{"record":{"id":"0df28ef164f25a65","repo":"gradle/gradle","slug":"dependency-verification-has-been-disabled","errorCode":null,"errorMessage":"Dependency verification has been disabled.","messagePattern":"Dependency verification has been disabled\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"platforms/software/dependency-management/src/main/java/org/gradle/api/internal/artifacts/ivyservice/ivyresolve/ExternalModuleComponentResolverFactory.java","lineNumber":209,"sourceCode":"    ) {\n        Action<? super ArtifactResolutionDetails> filter = Actions.doNothing();\n        if (repository instanceof ContentFilteringRepository) {\n            filter = ((ContentFilteringRepository) repository).getContentFilter();\n        }\n\n        if (filter == Actions.doNothing()) {\n            return moduleComponentRepository;\n        }\n\n        return new FilteredModuleComponentRepository(moduleComponentRepository, filter);\n    }\n\n    private ModuleComponentRepository<ExternalModuleComponentGraphResolveState> maybeApplyDependencyVerification(\n        ModuleComponentRepository<ExternalModuleComponentGraphResolveState> moduleComponentRepository,\n        boolean dependencyVerificationEnabled\n    ) {\n        if (!dependencyVerificationEnabled) {\n            LOGGER.warn(\"Dependency verification has been disabled.\");\n            return moduleComponentRepository;\n        }\n\n        return dependencyVerificationOverride.overrideDependencyVerification(moduleComponentRepository);\n    }\n\n    public ArtifactResult verifiedArtifact(DefaultResolvedArtifactResult defaultResolvedArtifactResult) {\n        return dependencyVerificationOverride.verifiedArtifact(defaultResolvedArtifactResult);\n    }\n\n    /**\n     * Provides access to the top-level resolver chain for looking up parent modules when parsing module descriptor files.\n     */\n    private static class ParentModuleLookupResolver implements ComponentResolvers, DependencyToComponentIdResolver, ComponentMetaDataResolver, ArtifactResolver {\n        private final UserResolverChain delegate;\n\n        public ParentModuleLookupResolver(\n            VersionComparator versionComparator,","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/gradle/gradle/blob/534f27719b66953f95cc907aae7f2c1b12f5482d/platforms/software/dependency-management/src/main/java/org/gradle/api/internal/artifacts/ivyservice/ivyresolve/ExternalModuleComponentResolverFactory.java#L191-L227","documentation":"ExternalModuleComponentResolverFactory wraps each module repository in dependency-verification machinery when verification is enabled. If the build carries verification configuration but the dependencyVerificationEnabled flag is false for this invocation (e.g. verification switched off via the org.gradle.dependency.verification Gradle property), this warning is logged and the repository chain is returned unwrapped: artifacts are resolved WITHOUT checksum or signature verification.","triggerScenarios":"A build that has gradle/verification-metadata.xml (or otherwise configures verification) is run with dependency verification disabled: -Porg.gradle.dependency.verification=off on the command line or the same key in gradle.properties, so maybeApplyDependencyVerification receives dependencyVerificationEnabled == false.","commonSituations":"A leftover org.gradle.dependency.verification=off committed to gradle.properties during an incident; CI jobs disabling verification while seeding caches; local developer overrides; test harnesses that disable verification globally.","solutions":["Remove org.gradle.dependency.verification=off from the command line and gradle.properties so verification runs again","If verification failures forced the flag, fix the root cause: audit and regenerate verification-metadata.xml with --write-verification-metadata","Treat any remaining 'off' as a tracked, expiring change; restore verification promptly","Audit the dependency cache afterwards: builds run without verification may have accepted unverified artifacts"],"exampleFix":"# before\n./gradlew build -Porg.gradle.dependency.verification=off\n# after\n./gradlew build   # gradle/verification-metadata.xml governs artifact verification again","handlingStrategy":"validation","validationCode":"# Fail CI if dependency verification is switched off anywhere\nif grep -rq 'org.gradle.dependency.verification=off' gradle.properties .github/workflows ci/ 2>/dev/null; then\n  echo 'dependency verification is disabled somewhere; remove the override'\n  exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never commit org.gradle.dependency.verification=off; use it only as a local, expiring override","Add a repo scan / branch-protection check for verification-disabling flags","Alert on this warning string in CI log monitoring","Rotate verification-metadata.xml whenever builds ran unverified"],"tags":["gradle","dependency-verification","security","supply-chain"],"backgroundTag":"dependency-verification-disabled","analyzedSha":"534f27719b66953f95cc907aae7f2c1b12f5482d","analyzedAt":"2026-08-22T08:09:12.375Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}