Send resolved list of gradle dependencies (including versions) back to the client

[Filazapovich]

It can be useful for analyzing dependencies for security reasons. The same idea as for #470 but for Android

[ekharkunov]

@Filazapovich Please, provide description of expected format for requested information. There are no formalized format (like Podfile.lock) for gradle dependencies.

[harel-mi-MA]

@Filazapovich Please, provide description of expected format for requested information. There are no formalized format (like Podfile.lock) for gradle dependencies.

There's a format, gradle.lockfile as specified here: https://docs.gradle.org/current/userguide/dependency_locking.html#sec:generate-locks

It would also be helpful to retrieve the tree of the dependencies as shown here:
https://docs.gradle.org/current/userguide/viewing_debugging_dependencies.html#sec:listing-dependencies

[harel-mi-MA]

Hi,
Thank you for being swift about it!
Is there an option though to include the dependencies tree as well as I mentioned before (https://docs.gradle.org/current/userguide/viewing_debugging_dependencies.html#sec:listing-dependencies)?
It would help understanding how each of the dependencies has been introduced to the code base and would allow to evaluate how to upgrade a package if being transitive.

[britzl]

Hi, Thank you for being swift about it! Is there an option though to include the dependencies tree as well as I mentioned before (https://docs.gradle.org/current/userguide/viewing_debugging_dependencies.html#sec:listing-dependencies)? It would help understanding how each of the dependencies has been introduced to the code base and would allow to evaluate how to upgrade a package if being transitive.

This is something we can add in a separate PR. The gradle.lockfile will solve the urgent need of understanding how gradle resolved your dependencies.

[britzl]

This is something we can add in a separate PR

Feature Request: #647