What's new at Socket?

You can now upload gradle.lockfile files directly to Socket! This means Gradle projects no longer need to generate a CycloneDX SBOM to take advantage of Socket’s deep dependency analysis.

Using gradle.lockfile gives you more reproducible builds and improves protection against dependency hijacking—no more risk of a transitive dependency quietly changing under your nose.

If you're not using lockfiles yet, now’s a great time to start:

dependencyLocking.lockAllConfigurations()

Then run:

./gradlew dependencies --write-locks

…and commit the generated gradle.lockfile to your repo.