What changed, and why it matters
This commit updates the project's build tool (Gradle) from version 8.9 to 8.14.3 and adjusts related build scripts and plugins. It is a routine maintenance change. There is no direct evidence in the commit that it fixes a security vulnerability, but keeping build tools up to date can help avoid known bugs and weaknesses in older versions.
Treat as routine maintenance. Verify the upgraded Gradle distribution and wrapper JAR match official Gradle 8.14.3 release hashes to prevent supply-chain tampering. Review release notes for Gradle 8.14.3 and updated plugins for any disclosed security fixes. No immediate application-level security response is indicated.
Security signals we found
Build toolchain upgrade may address known vulnerabilities in older Gradle 8.9 or bundled dependencies, but no specific CVE is referenced in the commit.
Removal of third-party moduleplugin reduces dependency surface and potential supply-chain exposure.
No changes to cryptographic, networking, or wallet-handling code.
Evidence from the diff
The commit upgrades Gradle wrapper and build configuration from 8.9 to 8.14.3. It updates plugin versions (jlink 3.1.1→3.1.2, extra-java-module-info 1.9→1.13), removes the org.javamodularity:moduleplugin dependency, replaces deprecated Gradle APIs (project.getTasks().create → register), and simplifies the JavaFX exec task by removing module-plugin-specific logic. The gradlew/gradlew.bat scripts are regenerated with current Gradle wrapper conventions. No application source code or wallet logic is changed.
Changed components
Gradle wrapper (gradle-wrapper.jar, gradle-wrapper.properties)gradlew / gradlew.bat launcher scriptsbuild.gradlebuildSrc build plugin and JavaFX plugin codejlink and extra-java-module-info Gradle pluginsInspect captured patch +32 / −65
diff --git a/build.gradle b/build.gradle
index 7589ccd..6e9134e 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,8 +1,8 @@
plugins {
id 'application'
id 'org-openjfx-javafxplugin'
- id 'org.beryx.jlink' version '3.1.1'
- id 'org.gradlex.extra-java-module-info' version '1.9'
+ id 'org.beryx.jlink' version '3.1.2'
+ id 'org.gradlex.extra-java-module-info' version '1.13'
id 'io.matthewnelson.kmp.tor.resource-filterjar' version '408.16.3'
}
@@ -19,12 +19,12 @@ if(System.getProperty("os.arch") == "aarch64") {
}
def headless = "true".equals(System.getProperty("java.awt.headless"))
-group 'com.sparrowwallet'
-version '2.2.4'
+group = 'com.sparrowwallet'
+version = '2.2.4'
repositories {
mavenCentral()
- maven { url 'https://code.sparrowwallet.com/api/packages/sparrowwallet/maven' }
+ maven { url = uri('https://code.sparrowwallet.com/api/packages/sparrowwallet/maven') }
}
tasks.withType(AbstractArchiveTask) {
diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle
index 8cf7a83..a479973 100644
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -4,13 +4,12 @@ plugins {
dependencies {
implementation 'com.google.gradle:osdetector-gradle-plugin:1.7.3'
- implementation 'org.javamodularity:moduleplugin:1.8.14'
}
repositories {
mavenCentral()
maven {
- url "https://plugins.gradle.org/m2/"
+ url = uri("https://plugins.gradle.org/m2/")
}
}
diff --git a/buildSrc/src/main/java/org/openjfx/gradle/JavaFXPlugin.java b/buildSrc/src/main/java/org/openjfx/gradle/JavaFXPlugin.java
index 2b5e59d..a3faafc 100644
--- a/buildSrc/src/main/java/org/openjfx/gradle/JavaFXPlugin.java
+++ b/buildSrc/src/main/java/org/openjfx/gradle/JavaFXPlugin.java
@@ -32,7 +32,6 @@ package org.openjfx.gradle;
import com.google.gradle.osdetector.OsDetectorPlugin;
import org.gradle.api.Plugin;
import org.gradle.api.Project;
-import org.javamodularity.moduleplugin.ModuleSystemPlugin;
import org.openjfx.gradle.tasks.ExecTask;
public class JavaFXPlugin implements Plugin<Project> {
@@ -40,10 +39,9 @@ public class JavaFXPlugin implements Plugin<Project> {
@Override
public void apply(Project project) {
project.getPlugins().apply(OsDetectorPlugin.class);
- project.getPlugins().apply(ModuleSystemPlugin.class);
project.getExtensions().create("javafx", JavaFXOptions.class, project);
- project.getTasks().create("configJavafxRun", ExecTask.class, project);
+ project.getTasks().register("configJavafxRun", ExecTask.class, project);
}
}
diff --git a/buildSrc/src/main/java/org/openjfx/gradle/tasks/ExecTask.java b/buildSrc/src/main/java/org/openjfx/gradle/tasks/ExecTask.java
index 6b31f84..d62abcb 100644
--- a/buildSrc/src/main/java/org/openjfx/gradle/tasks/ExecTask.java
+++ b/buildSrc/src/main/java/org/openjfx/gradle/tasks/ExecTask.java
@@ -33,27 +33,19 @@ import org.gradle.api.DefaultTask;
import org.gradle.api.GradleException;
import org.gradle.api.Project;
import org.gradle.api.file.FileCollection;
-import org.gradle.api.logging.Logger;
-import org.gradle.api.logging.Logging;
import org.gradle.api.plugins.ApplicationPlugin;
import org.gradle.api.tasks.JavaExec;
import org.gradle.api.tasks.TaskAction;
-import org.javamodularity.moduleplugin.extensions.RunModuleOptions;
import org.openjfx.gradle.JavaFXModule;
import org.openjfx.gradle.JavaFXOptions;
import org.openjfx.gradle.JavaFXPlatform;
