AGP 9.3.0 shipped this month, supporting up to API level 37 and continuing the AGP release cadence that has closely tracked the Gradle 9.x line. If you're on AGP 9.2.x and Gradle 9.5.x, this upgrade pairs cleanly.

John Burns and Emily Yuan from Netflix's JVM Ecosystem team detail how they turned ArchUnit (normally a per-repo, JUnit-based architectural-rules tool) into a cross-repo enforcement layer for Netflix's large fleet of Java repositories.

Two new Gradle plugins do the work: an ArchRules Library Plugin for authoring and publishing rules, and an ArchRules Runner Plugin that automatically picks up bundled rules from dependencies. The system runs 358 rules across 5,000+ repositories, detecting nearly 1 million issues (~1,000 of them high-priority), and ships with OSS rule libraries for nullability, Gradle plugin best practices, deprecated Joda/Guava usage, and known-vulnerable APIs.

Tony Robalik (@autonomousapps) is a Gradle Fellow and the solo engineer behind a quietly foundational set of JVM build tools worth knowing about: the Dependency Analysis Gradle Plugin for catching unused and misclassified dependencies, the Gradle Best Practices Plugin for plugin-author anti-patterns, the Gradle Dependencies Sorter, and the community-reference Gradle Glossary. If you build with Gradle at scale, at least one or two of these tools will likely look familiar. Tony now consults independently under Faster Builds, LLC.

Benedikt Ritter distills a year of running Gradle dependency verification across the GradleX projects. Key recommendations: prefer PGP keys over per-artifact checksums, use the armored keyring so diffs are reviewable, disable key-server lookups, annotate the file with confidence indicators, and make dependency resolution reproducible.

Gradle 9.6.0 is out! This release includes:

• Configuration Cache hit rates improved: Gradle now precisely tracks which org.gradle.project.* system properties and ORG_GRADLE_PROJECT_* environment variables are actually read during the configuration phase, so changing an unused property no longer invalidates the cache.
• Deprecation of implicit lookup in parent projects: implicit property references and explicit findProperty() / property() / hasProperty() calls now emit deprecation warnings when they resolve from parent projects.
• Cloud-runner I/O performance: Significant performance gains on cloud CI runners.

Update your wrapper to get started:

./gradlew wrapper --gradle-version=9.6.0 --gradle-distribution-sha256-sum=bbaeb2fef8710818cf0e261201dab964c572f92b942812df0c3620d62a529a01 && ./gradlew wrapper

Laura Kassovic untangles what's actually happening when you "set the Kotlin version" in a Gradle build: two compilers, your Kotlin Gradle Plugin and the one Gradle embeds for build logic, each with its own language-version dial, gives you four numbers to keep straight. Gradle 9.6.0 ships embedded Kotlin 2.3.21 pinned to language version 2.2, while your KGP and its language version are yours to set.

The post explains why the separation is deliberate, where the two can safely diverge, and what to expect when you bump the Gradle wrapper.