The Kotlin CocoaPods Gradle plugin brings a second dependency system into a Gradle build: the CocoaPods tool, the Ruby environment that runs it, and every pod you declare. Inventory both graphs, pin the tool versions, and record the generated podspec. A Gradle only scan will not see the pods.
What the plugin does
According to the Kotlin documentation, the plugin lets Kotlin/Native projects depend on CocoaPods libraries and lets a Kotlin project be used as a CocoaPods dependency. Applying it adds debug and release frameworks as output binaries for Apple targets and creates a podspec task that generates a Podspec file.
Pods are declared with a pod function, and a pod can carry its own version:
pod("NearbyMessages") {
version = "1.1.1"
headers = "GNSMessages.h"
}
What else enters the build
| Item | Source in the docs | Why inventory it |
|---|---|---|
| CocoaPods itself | Installed with RVM, rbenv, system Ruby or Homebrew | It resolves and fetches pods |
| Ruby gems | The tool and its plugins, such as the Xcodeproj gem | Run on developer and CI machines |
| The pod executable | Found in PATH, or set with a property in local.properties | A different binary changes results |
| Pod dependencies | Declared with pod and resolved by pod install | Ship in the iOS app |
| Podspec | Generated by the Gradle task | Describes your own framework |
The docs recommend running the podInstall Gradle task instead of pod install directly, and note that Homebrew installed tooling can cause compatibility issues. Machines that differ in how CocoaPods was installed can resolve differently.
Security habits
- Pin pod versions with an explicit version, and commit the generated lockfile your pod tooling produces, if your project uses one.
- Pin tool versions. Record the CocoaPods and Ruby versions in CI images.
- Scan both sides. Include the pods directory manifests and lockfiles in dependency scanning.
- Use the Gradle wrapper. The docs recommend it to avoid compatibility issues during Xcode builds, and it also pins the Gradle version. See verify the Gradle wrapper before running it.
- Review the sources pods come from, since CocoaPods resolves from its own sources, not Maven.
Consider the alternative
The Kotlin docs point to Swift Package Manager as an alternative and describe a separate import feature, which is alpha. See what to commit and what is alpha. Whichever you use, say so in your SBOM notes so a reader knows which ecosystems it covers.
Try it yourself
Click through it at your own pace, or open it full screen.
Check whether components from different ecosystems appear in one list. That is the goal for a mixed Gradle and CocoaPods app.
Safeguard's SBOM and dependency scanning handle several ecosystems in one inventory, and the free scan at gold.safeguard.sh/scan is a way to try a repository.
Quick check
Will a Gradle scan find my pods?
Not by itself. Pods are resolved by CocoaPods, so scan the pod manifests and lockfiles too.
Should I run pod install or the Gradle task?
The Kotlin docs recommend running the podInstall Gradle task, so the required directories are created.
Sources
Last reviewed: 19 October 2026.
