As an expansion for this…

I was using a trick with a Versions.kt file in buildSrc hosting all the versions for my project and using it in the build. Take a look at the example in madhead/ImgMacroBot:

buildSrc/src/main/kotlin/Versions.kt

object Versions {
    const val JVM = "11"

    object Plugins {
        const val KOTLIN = "1.4.21"
        const val DETEKT = "1.15.0"
        const val LIQUIBASE = "2.0.4"
    }

    object Dependencies {
        const val KTOR = "1.5.1"
        const val KOIN = "2.2.2"
        const val KOTLINX_SERIALIZATION = "1.0.1"
        const val TGBOTAPI = "0.30.0"
        const val SKIJA = "0.89.18"
        const val MICROMETER = "1.6.4"
        const val LOG4J = "2.14.0"
        const val JACKSON = "2.12.1"
        const val JUNIT = "5.7.1"
        const val MOCKK = "1.10.6"
        const val LIQUIBASE = "4.3.1"
        const val SNAKEYAML = "1.28"
        const val OJDBC11 = "21.1.0.0"
    }
}

And then in any build.gradle.kts:

dependencies {
    implementation(platform("org.apache.logging.log4j:log4j-bom:${Versions.Dependencies.LOG4J}"))
    implementation(platform("io.micrometer:micrometer-bom:${Versions.Dependencies.MICROMETER}"))
 
    api("io.micrometer:micrometer-core")
    api("dev.inmo:tgbotapi:${Versions.Dependencies.TGBOTAPI}")
    api("org.jetbrains.skija:skija-linux:${Versions.Dependencies.SKIJA}")
    …
}

Dependabot seems not to handle that correctly, check the repo's insights: the dependencies list is empty. I don't know if Dependabot actually executes Gradle to parse the dependencies, but seems like it's abilities in parsing them are limited.

Probably, if it executed full-featured Gradle it could handle any scenarios like mine or like the new central declaration system.

Uh oh!

Add support for Gradle Version Catalogs (Gradle 7.0) #3121

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions