Your build ships to production. Secure it like it does.
Supply chain security starts at the build. Builds execute code, and their output is what ships. A compromised build system lets attackers inject malicious code that bypasses typical security checks and code review entirely.
The build layer has been the entry point for some of the most damaging supply chain attacks.
Attackers now use AI to find and exploit vulnerabilities faster than ever.
Ready to secure your pipeline?
Contact usOur open-source promise
Gradle ships strong supply-chain protections, including built-in dependency verification.
But our end-of-life policy limits security fixes to the latest minor of the current and previous major. On anything older, you're building production artifacts with end-of-life software.
| Version | Open source | Subscription |
|---|---|---|
| Current major Latest minor | Covered | Covered |
| Current major, earlier minors Released in the last 12 months | Not covered | Covered |
| Previous major Latest minor | Covered | Covered |
| Most recent end-of-life major Latest minor | Not covered | Covered |
| All older end-of-life versions | Contact us | |
What's in the subscription
Prioritized security fixes under SLA
Critical vulnerabilities fixed in 7 days. High severity in 30 days. Contractual, not best-effort.
Extended security maintenance
High-severity and critical fixes (CVSS ≥ 7) beyond the open-source end-of-life policy.
Embargoed vulnerability information
Advance, confidential notification of newly discovered vulnerabilities, including available mitigations.
If you need broader coverage or a formal SLA?
Contact usContact us
Get started with a Gradle Security Subscription.
Thanks — we'll be in touch shortly.
Your request is with the Gradle team. We'll reply to the address you gave us. In the meantime, the FAQ below covers what the subscription includes.
Your request wasn't submitted.
Something went wrong on our side. Please try again below, or email info@gradle.com and we'll pick it up from there.
FAQ
Is this a "CVE-free" guarantee?
High-severity and critical vulnerabilities in Gradle itself are fixed under the SLA. What it does not promise is a clean scanner report; some findings come from third-party libraries.
How are vulnerabilities in third-party dependencies handled?
Gradle bundles third-party libraries, and a CVE reported against one of them does not always affect how Gradle uses it. For critical vulnerabilities, we publish an impact analysis; including an adjusted CVSS score and the reasoning behind it.
Which versions exactly are covered?
The latest minor of the most recent end-of-life major, plus minor releases in the current major stream released in the last 12 months.
Can a backported patch change behavior?
Rarely. When a third-party dependency must be upgraded to fix a vulnerability, constraints can shift, for example, the minimum supported Java version. Any such change is documented in the advisory.
How are patches delivered?
Through a secure file-sharing system. You host the binaries in your own artifact repository and point the Gradle wrapper at them.
Does this change security for open-source users?
Open-source Gradle continues to receive security fixes under the existing policy.