With platform(), a BOM's versions are recommendations that other dependencies can raise. With enforcedPlatform(), every version becomes strict, so nothing in the graph can go higher. For an app that needs a security fix, that difference decides whether a patched version can win.
Definitions
A BOM (bill of materials) is a component that sets versions for a group of related libraries so they stay in sync. In Gradle terms it is a platform made of dependency constraints. The java-platform plugin can build one and publish it as a Maven BOM.
The two notations
| Notation | Version behaviour | Where to use |
|---|---|---|
platform(...) | Versions are recommendations; others can upgrade them | Most apps and libraries |
enforcedPlatform(...) | Every constraint becomes strictly | Applications, not libraries |
Gradle's documentation adds that platform() also enables endorseStrictVersions by default, and that strict versions from an enforced platform propagate to consumers, which is why the page says to use it in applications rather than libraries.
Why this is a security matter
Suppose your BOM pins a networking library at a version with a known flaw. If you used enforcedPlatform, a transitive dependency that asks for the fixed version cannot raise it. Your fix must come from updating the BOM itself or overriding it on purpose.
With plain platform(), a higher requested version can win, which lets fixes flow in but can also move a version you expected to stay put.
Steps to check your own build
- Search your Gradle files for
platform(andenforcedPlatform(. - Note the BOM version for each, and add it to your dependency record.
- For each, ask: would a patched version be allowed to win?
- If you used
strictlyon one module inside a platform, check siblings. The docs warn this can leave sibling modules at older BOM versions. - Use dependencyInsight to see why a version was selected.
- Update the BOM version as part of regular patching, and not just when something breaks.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a patched version is identified, then think about whether your BOM would let it through.
Safeguard builds an SBOM and scans your dependencies for known vulnerabilities, and you can run a free scan at gold.safeguard.sh/scan to see what your own project pulls in.
Quick check
Should a library use enforcedPlatform?
Gradle's docs say it should generally be used in applications, not libraries, because strict versions propagate to consumers.
Does a BOM update fix vulnerabilities automatically?
It changes the recommended versions. You still need to confirm the new versions are fixed and that the build resolves them.
Sources
Last reviewed: 19 October 2026.
