Use version catalog.

annotation-file-utilities/build.gradle

@@ -20,15 +20,15 @@ dependencies {
   // Annotations in checker-qual.jar are used, but no checkers are (currently) run on the code.
   compileOnly(project(":checker-qual"))
 
-  implementation("org.plumelib:options:2.0.3")
-  implementation("org.plumelib:plume-util:${plumeUtilVersion}")
-  implementation("org.plumelib:reflection-util:${reflectionUtilVersion}")
-  implementation("org.checkerframework.annotatedlib:guava:33.1.0.2-jre") {
+  implementation(libs.options)
+  implementation(libs.plume.util)
+  implementation(libs.reflection.util)
+  implementation(libs.guava) {
     // So long as Guava only uses annotations from checker-qual, excluding it should not cause problems.
     exclude group: "org.checkerframework"
   }
-  implementation("org.ow2.asm:asm:9.9")
-  testImplementation("junit:junit:${junitVersion}")
+  implementation(libs.asm)
+  testImplementation(libs.junit)
   testImplementation(project(":checker-qual"))
 }
 

build.gradle

@@ -1,21 +1,22 @@
 plugins {
   // https://plugins.gradle.org/plugin/com.gradleup.shadow
-  id("com.gradleup.shadow").version("9.2.2")
+  alias(libs.plugins.com.gradleup.shadow)
   // https://plugins.gradle.org/plugin/de.undercouch.download
-  id("de.undercouch.download").version("5.6.0")
+  alias(libs.plugins.de.undercouch.download)
   id("java")
   // https://github.com/tbroyer/gradle-errorprone-plugin
-  id("net.ltgt.errorprone").version("4.3.0")
+  alias(libs.plugins.net.ltgt.errorprone)
   // https://docs.gradle.org/current/userguide/eclipse_plugin.html
   id("eclipse")
 
   id("groovy") // needed for formatting Gradle files
+
   // Code formatting; defines targets "spotlessApply" and "spotlessCheck".
   // https://github.com/diffplug/spotless/tags ; see tags starting "gradle/"
   // Only works on JDK 11+ (even including the plugin crashes Gradle on JDK 8);
   // shell scripts in checker/bin-devel/ ensure spotless isn't called unless
   // the JDK is 17 or later.
-  id("com.diffplug.spotless").version("8.0.0")
+  alias(libs.plugins.com.diffplug.spotless)
 }
 apply from: rootProject.file("release.gradle")
 
@@ -207,7 +208,7 @@ allprojects { currentProj ->
   }
 
   dependencies {
-    errorprone("com.google.errorprone:error_prone_core:${errorproneVersion}")
+    errorprone(libs.error.prone.core)
 
     javacJar("com.google.errorprone:javac:9+181-r4173-1")
 
@@ -575,7 +576,7 @@ allprojects { currentProj ->
           "-Xep:NonOverridingEquals:OFF",
           // Suggests using a class that's in Error Prone itself, not in any library for clients.
           // It requires "import com.google.errorprone.util.ASTHelpers;", and (in build.gradle)
-          //   implementation("com.google.errorprone:error_prone_core:${errorproneVersion}")
+          //   implementation(libs.error.prone.core)
           // Adding that line in build.gradle causes a javac crash when running the Checker Framework.
           "-Xep:ASTHelpersSuggestions:OFF",
           // Removing "public" from private class members loses information about the abstraction.
@@ -825,7 +826,7 @@ configurations {
   requireJavadoc
 }
 dependencies {
-  requireJavadoc("org.plumelib:require-javadoc:2.0.0")
+  requireJavadoc(libs.require.javadoc)
 }
 tasks.register("requireJavadoc", JavaExec) {
   description = "Ensures that Javadoc documentation exists in source code."
@@ -957,8 +958,8 @@ subprojects {
 
   dependencies {
     // TODO: it's a bug that annotatedlib:guava requires the error_prone_annotations dependency.
-    annotatedGuava("com.google.errorprone:error_prone_annotations:${errorproneVersion}")
-    annotatedGuava("org.checkerframework.annotatedlib:guava:33.1.0.2-jre") {
+    annotatedGuava(libs.error.prone.annotations)
+    annotatedGuava(libs.guava) {
       // So long as Guava only uses annotations from checker-qual, excluding it should not cause problems.
       exclude group: "org.checkerframework"
     }

checker-qual/build.gradle

@@ -1,6 +1,6 @@
 plugins {
   id("java-library")
-  id("biz.aQute.bnd.builder").version("7.1.0")
+  alias(libs.plugins.biz.aqute.bnd.builder)
 }
 
 sourceSets {

checker-util/build.gradle

@@ -6,7 +6,7 @@ dependencies {
   api(project(":checker-qual"))
   // Don't add implementation dependencies; checker-util.jar should have no dependencies.
 
-  testImplementation("junit:junit:${junitVersion}")
+  testImplementation(libs.junit)
 }
 
 jar {

checker/build.gradle

@@ -3,7 +3,7 @@ plugins {
   id("base")
   // https://github.com/n0mer/gradle-git-properties
   // Generates file build/resources/main/git.properties when the `classes` task runs.
-  id("com.gorylenko.gradle-git-properties").version("2.5.3")
+  alias(libs.plugins.com.gorylenko.gradle.git.properties)
 }
 
 sourceSets {
@@ -42,33 +42,33 @@ dependencies {
   // If you add an external dependency, you must shadow its packages.
   // See the comment in ../build.gradle in the shadowJar block.
 
