feat: Better gradle internal project depedencies support

gitphill · calhar-snyk · commit 22ba468b6554 · 2025-06-30T14:11:01.000+01:00
Include all module artifacts as nodes in the dep-graph: snyk/snyk-gradle-plugin#299 Changes the ID of nodes in the resulting dep-graph resolved by snyk-gradle-plugin. The new node ID ensures each module artifact is identified as: `groupId:artifactId:type(:classifier)@version` where type and (optionally) classifier are new. Also better support for internal project dependencies: snyk/snyk-gradle-plugin#304 Includes changes to make the above safe for android projects: snyk/snyk-gradle-plugin#307
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -119,7 +119,7 @@
     "snyk-cpp-plugin": "2.24.1",
     "snyk-docker-plugin": "7.1.0",
     "snyk-go-plugin": "1.23.0",
-    "snyk-gradle-plugin": "4.9.2",
+    "snyk-gradle-plugin": "5.0.2",
     "snyk-module": "3.1.0",
     "snyk-mvn-plugin": "4.0.1",
     "snyk-nodejs-lockfile-parser": "2.2.1",
diff --git a/test/acceptance/workspaces/gradle-with-classifier/build.gradle b/test/acceptance/workspaces/gradle-with-classifier/build.gradle
@@ -0,0 +1,11 @@
+plugins {
+    id 'application'
+}
+
+repositories {
+    mavenCentral()
+}
+
+dependencies {
+    implementation 'net.sf.json-lib:json-lib:2.4:jdk13'
+}
diff --git a/test/jest/acceptance/snyk-test/basic-test-all-languages.spec.ts b/test/jest/acceptance/snyk-test/basic-test-all-languages.spec.ts
@@ -186,6 +186,37 @@ describe('`snyk test` of basic projects for each language/ecosystem', () => {
     expect(code).toEqual(0);
   });
 
+  test('run `snyk test` on a gradle project and check top-level dependency node id', async () => {
+    const project = await createProjectFromWorkspace('gradle-with-classifier');
+
+    const { code, stderr, stdout } = await runSnykCLI('test --print-graph', {
+      cwd: project.path(),
+      env,
+    });
+
+    if (code != 0) {
+      console.debug(stderr);
+      console.debug('---------------------------');
+      console.debug(stdout);
+    }
+    expect(code).toEqual(0);
+
+    const depGraphJsonStr = stdout
+      .split('DepGraph data:')[1]
+      .split('DepGraph target:')[0];
+    const depGraphJson = JSON.parse(depGraphJsonStr);
+    expect(depGraphJson.pkgManager.name).toEqual('gradle');
+    expect(depGraphJson.pkgs).toContainEqual({
+      id: 'net.sf.json-lib:json-lib@2.4',
+      info: { name: 'net.sf.json-lib:json-lib', version: '2.4' },
+    });
+    expect(depGraphJson.graph.nodes).toContainEqual({
+      nodeId: 'net.sf.json-lib:json-lib:jar:jdk13@2.4',
+      pkgId: 'net.sf.json-lib:json-lib@2.4',
+      deps: expect.any(Array),
+    });
+  });
+
   test('run `snyk test` on a cocoapods project', async () => {
     const project = await createProjectFromWorkspace('cocoapods-app');
 
