September 2026
Table of Contents
Introduction
Welcome to the September 2026 Gradle Build Tool newsletter! This month, Gradle 9.8.0, Develocity 2026.3, a new Gradle Security Subscription, and DPE Summit 2027 registration.
From the Community #
CI Breadcrumbs #
Aurimas Liutikas shares a technique for debugging CI failures that won’t reproduce locally and uses it to track down a real deadlock in androidx.tracing.
My Gate Failed #
Hideyuki Mori’s postmortem on a Gradle-based CI gate that let a planted violation through. Not because the gate’s logic was broken, but because the config file it was supposed to enforce was never being loaded by the build script.
Configuration Bomb #
Aurimas Liutikas flags a subtler laziness footgun: calls like tasks.getByName, tasks.withType without .configureEach {}, or even Kotlin collection methods like tasks.map {} can silently undo the laziness of tasks.register.
From Gradle #
Gradle 9.8.0 #
It’s time to upgrade: Gradle 9.8.0 is out, with Java 27 support and Maven mirror reuse.
Along with this release, the Plugin Publish Plugin now lets you declare Isolated Projects and Configuration Cache support with a few lines in a compatibility { features { ... } } block. Declaring compatibility earns your plugin badges on the Plugin Portal and a bump in search ranking, so the users who care can actually find you.
Gradle Security Subscription #
The Gradle Security Subscription is available now. The subscription adds to the existing open source end-of-life policy:
- SLA-backed fixes: critical vulnerabilities patched within 7 days, high-severity within 30.
- Extended security maintenance: CVSS ≥ 7 fixes are backported to the release you’re on, whether that’s a minor from the past 12 months or a version up to two majors back.
- Embargoed disclosure: subscribers get advance, confidential notice of new vulnerabilities and mitigations ahead of public disclosure.
It’s built for teams with compliance obligations or production systems pinned to older Gradle versions.
Two Agents, One Bug #
The Gradle agentic team pointed two coding agents at the same real, filed bug under identical constraints. Both agents produced a passing fix using a custom evaluator that scored them on cost, speed, tool usage, and code quality. So which one gets merged?
It’s a follow-up to last month’s “Gradle Is Going Agentic” post, which explained why the team pushed default Configuration Cache from Gradle 10 to Gradle 11 to prioritize this work.
From Develocity #
Develocity 2026.3 #
Develocity 2026.3 is out, with three headline themes:
- Organization-Wide Build Optimization with Develocity Agents: a new skill ranks the CI hours your organization loses to cache misses, flaky tests, and recurring failures, then hands your AI agent a “to-do” list.
- Observability for Docker Builds: every
docker buildnow produces a Build Scan. - Enhanced Universal Cache Security with Trusted Artifact Isolation: protects downstream consumers from cache poisoning.
Paying for Your Toolchain #
Hans Dockter’s follow-up to Your Toolchain Is Production Now argues that AI coding agents bill you twice for a slow or flaky toolchain: once visibly, in compute and token spend, and once invisibly, in the productivity a bad build silently drains from the humans who used to absorb that cost without complaint:
- The bill used to be hidden: a slow build used to cost a developer a coffee break, but an agent looping through the same build has no coffee break, so the cost shows up immediately rather than being hidden and quietly absorbed.
- The toolchain has to be engineered like production: reliability and latency aren’t nice-to-haves anymore, they’re now on the critical path for every agent-driven change.
DPE Summit 2027 #
Registration is open for DPE Summit 2027. The event dedicated to Developer Productivity Engineering and Developer Experience in the age of AI is returning to The Midway in San Francisco on February 2–3, 2027.
Last year’s sessions included speakers from Google, Meta, Microsoft, Netflix, and Uber. Session videos are online if you want a preview before you commit:
- Early pricing: tickets are $349 through October 23, after which prices increase.
- Call for Speakers: open now through September 30, submit a talk.
Upcoming events #
Meet the Gradle team and fellow community members at these upcoming events! We’d love to connect with you to discuss anything related to Gradle Build Tool, Develocity, Developer Productivity Engineering (DPE), or AI’s evolving impact on software development and delivery.
- September 28 – October 2, 2026 — DevOpsCon New York — New York, NY. Gradle is a recurring partner of the DevOpsCon series.
- October 5–9, 2026 — Devoxx Belgium — Antwerp — one of the largest Java/JVM conferences in Europe.
- October 7–9, 2026 — Droidcon Berlin — Berlin — Android and Kotlin build tooling, where Gradle is the default build system.
- November 2–6, 2026 — W-JAX — Munich — enterprise Java, JVM, and DevOps conference.
- November 13–14, 2026 — devopsdays Barcelona — Barcelona — DevOps and developer-productivity focused.
Spread the word #
We encourage you to share highlights from this newsletter.
Find this and previous editions in the Gradle Newsletter Archive or subscribe via RSS.
The Call for Proposals for the October edition is now open!