build(deps): Generate Gradle Wrapper 8.14.5 instead of 8.7 and 8.14.3 (SECURITY) by pkubowicz · Pull Request #24396 · OpenAPITools/openapi-generator

pkubowicz · 2026-07-23T09:26:11Z

It's not safe to use 8.x before 8.14.5 due to multiple vulnerabilities.

https://security.snyk.io/package/linux/chainguard:latest/gradle-8

Keeping wrapper 8.1.1 unchanged just in case there are some incompatibilities.

@cachescrubber (2022/02) @welshm (2022/02) @MelleD (2022/02) @atextor (2022/02) @manedev79 (2022/02) @javisst (2022/02) @borsch (2022/02) @banlevente (2022/02) @Zomzog (2022/09) @martin-mfg (2023/08) @KannaKim (2026/07)

PR checklist

Read the contribution guidelines.
Run the following to build the project and update samples:
```
./mvnw clean package || exit
./bin/generate-samples.sh ./bin/configs/*.yaml || exit
./bin/utils/export_docs_generators.sh || exit
```
(For Windows users, please run the script in WSL)
Commit all changed files.
This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
These must match the expectations made by your contribution.
You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example ./bin/generate-samples.sh bin/configs/java*.
IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

Summary by cubic

Upgrade Gradle wrappers to 8.14.5 across generator templates and samples to address vulnerabilities in earlier 8.x releases. Keep 8.1.1 for non–Spring Boot 4 Kotlin Spring and 7.6.2 for jvm-volley for compatibility.

Dependencies
- Bumped distributionUrl and wrapper gradleVersion from 8.7/8.14/8.14.3 to 8.14.5 across Java, Kotlin, and Android templates and samples.

^{Written for commit b6096f2. Summary will update on new commits.}

cubic-dev-ai

15 issues found across 168 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/client/petstore/kotlin-jvm-jackson/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/client/petstore/kotlin-jvm-jackson/gradle/wrapper/gradle-wrapper.properties:3">
P2: The checked-in wrapper version is inconsistent with the project's wrapper-task configuration: `gradle wrapper` will overwrite this 8.14.5 URL with 8.14.3. Updating the `wrapper` block in `build.gradle` to 8.14.5 as part of this change would keep regeneration from restoring the older distribution.</violation>
</file>

<file name="samples/client/petstore/java/resttemplate-jakarta/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/client/petstore/java/resttemplate-jakarta/gradle/wrapper/gradle-wrapper.properties:3">
P2: The wrapper now downloads a new executable Gradle distribution without verifying its contents, so a compromised distribution endpoint or cache could supply a different archive despite the HTTPS URL. Pin the published SHA-256 with `distributionSha256Sum` to preserve the integrity guarantee expected from this security-focused upgrade.</violation>
</file>

<file name="samples/server/petstore/kotlin-wiremock-responses/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/server/petstore/kotlin-wiremock-responses/gradle/wrapper/gradle-wrapper.properties:3">
P2: Regenerating this wrapper with `./gradlew wrapper` will reset `distributionUrl` to Gradle 8.7 because `build.gradle.kts` still sets `tasks.wrapper { gradleVersion = "8.7" }`, allowing the vulnerable version to be reintroduced. Keeping the wrapper task configuration at 8.14.5 as well would make the security upgrade persistent.</violation>
</file>

<file name="samples/client/petstore/java/resteasy/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/client/petstore/java/resteasy/gradle/wrapper/gradle-wrapper.properties:3">
P2: The updated wrapper still executes a downloaded Gradle archive without verifying it against a pinned SHA-256 digest, leaving this security-sensitive dependency exposed if the distribution is altered in transit or at its download endpoint. Adding the official `distributionSha256Sum` for `gradle-8.14.5-bin.zip` would make the upgrade provide integrity verification as well as the version fix.</violation>
</file>

<file name="samples/client/petstore/java/vertx5-supportVertxFuture/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/client/petstore/java/vertx5-supportVertxFuture/gradle/wrapper/gradle-wrapper.properties:3">
P2: Builds will accept an altered archive served from this URL because the wrapper does not verify the downloaded distribution's SHA-256, leaving the security upgrade exposed to a compromised or mis-served artifact. Adding the published Gradle 8.14.5 checksum would preserve the security intent of this change.</violation>
</file>

