Update to latest gradle master by koppor · Pull Request #15279 · JabRef/jabref

koppor · 2026-03-06T12:31:57Z

⚠️ After merging, one needs to delete build-logic/build ⚠️

./gradlew --stop
rm -rf build-logic/build
./gradlew :jabgui:run

Related issues and pull requests

Updates to latest gradle/gradle#34227

Steps to test

See CI passing
./gradlew :jabgui:run succeeds on windows

Checklist

I own the copyright of the code submitted and I license it under the MIT license
I manually tested my changes in running JabRef (always required)
[/] I added JUnit tests for changes (if applicable)
[/] I added screenshots in the PR description (if change is visible to the user)
[/] I added a screenshot in the PR description showing a library with a single entry with me as author and as title the issue number
[/] I described the change in CHANGELOG.md in a way that can be understood by the average user (if change is visible to the user)
[/] I checked the user documentation for up to dateness and submitted a pull request to our user documentation repository

qodo-free-for-open-source-projects · 2026-03-06T12:32:16Z

Review Summary by Qodo

Update Gradle wrapper to latest jabref-2 distribution

✨ Enhancement

Walkthroughs

Description

• Update Gradle wrapper to latest jabref-2 distribution
• Maintains compatibility with Windows builds

Diagram

flowchart LR
  A["gradle-9.5.0-jabref-1"] -- "update to" --> B["gradle-9.5.0-jabref-2"]
  B -- "enables" --> C["Latest Gradle features"]

File Changes

1. gradle/wrapper/gradle-wrapper.properties Dependencies +1/-1

Update Gradle wrapper distribution version
• Updated distributionUrl from gradle-9.5.0-jabref-1 to gradle-9.5.0-jabref-2
• Ensures build system uses the latest JabRef-customized Gradle distribution
gradle/wrapper/gradle-wrapper.properties

qodo-free-for-open-source-projects · 2026-03-06T12:32:17Z

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0)

1. Unpinned wrapper distribution 🐞 Bug ⛨ Security

Description

The wrapper now downloads a new custom Gradle distribution (jabref-2) while URL validation is
disabled and no checksum is pinned, so a modified/compromised zip could be executed during
CI/developer builds without detection. This is a build-time supply-chain risk (potentially leading
to arbitrary code execution in the build environment).

Code

gradle/wrapper/gradle-wrapper.properties[R3-5]

+distributionUrl=https://files.jabref.org/gradle-9.5.0-jabref-2-bin.zip
networkTimeout=10000
validateDistributionUrl=false

Evidence

The wrapper is configured to download from a custom URL and explicitly disables distribution URL
validation; additionally, the properties file contains no checksum pinning for the distribution, so
integrity is not verified at the configuration level.

gradle/wrapper/gradle-wrapper.properties[1-7]
Best Practice: Gradle Wrapper documentation

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The Gradle wrapper downloads a custom Gradle distribution zip but does not pin a checksum and explicitly disables URL validation. This allows an altered distribution to be used without detection.

### Issue Context
The PR changed the `distributionUrl` to a new artifact (`jabref-2`). This is the right moment to also ensure integrity checks are in place for that new binary.

### Fix Focus Areas
- gradle/wrapper/gradle-wrapper.properties[1-7]

### Suggested changes
1. Add `distributionSha256Sum=&lt;sha256-of-gradle-9.5.0-jabref-2-bin.zip&gt;` to `gradle-wrapper.properties`.
2. Consider setting `validateDistributionUrl=true` if the custom distribution URL can pass Gradle’s validation rules; if not, document why it must remain `false` and rely on the pinned SHA-256 as the primary integrity control.
3. (Optional but recommended) Add a short note in contributing/build docs describing how the checksum is generated/verified when updating the wrapper distribution.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

ⓘ The new review experience is currently in Beta. Learn more

qodo-free-for-open-source-projects · 2026-03-06T12:34:03Z

+distributionUrl=https://files.jabref.org/gradle-9.5.0-jabref-2-bin.zip
 networkTimeout=10000
 validateDistributionUrl=false


1. Unpinned wrapper distribution 🐞 Bug ⛨ Security

The wrapper now downloads a new custom Gradle distribution (jabref-2) while URL validation is disabled and no checksum is pinned, so a modified/compromised zip could be executed during CI/developer builds without detection. This is a build-time supply-chain risk (potentially leading to arbitrary code execution in the build environment).

