Versions of plugins from settings.gradle are not checked

Steps to reproduce:

• use Gradle 6.x
• add some plugin with old version to settings.gradle(.kts) for example “com.gradle.enterprise”
• invoke updateDependencies task

plugins {
    id("com.gradle.enterprise") version "3.1"
}

At the time of writing there is a version 3.1.1.

More info about build scan plugin: https://docs.gradle.com/enterprise/gradle-plugin/#gradle_6_x_and_later

[ben-manes]

Yes, if I recall correctly they use simple regex parsing of the build files rather than executing it. That has other limitations.

The long-term approach that Github/Gradle are pursuing is outlined in this proposal and github issue. This would be similar to having static analyzers produce SARIF reports that the Github Security dashboard consumes, so it could simply be an action that feeds the current dependency graph into Github for a monitoring dashboard.

[ben-manes]

Yes, see my comment above @nedtwigg. We would need to use both of those methods to capture those dependencies. Since those are not configurations, we’d have to make a detached configuration with the dependencies, repositories, and resolution strategy that those methods provide. Then resolve and print in the report with everything else.