[dependabot]

Bumps com.netflix.nebula:gradle-dependency-lock-plugin from 15.2.0 to 17.2.1.

Release notes

Sourced from com.netflix.nebula:gradle-dependency-lock-plugin's releases.

v17.2.1

What's Changed

• write test validating that project dependencies are not written to core locks file by @​wakingrufus in nebula-plugins/gradle-dependency-lock-plugin#310
• fix deprecation warning in 9.7+ by @​wakingrufus in nebula-plugins/gradle-dependency-lock-plugin#311

Full Changelog: nebula-plugins/gradle-dependency-lock-plugin@v17.2.0...v17.2.1

v17.2.0

What's Changed

• update dependency comparison library to get bugfix related to project dependencies by @​wakingrufus in nebula-plugins/gradle-dependency-lock-plugin#306
• fix CC issue by removing project field reference by @​wakingrufus in nebula-plugins/gradle-dependency-lock-plugin#307

Full Changelog: nebula-plugins/gradle-dependency-lock-plugin@v17.1.1...v17.2.0

v17.1.1

What's Changed

• Preserve project dependencies in generated locks by @​chali in nebula-plugins/gradle-dependency-lock-plugin#305

Full Changelog: nebula-plugins/gradle-dependency-lock-plugin@v17.1.0...v17.1.1

v17.1.0

What's Changed

• Restore previous Extension APIs and also keep config-caching safe APIs available by @​OdysseusLives in nebula-plugins/gradle-dependency-lock-plugin#303
• modernization by @​wakingrufus in nebula-plugins/gradle-dependency-lock-plugin#302

Backward-compatible bridge pattern (both extensions)

Every property now follows a two-name convention:

• getFooProperty() — the Gradle-managed Property<T> / SetProperty<T>, used by internal plugin code for CC-safe lazy task wiring
• getFoo() / setFoo() — concrete methods returning plain String / Boolean / Set<String>, restoring the pre-modernization public API for downstream build scripts

Set<String> bridge getters return a new LinkedHashSet<>() defensive copy so callers can mutate the result without UnsupportedOperationException and without accidentally mutating extension state.

dependencyFilter deprecation

Closure dependencyFilter is not configuration-cache serializable. It is now marked @Deprecated @Internal and setDependencyFilter() logs a warning on first use explaining the CC incompatibility. @Internal prevents it from affecting task input fingerprints.

modernization

remove usage of com.netflix.nebula.optional-base plugin and nebula-gradle-interop library

update to latest nebula OSS convention plugins

Bug fixes

• parseLockFile returned an empty map when Moshi.fromJson() returned null (triggered by a lock file whose entire content is the JSON literal null). This silently skipped all lock enforcement. Now throws GradleException — same behaviour as malformed JSON.

... (truncated)

Commits

• b465de2 fix deprecation warning in 9.7+
• aa16023 write test validating that project dependencies are not written to core locks...
• 0e344b6 fix CC issue by removing project field reference
• 6b09ca7 update dependency comparison library to get bugfix related to project depende...
• 9980db4 Preserve project dependencies in generated locks (#305)
• 5c8337a Throw GradleException when parseLockFile receives null JSON
• 2e34abe Track coreAlignmentSupport as a configuration cache input
• d1c8120 format: reformat before changes (npm-groovy-lint)
• a2756af format: reformat before changes (ktfmt, npm-groovy-lint)
• e93c095 Validate dependencyLock.override coordinates before use
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)