Gradle supports various sources for resolving dependencies, accommodating different metadata formats and connectivity methods. You can resolve dependencies from:

Maven repositories

Many organizations host dependencies in Maven repositories. Gradle can declare Maven repositories by specifying their URL:

build.gradle.kts
repositories {
    maven {
        url = uri("http://repo.mycompany.com/maven2")
    }
}
build.gradle
repositories {
    maven {
        url = "http://repo.mycompany.com/maven2"
    }
}

Composite Maven repository

Sometimes, POMs are published in one location, and JARs in another. You can define such a repository as follows:

build.gradle.kts
repositories {
    maven {
        // Look for POMs and artifacts, such as JARs, here
        url = uri("http://repo2.mycompany.com/maven2")
        // Look for artifacts here if not found at the above location
        artifactUrls("http://repo.mycompany.com/jars")
        artifactUrls("http://repo.mycompany.com/jars2")
    }
}
build.gradle
repositories {
    maven {
        // Look for POMs and artifacts, such as JARs, here
        url = "http://repo2.mycompany.com/maven2"
        // Look for artifacts here if not found at the above location
        artifactUrls "http://repo.mycompany.com/jars"
        artifactUrls "http://repo.mycompany.com/jars2"
    }
}

Gradle will first look for POMs and artifacts at the base URL, and if the artifact is not found, it will check the additional artifactUrls.

Strict limitation for Maven repositories

Maven POM metadata can specify additional repositories, but Gradle ignores them. Instead, Gradle strictly uses only the repositories declared in the build script.

This serves as both a reproducibility safeguard and a security measure. Without this restriction, an updated dependency version could unexpectedly introduce artifacts from unverified sources into your build.

Authenticated Maven repository

You can specify credentials for Maven repositories that require authentication. See Supported Repository Protocols for authentication options.

Local Maven repository

Gradle can consume dependencies from a local Maven repository, that is repositories on the local file system:

build.gradle.kts
repositories {
    maven {
        url = uri(layout.buildDirectory.dir("repo"))
    }
}
build.gradle
repositories {
    maven {
        url = uri(layout.buildDirectory.dir("repo"))
    }
}

Gradle can consume dependencies from the local Maven repository. This is useful for teams that want to test their setup locally before publishing their plugin.

You should ensure that using the local Maven repository is necessary before adding mavenLocal() to your build script:

build.gradle.kts
repositories {
    mavenLocal()
}
build.gradle
repositories {
    mavenLocal()
}
Gradle manages its own cache and doesn’t need to declare the local Maven repository even if you resolve dependencies from a remote Maven repository.

Gradle uses the same logic as Maven to identify the location of your local Maven cache. If a settings.xml file is defined in the user’s home directory (~/.m2/settings.xml), this location takes precedence over M2_HOME/conf Otherwise, Gradle defaults to ~/.m2/repository.

The case against mavenLocal()

As a general rule, you should avoid adding mavenLocal() as a repository in your Gradle builds. There are several issues with relying on it:

  1. Not a true repository, just a cache:

    • Maven treats mavenLocal() as a cache, not a reliable repository.

    • It may contain incomplete modules—for example, missing sources or Javadoc files—leading to issues in Gradle when resolving dependencies.

  2. Trust and security issues

    • Gradle does not trust local repositories because artifacts’ origins cannot be verified.

    • Dependencies can be easily overwritten, creating risks for security, correctness, and reproducibility.

  3. Performance degradation

    • Since metadata and artifacts can change at any time (see item 2), Gradle disables caching for local repositories.

    • This results in slower builds—especially when mavenLocal() is declared before remote repositories, as Gradle checks it first.

Despite its drawbacks, there are rare cases where mavenLocal() can be useful:

  1. Interoperability with Maven:

    • Example: If Project A (Maven) and Project B (Gradle) share artifacts during development, mavenLocal() can act as a temporary bridge.

    • Prefer an internal repository instead, but if that’s not feasible, limit mavenLocal() to local builds only.

  2. Interoperability with Gradle (Multi-Repo Development):

    • Example: If you need to validate that Project A’s changes work with Project B, mavenLocal() might be used.

    • Prefer composite builds for better dependency resolution.

    • Only use mavenLocal() as a last resort.

To mitigate risks, consider restricting mavenLocal() to specific dependencies using a repository filter:

repositories {
    mavenLocal {
        content {
            includeGroup("com.example.myproject") // Only allow this group from mavenLocal
        }
    }
}

This ensures that mavenLocal() is only used for expected dependencies and avoids unexpected resolution issues.

Ivy repositories

Many organizations host dependencies in Ivy repositories.

