How do I force a fixed version of a transitive Gradle dependency?

Add a dependency constraint in your build file. A constraint sets a version requirement for a module without adding that module as a dependency, and Gradle will select at least the version you name. It is the usual way to raise a transitive library to a fixed release in Java and Kotlin builds.

The constraint

In Kotlin DSL:

dependencies {
    implementation("com.example:parent-lib:3.4.0")

    constraints {
        implementation("com.example:vulnerable-lib:2.16.1") {
            because("fixes the advisory in 2.16.0 and below")
        }
    }
}

The Gradle documentation explains that a constraint, when the module is resolved, makes Gradle select at least that version. If nothing pulls the module in, the constraint does nothing. In its commons-codec example, a constraint upgrades the library without adding it as a direct dependency.

Why the because text matters

The because call attaches a human-readable reason. When someone later wonders why a version is pinned, the reason shows in Gradle's reports. Write the advisory or ticket there so the constraint can be removed when it is no longer needed.

At least, or exactly

Constraints are not strict by default. For a security fix, the default is usually right: you want to set a floor and still allow newer releases. Use strictly only when you have a compatibility reason, since it can make resolution fail.

Constraints travel

The docs state that dependency constraints are transitive. If a library you publish declares a constraint, it affects what the consumers of that library resolve. That is helpful for fixes and a reason to be careful when you publish. Do not ship constraints you would not want your users to inherit.

Steps

1. Use the dependencyInsight task to confirm the library and path. See our post on tracing it.
2. Add the constraint with the fixed version and a reason.
3. Re-run the tree and confirm the new version is selected.
4. Run tests, then your advisory scan.
5. When a parent library moves to a fixed release, remove the constraint.

Try it yourself

Click through it at your own pace, or open it full screen.

Note the fixed version it lists. That number is what goes into the constraint.

Quick check

Safeguard's autonomous remediation can raise fix pull requests for vulnerable dependencies. It is off by default with every category on Manual. See your own results with the free scan.

Sources

• Gradle: Dependency constraints
• Gradle: Viewing and debugging dependencies

Last reviewed: 19 October 2026.