it is having issue because pipelines are not working. When it is working I will check it if everything is ok, the doc team will review it.

Thanks @yeikel for the attention. @gmazzo , I am not sure but we have two sections that has duplicated. It may be better if we consolidate things around? Somehow I feel like we need to do make it in a way it is not repeating files. I understand both sections have different purpose but we may want to consolidate.

Sugggestion:

I added suggestion in comment, https://github.com/github/docs/pull/39954/changes#r2756286217

Preview:

Dependabot supports updates to the following files without needing to run Gradle:

build.gradle, build.gradle.kts (for Kotlin projects)
gradle/libs.versions.toml (for projects using a standard Gradle version catalog)
gradle.lockfile (for projects using Gradle dependency locking)
Files included via the apply declaration that have dependencies in the filename. Note that apply does not support apply to, recursion, or advanced syntaxes (for example, Kotlin's apply with mapOf, filenames defined by property).

Dependabot runs Gradle to update the Gradle Wrapper:

gradle/wrapper/gradle-wrapper.properties
gradlew
gradlew.bat
gradle/wrapper/gradle-wrapper.jar

gmazzo · 2026-02-02T22:27:29Z

I understand both sections have different purpose but we may want to consolidate.

I'll let the doc part to you guys. I'm fine with any wording.

kbukum1 · 2026-02-02T22:56:37Z

data/reusables/dependabot/supported-package-managers.md

 {% data variables.product.prodname_dependabot %} doesn't run Gradle but supports updates to the following files:
 * `build.gradle`, `build.gradle.kts` (for Kotlin projects)
+* `gradle/wrapper/gradle-wrapper.properties` (for Gradle wrapper)
 * `gradle/libs.versions.toml` (for projects using a standard Gradle version catalog)
 * `gradle.lockfile` (for projects using Gradle dependency locking)
 * `gradle/wrapper/gradle-wrapper.properties` (for the Gradle Wrapper)
 * Files included via the `apply` declaration that have `dependencies` in the filename. Note that `apply` does not support `apply to`, recursion, or advanced syntaxes (for example, Kotlin's `apply` with `mapOf`, filenames defined by property).

+{% data variables.product.prodname_dependabot %} runs Gradle to update the Gradle Wrapper: 
+* `gradle/wrapper/gradle-wrapper.properties`
+* `gradlew`
+* `gradlew.bat`
+* `gradle/wrapper/gradle-wrapper.jar`
+


Suggested change

{% data variables.product.prodname_dependabot %} doesn't run Gradle but supports updates to the following files:

* `build.gradle`, `build.gradle.kts` (for Kotlin projects)

* `gradle/wrapper/gradle-wrapper.properties` (for Gradle wrapper)

* `gradle/libs.versions.toml` (for projects using a standard Gradle version catalog)

* `gradle.lockfile` (for projects using Gradle dependency locking)

* `gradle/wrapper/gradle-wrapper.properties` (for the Gradle Wrapper)

* Files included via the `apply` declaration that have `dependencies` in the filename. Note that `apply` does not support `apply to`, recursion, or advanced syntaxes (for example, Kotlin's `apply` with `mapOf`, filenames defined by property).

{% data variables.product.prodname_dependabot %} runs Gradle to update the Gradle Wrapper:

* `gradle/wrapper/gradle-wrapper.properties`

* `gradlew`

* `gradlew.bat`

* `gradle/wrapper/gradle-wrapper.jar`

{% data variables.product.prodname_dependabot %} supports updates to the following files without needing to run Gradle:

* `build.gradle`, `build.gradle.kts` (for Kotlin projects)

* `gradle/libs.versions.toml` (for projects using a standard Gradle version catalog)

* `gradle.lockfile` (for projects using Gradle dependency locking)

* Files included via the `apply` declaration that have `dependencies` in the filename. Note that `apply` does not support `apply to`, recursion, or advanced syntaxes (for example, Kotlin's `apply` with `mapOf`, filenames defined by property).

