Skip to content

build(deps): Generate Gradle Wrapper 8.14.5 instead of 8.7 and 8.14.3 (SECURITY) #24396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pkubowicz wants to merge 1 commit into
base: master
Choose a base branch
from
Open

build(deps): Generate Gradle Wrapper 8.14.5 instead of 8.7 and 8.14.3 (SECURITY) #24396

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion modules/openapi-generator/src/main/resources/Java/gradle-wrapper.properties.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip

@cubic-dev-ai cubic-dev-ai Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Android-targeted Java clients will fail during Gradle configuration after this shared wrapper is upgraded: the target=android branch still applies com.android.tools.build:gradle:2.3.+, which cannot run on Gradle 8.14.5. Keeping a compatible wrapper for that branch or upgrading/splitting the Android build configuration would avoid breaking generated Android projects.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At modules/openapi-generator/src/main/resources/Java/gradle-wrapper.properties.mustache, line 3:

<comment>Android-targeted Java clients will fail during Gradle configuration after this shared wrapper is upgraded: the `target=android` branch still applies `com.android.tools.build:gradle:2.3.+`, which cannot run on Gradle 8.14.5. Keeping a compatible wrapper for that branch or upgrading/splitting the Android build configuration would avoid breaking generated Android projects.</comment>

<file context>
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
</file context>

@cubic-dev-ai cubic-dev-ai Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pkubowicz The short answer: Probably none of the 8.x series.

The target=android template in this project pins com.android.tools.build:gradle:2.3.+ — that's the Android Gradle Plugin (AGP) 2.3.x, which was released in 2017. AGP 2.3.x requires Gradle 3.3–4.10 at most. Even Gradle 5.x won't work, let alone 8.x.

If you wanted to keep the Android template functional with the new wrapper, you'd need to:

  1. Upgrade the AGP version to something much newer (AGP 8.x requires Gradle 8.x+, but also needs the Android SDK build tools, Kotlin plugin versions, etc. to all align), and
  2. Handle this conditionally in the template — use the old 8.7 wrapper for target=android and the new 8.14.5 wrapper for all other Java targets.

That said, looking at the PR more carefully: there's already a separate Android-specific template at modules/openapi-generator/src/main/resources/android/gradle-wrapper.properties.mustache which is also being bumped to 8.14.5. That one would face the same incompatibility if its build script still uses AGP 2.3.+.

Worth checking whether the Android template's build.gradle still references that old AGP version — if someone already modernized it, 8.14.5 might work there.

Tip: get faster answers by chatting with cubic’s review copilot in the review UI

@pkubowicz pkubowicz Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is AI hallucination.

I know little of Android development. But AGP 2.3 is something pre-historic, mentioning Gradle 3.3: https://developer.android.com/build/releases/agp-2-3-0-release-notes

I don't see any evidence I am breaking something more by using Gradle 8.14.5 compared to using Gradle 8.7.

networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion modules/openapi-generator/src/main/resources/android/gradle-wrapper.properties.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
zipStoreBase=GRADLE_USER_HOME
zipStorePath=wrapper/dists
2 changes: 1 addition & 1 deletion modules/openapi-generator/src/main/resources/kotlin-client/build.gradle.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ version '{{artifactVersion}}'
{{^omitGradleWrapper}}

wrapper {
gradleVersion = '8.14.3'
gradleVersion = '8.14.5'
distributionUrl = "https://services.gradle.org/distributions/gradle-$gradleVersion-all.zip"
}
{{/omitGradleWrapper}}
Expand Down
2 changes: 1 addition & 1 deletion ...les/openapi-generator/src/main/resources/kotlin-client/gradle-wrapper.properties.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-7.6.2-all.zip
{{/jvm-volley}}
{{^jvm-volley}}
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
{{/jvm-volley}}
networkTimeout=10000
validateDistributionUrl=true
Expand Down
2 changes: 1 addition & 1 deletion ...src/main/resources/kotlin-spring/libraries/spring-boot/gradle-wrapper.properties.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
{{#useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-bin.zip{{/useSpringBoot4}}{{^useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.1.1-bin.zip{{/useSpringBoot4}}
{{#useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip{{/useSpringBoot4}}{{^useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.1.1-bin.zip{{/useSpringBoot4}}
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion ...rc/main/resources/kotlin-spring/libraries/spring-cloud/gradle-wrapper.properties.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
{{#useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-bin.zip{{/useSpringBoot4}}{{^useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.1.1-bin.zip{{/useSpringBoot4}}
{{#useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip{{/useSpringBoot4}}{{^useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.1.1-bin.zip{{/useSpringBoot4}}