<file name="samples/client/petstore/java/okhttp-gson-swagger2/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/client/petstore/java/okhttp-gson-swagger2/gradle/wrapper/gradle-wrapper.properties:3">
P2: This version bump still lets the wrapper execute an unverified Gradle ZIP, so the security update does not pin the distribution contents. Adding `distributionSha256Sum` for the 8.14.5 binary would provide archive-integrity verification.</violation>
</file>

<file name="samples/openapi3/client/extensions/x-auth-id-alias/java/jersey2-java8/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/openapi3/client/extensions/x-auth-id-alias/java/jersey2-java8/gradle/wrapper/gradle-wrapper.properties:3">
P2: This wrapper update will not trigger the Gradle build workflow when it is the only change, so the security-motivated upgrade can merge without validating that Gradle 8.14.5 still builds this sample. Extending the workflow's `pull_request.paths` to include this sample or the broader `samples/openapi3/client/**` path would preserve CI coverage.</violation>
</file>

<file name="samples/client/others/java/restclient-sealedInterface/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/client/others/java/restclient-sealedInterface/gradle/wrapper/gradle-wrapper.properties:3">
P2: The updated wrapper still executes a downloaded Gradle ZIP without pinning its digest, so a compromised distribution path or artifact could be accepted as the build tool. Adding the official SHA-256 for `gradle-8.14.5-bin.zip` via `distributionSha256Sum` would preserve the security intent of this upgrade.</violation>
</file>

<file name="samples/client/petstore/java/webclient-springBoot4-jackson3/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/client/petstore/java/webclient-springBoot4-jackson3/gradle/wrapper/gradle-wrapper.properties:3">
P2: Fresh builds will trust whatever archive is returned for this new executable distribution URL because no checksum pins its contents. Adding `distributionSha256Sum` with the official Gradle 8.14.5 binary hash would preserve the security intent of this upgrade instead of relying only on HTTPS.</violation>
</file>

<file name="modules/openapi-generator/src/main/resources/kotlin-spring/libraries/spring-cloud/gradle-wrapper.properties.mustache">

<violation number="1" location="modules/openapi-generator/src/main/resources/kotlin-spring/libraries/spring-cloud/gradle-wrapper.properties.mustache:3">
P2: Generated Spring Cloud projects download the new Gradle distribution without verifying its SHA-256, so a compromised or misrouted distribution endpoint can supply code that runs during the build despite this security-focused upgrade. Adding the verified `distributionSha256Sum` for the 8.14.5 branch would provide artifact-integrity protection.</violation>
</file>

<file name="samples/client/petstore/java/native/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/client/petstore/java/native/gradle/wrapper/gradle-wrapper.properties:3">
P2: Builds can execute a tampered Gradle distribution if the download path or trusted network is compromised because this newly selected binary is not checksum-pinned. Adding the official `distributionSha256Sum` for 8.14.5 would make the security update provide integrity verification as well.</violation>
</file>

<file name="samples/client/others/java/webclient-sealedInterface_3_1/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/client/others/java/webclient-sealedInterface_3_1/gradle/wrapper/gradle-wrapper.properties:3">
P2: Builds now download and execute Gradle 8.14.5 without pinning the archive's SHA-256, so a compromised upstream artifact or delivery path could run arbitrary build code. Adding the official checksum for the 8.14.5 binary distribution would preserve the security goal while protecting the wrapper supply chain.</violation>
</file>

<file name="samples/client/petstore/java/okhttp-gson-3.1/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/client/petstore/java/okhttp-gson-3.1/gradle/wrapper/gradle-wrapper.properties:3">
P2: The new Gradle executable is still downloaded without a pinned SHA-256, so a corrupted or tampered archive at the configured URL would not be detected by the wrapper. Adding the official `distributionSha256Sum` is especially important for this security-focused dependency update.</violation>
</file>

<file name="samples/client/petstore/java/okhttp-gson-parcelableModel/gradle/wrapper/gradle-wrapper.properties">

<violation number="1" location="samples/client/petstore/java/okhttp-gson-parcelableModel/gradle/wrapper/gradle-wrapper.properties:3">
P2: Android-targeted builds now use Gradle 8.14.5 with the project's legacy `com.android.tools.build:gradle:2.3.+` plugin, causing configuration failure when `-Ptarget=android` is enabled. Updating the Android Gradle Plugin and its legacy DSL (or retaining a wrapper compatible with AGP 2.3) is needed alongside this wrapper bump.</violation>
</file>