Agent Prompt

### Issue description The Gradle wrapper downloads a custom Gradle distribution zip but does not pin a checksum and explicitly disables URL validation. This allows an altered distribution to be used without detection. ### Issue Context The PR changed the `distributionUrl` to a new artifact (`jabref-2`). This is the right moment to also ensure integrity checks are in place for that new binary. ### Fix Focus Areas - gradle/wrapper/gradle-wrapper.properties[1-7] ### Suggested changes 1. Add `distributionSha256Sum=<sha256-of-gradle-9.5.0-jabref-2-bin.zip>` to `gradle-wrapper.properties`. 2. Consider setting `validateDistributionUrl=true` if the custom distribution URL can pass Gradle’s validation rules; if not, document why it must remain `false` and rely on the pinned SHA-256 as the primary integrity control. 3. (Optional but recommended) Add a short note in contributing/build docs describing how the checksum is generated/verified when updating the wrapper distribution.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

testlens-app · 2026-03-06T12:51:40Z

✅ All tests passed ✅

🏷️ Commit: 6846f59
▶️ Tests: 10126 executed
⚪️ Checks: 67/67 completed

Learn more about TestLens at testlens.app.

* upstream/main: (59 commits) Fix 15000 identifier (JabRef#15286) Chore(deps): Bump dev.langchain4j:langchain4j-bom in /versions (JabRef#15305) Supress JavaFX VirtualFlow Info log noise for large libraries (10k+). (JabRef#15298) Chore(deps): Bump commons-logging:commons-logging in /versions (JabRef#15304) Fix merge dialog closing immediately when only one PDF importer returns metadata (JabRef#15127) (JabRef#15287) Fixed nullable eventhandlers (JabRef#15288) New Crowdin updates (JabRef#15285) Fix the ESC key for GlobalSearchResultDialog (JabRef#15259) Remove jbang plugin banner (JabRef#15282) Chore(deps): Bump org.apache.httpcomponents.core5:httpcore5 in /versions (JabRef#15281) Udpate to latest gradle master (JabRef#15279) Migrate to GemsFX Notifications (JabRef#14762) Chore(deps): Bump JetBrains/junie-github-action from 0 to 1 (JabRef#15272) Chore(deps): Bump docker/setup-qemu-action from 3 to 4 (JabRef#15269) Feature/citation count dropdown (JabRef#15216) Update dependency org.apache.maven.plugins:maven-resources-plugin to v3.5.0 (JabRef#15275) Chore(deps): Bump jablib/src/main/resources/csl-styles (JabRef#15273) Fix more security Fix pr_body leakage Chore: add dependency-management.md (JabRef#15278) ...

Udpate to latest gradle master

f1acb41

koppor marked this pull request as ready for review March 6, 2026 12:32

koppor added the automerge PR is tagged with that label will be merged if workflows are green label Mar 6, 2026

jabref-machine approved these changes Mar 6, 2026

View reviewed changes

koppor enabled auto-merge March 6, 2026 12:32

Merge branch 'main' into update-gradle

6846f59

jabref-machine approved these changes Mar 6, 2026

View reviewed changes

qodo-free-for-open-source-projects Bot reviewed Mar 6, 2026

View reviewed changes

koppor added this pull request to the merge queue Mar 6, 2026

github-actions Bot added the status: to-be-merged PRs which are accepted and should go into the merge-queue. label Mar 6, 2026

Merged via the queue into main with commit fcdac0f Mar 6, 2026
68 checks passed

koppor deleted the update-gradle branch March 6, 2026 13:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update to latest gradle master#15279

Update to latest gradle master#15279
koppor merged 2 commits into
mainfrom
update-gradle

koppor commented Mar 6, 2026 •

edited

Loading

Uh oh!

qodo-free-for-open-source-projects Bot commented Mar 6, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Mar 6, 2026 •

edited

Loading

Uh oh!

qodo-free-for-open-source-projects Bot Mar 6, 2026

Uh oh!

testlens-app Bot commented Mar 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

koppor commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related issues and pull requests

Steps to test

Checklist

Uh oh!

qodo-free-for-open-source-projects Bot commented Mar 6, 2026

Review Summary by Qodo

Walkthroughs

File Changes

Uh oh!

qodo-free-for-open-source-projects Bot commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

qodo-free-for-open-source-projects Bot Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

testlens-app Bot commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ All tests passed ✅

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

koppor commented Mar 6, 2026 •

edited

Loading

qodo-free-for-open-source-projects Bot commented Mar 6, 2026 •

edited

Loading

testlens-app Bot commented Mar 6, 2026 •

edited

Loading