import javax.inject.Inject;
import java.io.File;
-import java.util.ArrayList;
import java.util.Arrays;
-import java.util.List;
import java.util.TreeSet;
public class ExecTask extends DefaultTask {
-
- private static final Logger LOGGER = Logging.getLogger(ExecTask.class);
-
private final Project project;
private JavaExec execTask;
@@ -78,37 +70,11 @@ public class ExecTask extends DefaultTask {
var definedJavaFXModuleNames = new TreeSet<>(javaFXOptions.getModules());
if (!definedJavaFXModuleNames.isEmpty()) {
- RunModuleOptions moduleOptions = execTask.getExtensions().findByType(RunModuleOptions.class);
-
final FileCollection classpathWithoutJavaFXJars = execTask.getClasspath().filter(
jar -> Arrays.stream(JavaFXModule.values()).noneMatch(javaFXModule -> jar.getName().contains(javaFXModule.getArtifactName()))
);
final FileCollection javaFXPlatformJars = execTask.getClasspath().filter(jar -> isJavaFXJar(jar, javaFXOptions.getPlatform()));
-
- if (moduleOptions != null) {
- LOGGER.info("Modular JavaFX application found");
- // Remove empty JavaFX jars from classpath
- execTask.setClasspath(classpathWithoutJavaFXJars.plus(javaFXPlatformJars));
- definedJavaFXModuleNames.forEach(javaFXModule -> moduleOptions.getAddModules().add(javaFXModule));
- } else {
- LOGGER.info("Non-modular JavaFX application found");
- // Remove all JavaFX jars from classpath
- execTask.setClasspath(classpathWithoutJavaFXJars);
-
- var javaFXModuleJvmArgs = List.of("--module-path", javaFXPlatformJars.getAsPath());
-
- var jvmArgs = new ArrayList<String>();
- jvmArgs.add("--add-modules");
- jvmArgs.add(String.join(",", definedJavaFXModuleNames));
-
- List<String> execJvmArgs = execTask.getJvmArgs();
- if (execJvmArgs != null) {
- jvmArgs.addAll(execJvmArgs);
- }
- jvmArgs.addAll(javaFXModuleJvmArgs);
-
- execTask.setJvmArgs(jvmArgs);
- }
+ execTask.setClasspath(classpathWithoutJavaFXJars.plus(javaFXPlatformJars));
}
} else {
throw new GradleException("Run task not found. Please, make sure the Application plugin is applied");
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index d64cd49..1b33c55 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 09523c0..d4081da 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.9-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
diff --git a/gradlew b/gradlew
index 1aa94a4..23d15a9 100755
--- a/gradlew
+++ b/gradlew
@@ -15,6 +15,8 @@
# See the License for the specific language governing permissions and
# limitations under the License.
#
+# SPDX-License-Identifier: Apache-2.0
+#
##############################################################################
#
@@ -55,7 +57,7 @@
# Darwin, MinGW, and NonStop.
#
# (3) This script is generated from the Groovy template
-# https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+# https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
# within the Gradle project.
#
# You can find Gradle at https://github.com/gradle/gradle/.
@@ -84,7 +86,7 @@ done
# shellcheck disable=SC2034
APP_BASE_NAME=${0##*/}
# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
-APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
# Use the maximum available, or set MAX_FD != -1 to use that value.
MAX_FD=maximum
@@ -112,7 +114,7 @@ case "$( uname )" in #(
NONSTOP* ) nonstop=true ;;
esac
-CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+CLASSPATH="\\\"\\\""
# Determine the Java command to use to start the JVM.
@@ -203,7 +205,7 @@ fi
DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
# Collect all arguments for the java command:
-# * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+# * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
# and any embedded shellness will be escaped.
# * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
# treated as '${Hostname}' itself on the command line.
@@ -211,7 +213,7 @@ DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
set -- \
"-Dorg.gradle.appname=$APP_BASE_NAME" \
-classpath "$CLASSPATH" \
- org.gradle.wrapper.GradleWrapperMain \
+ -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
"$@"
# Stop when "xargs" is not available.
diff --git a/gradlew.bat b/gradlew.bat
index 6689b85..5eed7ee 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -13,6 +13,8 @@
@rem See the License for the specific language governing permissions and
@rem limitations under the License.
@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
@if "%DEBUG%"=="" @echo off
@rem ##########################################################################
@@ -43,11 +45,11 @@ set JAVA_EXE=java.exe
%JAVA_EXE% -version >NUL 2>&1
if %ERRORLEVEL% equ 0 goto execute
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
goto fail
@@ -57,22 +59,22 @@ set JAVA_EXE=%JAVA_HOME%/bin/java.exe
if exist "%JAVA_EXE%" goto execute
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
goto fail
:execute
@rem Setup the command line
-set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+set CLASSPATH=
@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
:end
@rem End local scope for the variables with windows NT shell
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.