<file name="modules/openapi-generator/src/main/resources/Java/gradle-wrapper.properties.mustache">

<violation number="1" location="modules/openapi-generator/src/main/resources/Java/gradle-wrapper.properties.mustache:3">
P1: Android-targeted Java clients will fail during Gradle configuration after this shared wrapper is upgraded: the `target=android` branch still applies `com.android.tools.build:gradle:2.3.+`, which cannot run on Gradle 8.14.5. Keeping a compatible wrapper for that branch or upgrading/splitting the Android build configuration would avoid breaking generated Android projects.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai · 2026-07-23T09:38:04Z

 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip


P1: Android-targeted Java clients will fail during Gradle configuration after this shared wrapper is upgraded: the target=android branch still applies com.android.tools.build:gradle:2.3.+, which cannot run on Gradle 8.14.5. Keeping a compatible wrapper for that branch or upgrading/splitting the Android build configuration would avoid breaking generated Android projects.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At modules/openapi-generator/src/main/resources/Java/gradle-wrapper.properties.mustache, line 3: <comment>Android-targeted Java clients will fail during Gradle configuration after this shared wrapper is upgraded: the `target=android` branch still applies `com.android.tools.build:gradle:2.3.+`, which cannot run on Gradle 8.14.5. Keeping a compatible wrapper for that branch or upgrading/splitting the Android build configuration would avoid breaking generated Android projects.</comment> <file context> @@ -1,6 +1,6 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip +distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip networkTimeout=10000 validateDistributionUrl=true </file context>

@pkubowicz The short answer: Probably none of the 8.x series.

The target=android template in this project pins com.android.tools.build:gradle:2.3.+ — that's the Android Gradle Plugin (AGP) 2.3.x, which was released in 2017. AGP 2.3.x requires Gradle 3.3–4.10 at most. Even Gradle 5.x won't work, let alone 8.x.

If you wanted to keep the Android template functional with the new wrapper, you'd need to:

Upgrade the AGP version to something much newer (AGP 8.x requires Gradle 8.x+, but also needs the Android SDK build tools, Kotlin plugin versions, etc. to all align), and

Handle this conditionally in the template — use the old 8.7 wrapper for target=android and the new 8.14.5 wrapper for all other Java targets.

That said, looking at the PR more carefully: there's already a separate Android-specific template at modules/openapi-generator/src/main/resources/android/gradle-wrapper.properties.mustache which is also being bumped to 8.14.5. That one would face the same incompatibility if its build script still uses AGP 2.3.+.

Worth checking whether the Android template's build.gradle still references that old AGP version — if someone already modernized it, 8.14.5 might work there.

_{Tip: get faster answers by chatting with cubic’s review copilot in the review UI}

I think this is AI hallucination.

I know little of Android development. But AGP 2.3 is something pre-historic, mentioning Gradle 3.3: https://developer.android.com/build/releases/agp-2-3-0-release-notes

I don't see any evidence I am breaking something more by using Gradle 8.14.5 compared to using Gradle 8.7.

cubic-dev-ai · 2026-07-23T09:38:04Z

 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip


P2: The checked-in wrapper version is inconsistent with the project's wrapper-task configuration: gradle wrapper will overwrite this 8.14.5 URL with 8.14.3. Updating the wrapper block in build.gradle to 8.14.5 as part of this change would keep regeneration from restoring the older distribution.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/petstore/kotlin-jvm-jackson/gradle/wrapper/gradle-wrapper.properties, line 3: <comment>The checked-in wrapper version is inconsistent with the project's wrapper-task configuration: `gradle wrapper` will overwrite this 8.14.5 URL with 8.14.3. Updating the `wrapper` block in `build.gradle` to 8.14.5 as part of this change would keep regeneration from restoring the older distribution.</comment> <file context> @@ -1,6 +1,6 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip +distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip networkTimeout=10000 validateDistributionUrl=true </file context>

cubic-dev-ai · 2026-07-23T09:38:05Z

 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip


P2: The new Gradle executable is still downloaded without a pinned SHA-256, so a corrupted or tampered archive at the configured URL would not be detected by the wrapper. Adding the official distributionSha256Sum is especially important for this security-focused dependency update.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/petstore/java/okhttp-gson-3.1/gradle/wrapper/gradle-wrapper.properties, line 3: <comment>The new Gradle executable is still downloaded without a pinned SHA-256, so a corrupted or tampered archive at the configured URL would not be detected by the wrapper. Adding the official `distributionSha256Sum` is especially important for this security-focused dependency update.</comment> <file context> @@ -1,6 +1,6 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip +distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip networkTimeout=10000 validateDistributionUrl=true </file context>

