Improve dependency locking

README.md

@@ -42,6 +42,11 @@ hex is triggered. This is the default and historical behaviour. Adjust to taste.
 A Nix flake is provided in this repository. This defines a stable development environment but isn't doing anything
 special. Any standard Java/Kotlin setup should work.
 
+### Dependencies
+Gradle [lockfiles](https://docs.gradle.org/current/userguide/dependency_locking.html) are enabled. They lock dependencies
+to specific version numbers. Lockfiles can be updated using the `--write-locks` flag. This may need to be paired with a
+build target such as `gradle build --write-locks` so that all dependencies are resolved.
+
 ### Reproducibility
 The [org.gradlex.reproducible-builds](https://gradlex.org/reproducible-builds/) plugin is used to set defaults for 
 Gradle's builtin tasks that aid reproducibility. Non-reproducible builds are considered low priority bugs. However,

build.gradle.kts

@@ -2,9 +2,9 @@ import org.gradle.api.JavaVersion
 import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
 
 plugins {
-    id("fabric-loom") version "1.10-SNAPSHOT"
+    id("net.fabricmc.fabric-loom-remap") version "1.17.2"
     id("maven-publish")
-    id("org.jetbrains.kotlin.jvm") version "2.1.10"
+    id("org.jetbrains.kotlin.jvm") version "2.4.0"
     id("com.modrinth.minotaur") version "2.+"
     id("org.gradlex.reproducible-builds") version "1.1"
 }
@@ -76,10 +76,23 @@ dependencies {
     modLocalRuntime(files("${rootProject.rootDir}/libs/serialization-hooks-0.4.99999.jar"))
 }
 
+// lock dependencies
+dependencyLocking {
+    lockAllConfigurations()
+    lockMode = LockMode.STRICT
+}
+
+// lock plugins
+buildscript {
+    configurations.classpath {
+        resolutionStrategy.activateDependencyLocking()
+    }
+}
+
 tasks.processResources {
     inputs.property("version", project.version)
     filesMatching("fabric.mod.json") {
-        expand("version" to inputs.properties["version"])
+        expand(mutableMapOf("version" to inputs.properties["version"]))
     }
 }
 

buildscript-gradle.lockfile

@@ -0,0 +1,60 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.gson:gson:2.14.0=classpath
+com.google.errorprone:error_prone_annotations:2.48.0=classpath
+com.modrinth.minotaur:Minotaur:2.9.0=classpath
+com.modrinth.minotaur:com.modrinth.minotaur.gradle.plugin:2.9.0=classpath
+com.squareup.okhttp3:okhttp:4.10.0=classpath
+com.squareup.okio:okio-jvm:3.0.0=classpath
+com.squareup.okio:okio:3.0.0=classpath
+dev.masecla:Modrinth4J:2.2.0=classpath
+net.fabricmc.fabric-loom-remap:net.fabricmc.fabric-loom-remap.gradle.plugin:1.17.2=classpath
+net.fabricmc.unpick:unpick-format-utils:3.0.0-beta.13=classpath
+net.fabricmc.unpick:unpick:3.0.0-beta.13=classpath
+net.fabricmc:class-tweaker:0.3.0-beta.2=classpath
+net.fabricmc:fabric-loom-native:0.2.0=classpath
+net.fabricmc:fabric-loom:1.17.2=classpath
+net.fabricmc:lorenz-tiny:4.0.2=classpath
+net.fabricmc:mapping-io:0.8.0=classpath
+net.fabricmc:mercury:0.4.3=classpath
+net.fabricmc:mercurymixin:0.2.2=classpath
+net.fabricmc:stitch:0.6.2=classpath
+net.fabricmc:tiny-mappings-parser:0.3.0+build.17=classpath
+net.fabricmc:tiny-remapper:0.14.0=classpath
+org.cadixdev:at:0.1.0-rc1=classpath
+org.cadixdev:bombe:0.3.4=classpath
+org.cadixdev:lorenz:0.5.7=classpath
+org.gradlex.reproducible-builds:org.gradlex.reproducible-builds.gradle.plugin:1.1=classpath
+org.gradlex:reproducible-builds:1.1=classpath
+org.jetbrains.kotlin.jvm:org.jetbrains.kotlin.jvm.gradle.plugin:2.4.0=classpath
+org.jetbrains.kotlin:fus-statistics-gradle-plugin:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-build-statistics:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-build-tools-api:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-compiler-runner:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-daemon-client:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-gradle-plugin-annotations:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-gradle-plugin-api:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-gradle-plugin-idea-proto:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-gradle-plugin-idea:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-gradle-plugin:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-gradle-plugins-bom:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-klib-commonizer-api:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-metadata-jvm:2.3.20=classpath
+org.jetbrains.kotlin:kotlin-native-utils:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-stdlib-common:2.3.20=classpath
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.8.0=classpath
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.0=classpath
+org.jetbrains.kotlin:kotlin-stdlib:2.3.20=classpath
+org.jetbrains.kotlin:kotlin-tooling-core:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-util-io:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-util-klib-metadata:2.4.0=classpath
+org.jetbrains.kotlin:kotlin-util-klib:2.4.0=classpath
+org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.8.0=classpath
+org.jetbrains:annotations:13.0=classpath
+org.ow2.asm:asm-analysis:9.10.1=classpath
+org.ow2.asm:asm-commons:9.10.1=classpath
+org.ow2.asm:asm-tree:9.10.1=classpath
+org.ow2.asm:asm-util:9.10.1=classpath
+org.ow2.asm:asm:9.10.1=classpath
+empty=