Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
platform gives BOM versions as raisable recommendations; enforcedPlatform makes them strict. Use platform for libraries and enforcedPlatform for apps.
In Gradle, platform() treats BOM versions as recommendations and enforcedPlatform() makes them strict. Learn which to use in an Android app and why.
Gradle Module Metadata is published beside the POM and adds variants and constraints. POM-only tools still work in degraded mode and can hide detail.
Yes. Gradle init scripts run before settings and project scripts and can add repositories to every build. Know where they load from and who controls them.
Use Gradle repository content filtering: includeGroup on the private repository and exclusiveContent so only it can serve your internal groups.
Selectors like 5.+ can pull new library code into a mobile release without any change in your repo. Why that matters and how dependency locking fixes it.
Use the Gradle dependencyInsight task to list every path to a dependency and why its version was chosen, then fix the version that carries the flaw.
Use the Gradle dependencies and dependencyInsight tasks to trace a vulnerable library to the dependency that requires it. Steps for Java and Kotlin.
Gradle constraints raise a transitive version without adding a direct dependency, and because documents why. A short how to for patching and later audits.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