Suggested change

distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip

distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip

distributionSha256Sum=6f74b601422d6d6fc4e1f9a1ab6522f642c2fdcbc15ae33ebd30ba3d7198e854

cubic-dev-ai · 2026-07-23T09:38:05Z

 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip


P2: Android-targeted builds now use Gradle 8.14.5 with the project's legacy com.android.tools.build:gradle:2.3.+ plugin, causing configuration failure when -Ptarget=android is enabled. Updating the Android Gradle Plugin and its legacy DSL (or retaining a wrapper compatible with AGP 2.3) is needed alongside this wrapper bump.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/petstore/java/okhttp-gson-parcelableModel/gradle/wrapper/gradle-wrapper.properties, line 3: <comment>Android-targeted builds now use Gradle 8.14.5 with the project's legacy `com.android.tools.build:gradle:2.3.+` plugin, causing configuration failure when `-Ptarget=android` is enabled. Updating the Android Gradle Plugin and its legacy DSL (or retaining a wrapper compatible with AGP 2.3) is needed alongside this wrapper bump.</comment> <file context> @@ -1,6 +1,6 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip +distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip networkTimeout=10000 validateDistributionUrl=true </file context>

It's not safe to use 8.x before 8.14.5 due to multiple vulnerabilities. Keeping wrapper 8.1.1 unchanged just in case there are some incompatibilities.

pkubowicz · 2026-07-23T12:21:37Z

Regarding the CI failure in 'Samples Java (sbt)'. The output is:

Run sbt -v +test
[sbt_options] declare -a sbt_options=()
[process_args] java_version = '11'
[error] sbt 2.x requires JDK 17 or above, but you have JDK 11
Error: Process completed with exit code 1.

I did not touch sbt (git show | grep sbt), so it's main branch problem, not something from my PR.

cubic-dev-ai Bot reviewed Jul 23, 2026

View reviewed changes

pkubowicz force-pushed the gradle-8.14.5 branch from 547322e to 730ab8a Compare July 23, 2026 10:19

build(deps): Generate Gradle Wrapper 8.14.5 instead of 8.7 and 8.14.3

b6096f2

It's not safe to use 8.x before 8.14.5 due to multiple vulnerabilities. Keeping wrapper 8.1.1 unchanged just in case there are some incompatibilities.

pkubowicz force-pushed the gradle-8.14.5 branch from 730ab8a to b6096f2 Compare July 23, 2026 10:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

build(deps): Generate Gradle Wrapper 8.14.5 instead of 8.7 and 8.14.3 (SECURITY)#24396

build(deps): Generate Gradle Wrapper 8.14.5 instead of 8.7 and 8.14.3 (SECURITY)#24396
pkubowicz wants to merge 1 commit into
OpenAPITools:masterfrom
pkubowicz:gradle-8.14.5

pkubowicz commented Jul 23, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

cubic-dev-ai Bot Jul 23, 2026

Uh oh!

cubic-dev-ai Bot Jul 23, 2026

Uh oh!

pkubowicz Jul 23, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot Jul 23, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot Jul 23, 2026

Uh oh!

cubic-dev-ai Bot Jul 23, 2026

Uh oh!

Uh oh!

pkubowicz commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
	distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
	distributionSha256Sum=6f74b601422d6d6fc4e1f9a1ab6522f642c2fdcbc15ae33ebd30ba3d7198e854

Uh oh!

Uh oh!

Conversation

pkubowicz commented Jul 23, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR checklist

Summary by cubic

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

pkubowicz Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pkubowicz commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pkubowicz commented Jul 23, 2026 •

edited by cubic-dev-ai Bot

Loading

cubic-dev-ai Bot left a comment •

edited

Loading