jason810496 opened a new pull request, #71400: URL: https://github.com/apache/airflow/pull/71400
## Why The Java SDK build trusted whatever its configured repositories returned, so a replaced or shadowed artifact could execute during a build without anything failing. ## How - Pin SHA-256 checksums for dependencies, plugins, and metadata in `gradle/verification-metadata.xml`. Gradle enables strict verification automatically when that file is present, so no build invocation needs a new flag. - Centralize repositories in `settings.gradle.kts` and reject project-added ones. - Reject dynamic and changing versions for project dependency configurations. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Codex GPT-5.6 following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