{% data variables.product.prodname_dependabot %} runs Gradle to update the Gradle Wrapper:

* `gradle/wrapper/gradle-wrapper.properties`

* `gradlew`

* `gradlew.bat`

* `gradle/wrapper/gradle-wrapper.jar`

Looks good to me. Thanks for the suggestions

github-actions bot added the triage Do not begin working on this issue until triaged by the team label Aug 20, 2025

gmazzo mentioned this pull request Aug 20, 2025

Added Gradle Wrapper support dependabot/dependabot-core#12891

Merged

5 tasks

github-actions bot added the Inactive Will be closed automatically by a stall check if no activity is detected. label Sep 23, 2025

Sharra-writes removed the Inactive Will be closed automatically by a stall check if no activity is detected. label Sep 23, 2025

yeikel reviewed Nov 15, 2025

View reviewed changes

data/reusables/dependabot/supported-package-managers.md Show resolved Hide resolved

yeikel mentioned this pull request Nov 21, 2025

Add support for updating gradle wrapper dependabot/dependabot-core#2223

Open

kbukum1 previously approved these changes Jan 16, 2026

View reviewed changes

kbukum1 marked this pull request as ready for review January 16, 2026 21:59

Copilot AI review requested due to automatic review settings January 16, 2026 21:59

kbukum1 force-pushed the dependabot-gradle-wrapper-support branch from 9e52473 to c0f476a Compare January 16, 2026 21:59

Copilot started reviewing on behalf of kbukum1 January 16, 2026 22:00 View session

Copilot AI reviewed Jan 16, 2026

View reviewed changes

kbukum1 dismissed their stale review via debb323 January 16, 2026 22:26

kbukum1 moved this to In review in Dependabot Jan 16, 2026

kbukum1 added this to Dependabot Jan 16, 2026

kbukum1 self-assigned this Jan 16, 2026

gmazzo and others added 2 commits January 23, 2026 13:26

Updated dependabot's docs to add Gradle Wrapper

aee5abe

Update Gradle wrapper description in documentation

9bd0c80

Clarified the terminology for the Gradle wrapper in the documentation.

kbukum1 force-pushed the dependabot-gradle-wrapper-support branch from debb323 to 9bd0c80 Compare January 23, 2026 19:26

yeikel and others added 3 commits January 28, 2026 10:40

Explain the dependency name for the Gradle Wrapper (#1)

9675fd8

* Updated `dependabot`'s docs to add `Gradle Wrapper` * Explain the dependency name for the Gradle Wrapper * Reword --------- Co-authored-by: Guillermo Mazzola <gmazzo65@gmail.com>

Document that Gradle runs when updating the Gradle Wrapper (#2)

c68dbb5

* Updated `dependabot`'s docs to add `Gradle Wrapper` * Document that Gradle runs when updating the Gradle Wrapper * Remove empty line --------- Co-authored-by: Guillermo Mazzola <gmazzo65@gmail.com>

Merge branch 'github:main' into dependabot-gradle-wrapper-support

43470eb

kbukum1 reviewed Feb 2, 2026

View reviewed changes

Updated dependabot's docs to add Gradle Wrapper #39954

Are you sure you want to change the base?

Updated dependabot's docs to add Gradle Wrapper #39954

Uh oh!

Conversation

gmazzo commented Aug 20, 2025

Why:

What's being changed (if available, include any code snippets, screenshots, or gifs):

Check off the following:

Uh oh!

welcome bot commented Aug 20, 2025

Uh oh!

github-actions bot commented Aug 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How to review these changes 👓

Uh oh!

Sharra-writes commented Aug 21, 2025

Uh oh!

github-actions bot commented Sep 23, 2025

Uh oh!

gmazzo commented Sep 23, 2025

Uh oh!

yeikel commented Nov 4, 2025

Uh oh!

gmazzo commented Nov 4, 2025

Uh oh!

yeikel commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

yeikel commented Nov 16, 2025

Uh oh!

schelombitko-bumble commented Jan 15, 2026

Uh oh!

kbukum1 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

yeikel commented Jan 16, 2026

Uh oh!

gmazzo commented Jan 28, 2026

Uh oh!

kbukum1 commented Feb 2, 2026

Uh oh!

yeikel commented Feb 2, 2026

Uh oh!

kbukum1 commented Feb 2, 2026

Uh oh!

kbukum1 Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gmazzo Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

kbukum1 Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

kbukum1 Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

kbukum1 commented Feb 2, 2026

Uh oh!

gmazzo commented Feb 2, 2026

Uh oh!

kbukum1 Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

yeikel Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Updated `dependabot`'s docs to add `Gradle Wrapper` #39954

Updated `dependabot`'s docs to add `Gradle Wrapper` #39954

github-actions bot commented Aug 20, 2025 •

edited

Loading

yeikel commented Nov 4, 2025 •

edited

Loading

kbukum1 Feb 2, 2026 •

edited

Loading