@cubic-dev-ai cubic-dev-ai Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Generated Spring Cloud projects download the new Gradle distribution without verifying its SHA-256, so a compromised or misrouted distribution endpoint can supply code that runs during the build despite this security-focused upgrade. Adding the verified distributionSha256Sum for the 8.14.5 branch would provide artifact-integrity protection.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At modules/openapi-generator/src/main/resources/kotlin-spring/libraries/spring-cloud/gradle-wrapper.properties.mustache, line 3:

<comment>Generated Spring Cloud projects download the new Gradle distribution without verifying its SHA-256, so a compromised or misrouted distribution endpoint can supply code that runs during the build despite this security-focused upgrade. Adding the verified `distributionSha256Sum` for the 8.14.5 branch would provide artifact-integrity protection.</comment>

<file context>
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-{{#useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-bin.zip{{/useSpringBoot4}}{{^useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.1.1-bin.zip{{/useSpringBoot4}}
+{{#useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip{{/useSpringBoot4}}{{^useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.1.1-bin.zip{{/useSpringBoot4}}
 networkTimeout=10000
 validateDistributionUrl=true
</file context>

networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion ...lin-spring/libraries/spring-declarative-http-interface/gradle-wrapper.properties.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
{{#useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-bin.zip{{/useSpringBoot4}}{{^useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.1.1-bin.zip{{/useSpringBoot4}}
{{#useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip{{/useSpringBoot4}}{{^useSpringBoot4}}distributionUrl=https\://services.gradle.org/distributions/gradle-8.1.1-bin.zip{{/useSpringBoot4}}
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion ...s/openapi-generator/src/main/resources/kotlin-wiremock/gradle-wrapper.properties.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
Comment thread
cubic-dev-ai[bot] marked this conversation as resolved.
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/java/apache-httpclient/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/java/feign-gson/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/java/native/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion ...echo_api/java/okhttp-gson-user-defined-templates/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/java/okhttp-gson/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/java/restclient/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/java/resteasy/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/java/resttemplate/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
Comment thread
pkubowicz marked this conversation as resolved.
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion ...client/echo_api/kotlin-jvm-okhttp-multipart-json/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/kotlin-jvm-okhttp/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ group 'org.openapitools'
version '1.0.0'

wrapper {
gradleVersion = '8.14.3'
gradleVersion = '8.14.5'
distributionUrl = "https://services.gradle.org/distributions/gradle-$gradleVersion-all.zip"
}

Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/kotlin-jvm-okhttp/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/kotlin-jvm-spring-3-restclient/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ group 'org.openapitools'
version '1.0.0'

wrapper {
gradleVersion = '8.14.3'
gradleVersion = '8.14.5'
distributionUrl = "https://services.gradle.org/distributions/gradle-$gradleVersion-all.zip"
}

Expand Down
2 changes: 1 addition & 1 deletion ...s/client/echo_api/kotlin-jvm-spring-3-restclient/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/kotlin-jvm-spring-3-webclient/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ group 'org.openapitools'
version '1.0.0'

wrapper {
gradleVersion = '8.14.3'
gradleVersion = '8.14.5'
distributionUrl = "https://services.gradle.org/distributions/gradle-$gradleVersion-all.zip"
}

Expand Down
2 changes: 1 addition & 1 deletion ...es/client/echo_api/kotlin-jvm-spring-3-webclient/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/echo_api/kotlin-model-prefix-type-mappings/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ group 'org.openapitools'
version '1.0.0'

wrapper {
gradleVersion = '8.14.3'
gradleVersion = '8.14.5'
distributionUrl = "https://services.gradle.org/distributions/gradle-$gradleVersion-all.zip"
}

Expand Down
2 changes: 1 addition & 1 deletion ...lient/echo_api/kotlin-model-prefix-type-mappings/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/others/java/jersey2-oneOf-Mixed/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/others/java/jersey2-oneOf-duplicates/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/others/java/okhttp-gson-oneOf-array/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/others/java/okhttp-gson-oneOf/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/others/java/okhttp-gson-streaming/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion .../client/others/java/restclient-enum-in-multipart/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion ...es/client/others/java/restclient-sealedInterface/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip

