Black Duck Detect 11.5.1 fixes Gradle scans that could report zero components for phantom subprojects, protecting release owners from approving incomplete BOM evidence.
What changed in 11.5.1
The Gradle init-script regression affected projects where a container or phantom module had no build.gradle file, while dependencies were declared in the root build.gradle. Those modules could be assigned an empty configuration set, resulting in zero detected components.
For a release organization, a successful scan with an incomplete component inventory is more concerning than a visible failure. It can leave open-source policy, license, and vulnerability decisions based on partial evidence.
This release also fixes an IndexOutOfBoundsException during component-location analysis when a version string contains spaces. That correction reduces avoidable scan interruptions in repositories with nonstandard version metadata.
Why the Gradle correction matters to governance
A BOM is commonly treated as an approval artifact: it supports security gates, legal review, supplier obligations, and audit inquiries. If a Gradle build reports no components for a module that actually contributes dependencies, downstream controls may not evaluate the full release content.
Release and platform teams should treat this update as a data-quality correction, not merely a scanner maintenance patch. The fix reduce the chance that a green pipeline is interpreted as proof of complete dependency coverage when it is not.
Recommended actions:
- Identify multi-project Gradle builds with container or phantom subprojects.
- Re-run scans for representative release branches after upgrading.
