Skip to content

Commit 14305a3

Browse files
chore: ignore gradle/actions/setup-gradle v6 in dependabot (#317)
gradle/actions/setup-gradle v6 introduced a licensing change requiring acceptance of new Terms of Use tied to a proprietary caching component. The ToS language is broad and legally ambiguous, raising concerns about IP rights over cached build artifacts (e.g. sources.jar). Key concerns: - ToS grants Gradle broad rights over "user submissions", unclear scope - Disabling the new caching also disables Gradle distribution caching (known bug) - No clear legal guidance for private/commercial repos yet Gradle maintainers have stated no data is currently sent to Gradle and plan to clarify the ToS, but until that happens we stay on v5 to avoid accidental acceptance of unclear terms.
1 parent 6ba951a commit 14305a3

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

.github/dependabot.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ updates:
4848
directory: "/"
4949
schedule:
5050
interval: "monthly"
51+
ignore:
52+
- dependency-name: "gradle/actions/setup-gradle"
53+
versions: [">= 6.0.0, < 7.0.0"]
5154
groups:
5255
dependencies:
5356
patterns:

0 commit comments

Comments
 (0)