Aurimas Liutikas shares a technique for debugging CI failures that won't reproduce locally and uses it to track down a real deadlock in androidx.tracing.

Hideyuki Mori's postmortem on a Gradle-based CI gate that let a planted violation through. Not because the gate's logic was broken, but because the config file it was supposed to enforce was never being loaded by the build script.

Aurimas Liutikas flags a subtler laziness footgun: calls like tasks.getByName, tasks.withType without .configureEach {}, or even Kotlin collection methods like tasks.map {} can silently undo the laziness of tasks.register.

It's time to upgrade: Gradle 9.8.0 is out, with Java 27 support and Maven mirror reuse.

Along with this release, the Plugin Publish Plugin now lets you declare Isolated Projects and Configuration Cache support with a few lines in a compatibility { features { ... } } block. Declaring compatibility earns your plugin badges on the Plugin Portal and a bump in search ranking, so the users who care can actually find you.

The Gradle Security Subscription is available now. The subscription adds to the existing open source end-of-life policy:

• SLA-backed fixes: critical vulnerabilities patched within 7 days, high-severity within 30.
• Extended security maintenance: CVSS ≥ 7 fixes are backported to the release you’re on, whether that’s a minor from the past 12 months or a version up to two majors back.
• Embargoed disclosure: subscribers get advance, confidential notice of new vulnerabilities and mitigations ahead of public disclosure.

It's built for teams with compliance obligations or production systems pinned to older Gradle versions.

The Gradle agentic team pointed two coding agents at the same real, filed bug under identical constraints. Both agents produced a passing fix using a custom evaluator that scored them on cost, speed, tool usage, and code quality. So which one gets merged?

It's a follow-up to last month's “Gradle Is Going Agentic” post, which explained why the team pushed default Configuration Cache from Gradle 10 to Gradle 11 to prioritize this work.

Develocity 2026.3 is out, with three headline themes:

• Organization-Wide Build Optimization with Develocity Agents: a new skill ranks the CI hours your organization loses to cache misses, flaky tests, and recurring failures, then hands your AI agent a “to-do” list.
• Observability for Docker Builds: every docker build now produces a Build Scan.
• Enhanced Universal Cache Security with Trusted Artifact Isolation: protects downstream consumers from cache poisoning.