Standard layout Ivy repository

To declare an Ivy repository with the standard layout, simply specify the URL:

build.gradle.kts
repositories {
    ivy {
        url = uri("http://repo.mycompany.com/repo")
    }
}
build.gradle
repositories {
    ivy {
        url = "http://repo.mycompany.com/repo"
    }
}

Named layout Ivy repository

You can specify that your repository follows the Ivy default layout:

build.gradle.kts
repositories {
    ivy {
        url = uri("http://repo.mycompany.com/repo")
        layout("maven")
    }
}
build.gradle
repositories {
    ivy {
        url = "http://repo.mycompany.com/repo"
        layout "maven"
    }
}

Valid named layout values are gradle (default), maven, and ivy. Refer to IvyArtifactRepository.layout(java.lang.String) in the API documentation for more details.

Custom pattern layout Ivy repository

To define an Ivy repository with a non-standard layout, you can set up a pattern layout:

build.gradle.kts
repositories {
    ivy {
        url = uri("http://repo.mycompany.com/repo")
        patternLayout {
            artifact("[module]/[revision]/[type]/[artifact].[ext]")
        }
    }
}
build.gradle
repositories {
    ivy {
        url = "http://repo.mycompany.com/repo"
        patternLayout {
            artifact "[module]/[revision]/[type]/[artifact].[ext]"
        }
    }
}

For an Ivy repository that fetches Ivy files and artifacts from different locations, define separate patterns:

build.gradle.kts
repositories {
    ivy {
        url = uri("http://repo.mycompany.com/repo")
        patternLayout {
            artifact("3rd-party-artifacts/[organisation]/[module]/[revision]/[artifact]-[revision].[ext]")
            artifact("company-artifacts/[organisation]/[module]/[revision]/[artifact]-[revision].[ext]")
            ivy("ivy-files/[organisation]/[module]/[revision]/ivy.xml")
        }
    }
}
build.gradle
repositories {
    ivy {
        url = "http://repo.mycompany.com/repo"
        patternLayout {
            artifact "3rd-party-artifacts/[organisation]/[module]/[revision]/[artifact]-[revision].[ext]"
            artifact "company-artifacts/[organisation]/[module]/[revision]/[artifact]-[revision].[ext]"
            ivy "ivy-files/[organisation]/[module]/[revision]/ivy.xml"
        }
    }
}

Optionally, you can enable Maven-style layout for the 'organisation' part, with forward slashes replacing dots:

build.gradle.kts
repositories {
    ivy {
        url = uri("http://repo.mycompany.com/repo")
        patternLayout {
            artifact("[organisation]/[module]/[revision]/[artifact]-[revision].[ext]")
            setM2compatible(true)
        }
    }
}
build.gradle
repositories {
    ivy {
        url = "http://repo.mycompany.com/repo"
        patternLayout {
            artifact "[organisation]/[module]/[revision]/[artifact]-[revision].[ext]"
            m2compatible = true
        }
    }
}

Authenticated Ivy repository

You can specify credentials for Ivy repositories that require authentication. See Supported Repository Protocols for authentication options.

Local Ivy repository

Gradle can consume dependencies from a local Ivy repository, that is repositories on the local file system:

build.gradle.kts
repositories {
    ivy {
        // URL can refer to a local directory
        url = uri("../local-repo")
    }
}
build.gradle
repositories {
    ivy {
        // URL can refer to a local directory
        url = file("../local-repo")
    }
}

Flat directory repository

Some projects store dependencies on a shared drive or within the project’s source code rather than using a binary repository. To use a flat filesystem directory as a repository, you can configure it like this:

build.gradle.kts
repositories {
    flatDir {
        dirs("lib")
    }
    flatDir {
        dirs("lib1", "lib2")
    }
}
build.gradle
repositories {
    flatDir {
        dirs 'lib'
    }
    flatDir {
        dirs 'lib1', 'lib2'
    }
}

This configuration adds repositories that search specified directories for dependencies.

Flat directory repositories are discouraged, as they do not support metadata formats like Ivy XML or Maven POM files.

In general, binary dependencies should be sourced from an external repository, but if storing dependencies externally is not an option, prefer declaring a Maven or Ivy repository using a local file URL instead.

When resolving dependencies from a flat dir repo, Gradle dynamically generates adhoc dependency metadata based on the presence of artifacts. Gradle prefers modules with real metadata over those generated by flat directory repositories. For this reason, flat directories cannot override artifacts with real metadata from other declared repositories.

For instance, if Gradle finds jmxri-1.2.1.jar in a flat directory and jmxri-1.2.1.pom in another repository, it will use the metadata from the latter.