December 2025

Welcome to the December 2025 Gradle Build Tool newsletter! This month, we're bringing you a review of Gradle in 2025, a look at the Develocity 2025.4 release, a deep dive into Develocity Universal Cache, and the open-sourcing of the popular Netflix Nebula ArchRules plugin.

From the community

New posts

• Is the Java Ecosystem Cursed? A Dependency Analysis Perspective – Tony Robalik dissects the inherent complexities and anti-patterns in the Java ecosystem (like split packages, shading, reliance on classpath order, and compiler differences) that make static dependency analysis and build integrity challenging.

• Detecting Maven-Hijack-style risks in Gradle builds with the Dependency Analysis Gradle Plugin – Laura Kassovic highlights the supply chain risk of Maven-Hijack, which weaponizes duplicate classes on the classpath, and how the Dependency Analysis Gradle Plugin (DAGP) enhances security by checking for binary-incompatible duplicate classes.

• Knocker-Uppers - PGP Validation of Gradle Wrapper and Distribution – Aurimas Liutikas addresses the critical supply chain risk of the Gradle Wrapper and a new defense layer: the ability to use PGP keys to validate the cryptographic signatures of both the gradle-wrapper.jar and the downloaded Gradle distribution zip.

New videos

• The Benevolent Gradle Overlord: Keeping Order – Aurimas Liutikas @ droidcon London 2025 provides strategies for build engineers and platform teams to maintain build health, stability, and speed in the face of rapidly growing codebases and increasing team constraints.

• Fix Flaky Android Builds Forever with Gradle Dependency Locking – Codetutor explains the problem of build non-determinism (flaky builds) and demonstrates the four-step process of implementing Gradle dependency locking and the version catalog to ensure consistent dependency resolution and reproducible builds.

• Understanding Gradle caches (in French) – Florian Le Ficher @ GDG Paris Android User Group provides a detailed breakdown of Gradle's various caching mechanisms, where they are stored, how to analyze their impact, and how the BackMarket team implemented custom logic to manage CI caching effectively.

New releases

• Spock 2.4 - The popular testing and specification framework for Java and Groovy now offers support for Groovy 5. Don’t forget to check out their new website.

• Spring Boot 4.0.0 – This major release brings full support for Gradle 9 and continues the modularization effort for building robust, modern Spring Boot applications.

From the Gradle team

The year in review

The year 2025 showcased the massive scale and adoption of the Gradle ecosystem, which recorded over 600 million downloads and saw nearly 2 billion plugins downloaded from the Gradle Plugin Portal. This unprecedented growth was driven and supported by a commitment to core quality, headlined by the release of Gradle 9.0.0. This definitive release cemented our focus on speed and developer experience, introducing key features that set a new standard for performance and stability:

• Configuration Cache – Gradle promoted Configuration Cache to the preferred execution mode, with graceful fallback and improved encryption to reduce accidental data exposure.

• Daemon JVM auto-provisioning – Gradle introduced the capability to automatically download the JVM required by the Daemon.

• Modern Java & languages – Gradle raised its core requirement to Java 17+, added support for Java 24/25, and upgraded to Groovy 4 and Kotlin 2.2 for improved performance and memory usage.

• Reproducible archives by default  – Gradle ensured deterministic outputs by enforcing that archives (JARs, WARs, etc.) are built consistently across different environments.

• Kotlin DSL – Gradle leveraged the K2 compiler, improved script compilation avoidance, and switched to JSpecify on the Gradle API for stricter nullability handling.

More 2025 highlights you might have missed:

• Gradle Best Practices Guide – Gradle released an opinionated “Do This, Not That” guide created with Google and JetBrains to help teams avoid common pitfalls.

• Maven Central Publishing and Mirroring – Gradle worked with Maven Central to minimize unnecessary traffic and provided tooling recommendations for publishing after the Sonatype OSSRH sunset. 

• Official Gradle Docker Images – Gradle took over the official images (now with 100M+ downloads and counting).

• Declarative Gradle – Work continued toward declarative and toolable build definitions.