@cubic-dev-ai cubic-dev-ai Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The updated wrapper still executes a downloaded Gradle ZIP without pinning its digest, so a compromised distribution path or artifact could be accepted as the build tool. Adding the official SHA-256 for gradle-8.14.5-bin.zip via distributionSha256Sum would preserve the security intent of this upgrade.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/others/java/restclient-sealedInterface/gradle/wrapper/gradle-wrapper.properties, line 3:

<comment>The updated wrapper still executes a downloaded Gradle ZIP without pinning its digest, so a compromised distribution path or artifact could be accepted as the build tool. Adding the official SHA-256 for `gradle-8.14.5-bin.zip` via `distributionSha256Sum` would preserve the security intent of this upgrade.</comment>

<file context>
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
</file context>

networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion ...nt/others/java/restclient-useAbstractionForFiles/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion .../others/java/resttemplate-list-schema-validation/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion .../others/java/resttemplate-useAbstractionForFiles/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion ...les/client/others/java/webclient-sealedInterface/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion ...client/others/java/webclient-sealedInterface_3_1/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip

@cubic-dev-ai cubic-dev-ai Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Builds now download and execute Gradle 8.14.5 without pinning the archive's SHA-256, so a compromised upstream artifact or delivery path could run arbitrary build code. Adding the official checksum for the 8.14.5 binary distribution would preserve the security goal while protecting the wrapper supply chain.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/others/java/webclient-sealedInterface_3_1/gradle/wrapper/gradle-wrapper.properties, line 3:

<comment>Builds now download and execute Gradle 8.14.5 without pinning the archive's SHA-256, so a compromised upstream artifact or delivery path could run arbitrary build code. Adding the official checksum for the 8.14.5 binary distribution would preserve the security goal while protecting the wrapper supply chain.</comment>

<file context>
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
</file context>

networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion ...ent/others/java/webclient-useAbstractionForFiles/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/others/kotlin-integer-enum/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ group 'org.openapitools'
version '1.0.0'

wrapper {
gradleVersion = '8.14.3'
gradleVersion = '8.14.5'
distributionUrl = "https://services.gradle.org/distributions/gradle-$gradleVersion-all.zip"
}

Expand Down
2 changes: 1 addition & 1 deletion samples/client/others/kotlin-integer-enum/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/others/kotlin-jvm-okhttp-non-ascii-headers/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ group 'org.openapitools'
version '1.0.0'

wrapper {
gradleVersion = '8.14.3'
gradleVersion = '8.14.5'
distributionUrl = "https://services.gradle.org/distributions/gradle-$gradleVersion-all.zip"
}

Expand Down
2 changes: 1 addition & 1 deletion ...lient/others/kotlin-jvm-okhttp-non-ascii-headers/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/others/kotlin-jvm-okhttp-parameter-tests/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ group 'org.openapitools'
version '1.0.0'

wrapper {
gradleVersion = '8.14.3'
gradleVersion = '8.14.5'
distributionUrl = "https://services.gradle.org/distributions/gradle-$gradleVersion-all.zip"
}

Expand Down
2 changes: 1 addition & 1 deletion .../client/others/kotlin-jvm-okhttp-parameter-tests/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/others/kotlin-jvm-okhttp-path-comments/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ group 'org.openapitools'
version '1.0.0'

wrapper {
gradleVersion = '8.14.3'
gradleVersion = '8.14.5'
distributionUrl = "https://services.gradle.org/distributions/gradle-$gradleVersion-all.zip"
}

Expand Down
2 changes: 1 addition & 1 deletion ...es/client/others/kotlin-jvm-okhttp-path-comments/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
2 changes: 1 addition & 1 deletion samples/client/others/kotlin-jvm-spring-3-restclient-nullable-return/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ group 'org.openapitools'
version '1.0.0'

wrapper {
gradleVersion = '8.14.3'
gradleVersion = '8.14.5'
distributionUrl = "https://services.gradle.org/distributions/gradle-$gradleVersion-all.zip"
}

Expand Down
2 changes: 1 addition & 1 deletion ...s/kotlin-jvm-spring-3-restclient-nullable-return/gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-all.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
Expand Down
Loading
Loading