Simplify Dependency Management for Android Projects with Gradle Version Catalog and Dependabot | by Jordan Gout | Jul, 2023
GitHub Dependabot is an automated dependency management tool provided by GitHub. It monitors a project’s dependencies and notifies about outdated versions. It generates pull requests with information on the updates available. Dependabot helps to ensure projects are using the latest dependencies. Since march-23 Dependabot has…
Android Security: Securing your Gradle builds from baddies | by Ed Holloway-George | Jul, 2023
The provenance, or origin of a dependency is verified via the signature that was used to sign the artifacts. This signature is generated by a public-private key pair used by the library’s author when uploading the library to a Maven Repo. To allow for this…