-  implementation("org.plumelib:reflection-util:${reflectionUtilVersion}")
-  implementation("org.plumelib:plume-util:${plumeUtilVersion}")
+  implementation(libs.reflection.util)
+  implementation(libs.plume.util)
 
   // Dependencies added to "shadow" appear as dependencies in Maven Central.
   shadow(project(":checker-qual"))
   shadow(project(":checker-util"))
 
   // Called Methods Checker AutoValue + Lombok support
-  testImplementation("com.google.auto.value:auto-value-annotations:${autoValueVersion}")
-  testImplementation("com.google.auto.value:auto-value:${autoValueVersion}")
-  testImplementation("com.ryanharter.auto.value:auto-value-parcel:0.2.9")
-  testImplementation("org.projectlombok:lombok:${lombokVersion}")
+  testImplementation(libs.auto.value.annotations)
+  testImplementation(libs.auto.value)
+  testImplementation(libs.auto.value.parcel)
+  testImplementation(libs.lombok)
 
   // Called Methods Checker support for detecting misuses of AWS APIs
-  testImplementation("com.amazonaws:aws-java-sdk-ec2")
-  testImplementation("com.amazonaws:aws-java-sdk-kms")
+  testImplementation(libs.aws.java.sdk.ec2)
+  testImplementation(libs.aws.java.sdk.kms)
   // The AWS SDK is used for testing the Called Methods Checker.
-  testImplementation(platform("com.amazonaws:aws-java-sdk-bom:1.12.793"))
+  testImplementation(platform(libs.aws.java.sdk.bom))
   // For the Resource Leak Checker's support for JavaEE.
-  testImplementation("javax.servlet:javax.servlet-api:4.0.1")
+  testImplementation(libs.javax.servlet.api)
   // For the Resource Leak Checker's support for IOUtils.
-  testImplementation("commons-io:commons-io:2.21.0")
+  testImplementation(libs.commons.io)
   // To test for an obscure crash in CFG construction for try-with-resources;
   // see https://github.com/typetools/checker-framework/issues/6396
-  testImplementation("org.apache.spark:spark-sql_2.12:3.3.2")
+  testImplementation(libs.spark.sql)
 
-  testImplementation("junit:junit:${junitVersion}")
+  testImplementation(libs.junit)
   testImplementation(project(":framework-test"))
   testImplementation(sourceSets.testannotations.output)
 

dataflow/build.gradle

@@ -8,11 +8,11 @@ dependencies {
   api(project(":checker-qual"))
 
   // Node implements org.plumelib.util.UniqueId, so this dependency must be "api".
-  api("org.plumelib:plume-util:${plumeUtilVersion}")
+  api(libs.plume.util)
 
-  implementation("org.plumelib:hashmap-util:${hashmapUtilVersion}")
+  implementation(libs.hashmap.util)
 
-  testImplementation("junit:junit:${junitVersion}")
+  testImplementation(libs.junit)
 
   // External dependencies:
   // If you add an external dependency, you must shadow its packages both in the dataflow-shaded

framework-test/build.gradle

@@ -3,11 +3,11 @@ sourceSets {
 }
 
 dependencies {
-  implementation("junit:junit:${junitVersion}")
+  implementation(libs.junit)
   implementation(project(":javacutil"))
   implementation(project(":checker-qual"))
 
-  implementation("org.plumelib:plume-util:${plumeUtilVersion}")
+  implementation(libs.plume.util)
   testImplementation(project(":framework"))
 }
 

framework/build.gradle

@@ -38,8 +38,8 @@ def stubifierJar = tasks.register("stubifierJar", Jar) {
 dependencies {
   api(project(":javacutil"))
   api(project(":dataflow"))
-  api("org.checkerframework:stubparser:3.27.1")
-  stubifierImplementation("org.checkerframework:stubparser:3.26.4")
+  api(libs.stubparser)
+  stubifierImplementation(libs.stubparser)
   // This should be implementation sourceSets.stubifier.output, but that cause a failure in shadowJar.
   // This work around is from here: https://github.com/GradleUp/shadow/issues/1606#issuecomment-3164731141
   implementation(files(stubifierJar))
@@ -49,21 +49,21 @@ dependencies {
   // External dependencies:
   // If you add an external dependency, you must shadow its packages.
   // See the comment in ../build.gradle in the shadowJar block.
-  implementation("org.plumelib:hashmap-util:${hashmapUtilVersion}")
-  implementation("org.plumelib:plume-util:${plumeUtilVersion}")
-  implementation("org.plumelib:reflection-util:${reflectionUtilVersion}")
-  implementation("io.github.classgraph:classgraph:4.8.184")
+  implementation(libs.hashmap.util)
+  implementation(libs.plume.util)
+  implementation(libs.reflection.util)
+  implementation(libs.classgraph)
 
-  testImplementation("junit:junit:${junitVersion}")
+  testImplementation(libs.junit)
   testImplementation(project(":framework-test"))
   testImplementation(sourceSets.testannotations.output)
 
   // AutoValue support in Returns Receiver Checker
-  testImplementation("com.google.auto.value:auto-value-annotations:${autoValueVersion}")
-  testImplementation("com.google.auto.value:auto-value:${autoValueVersion}")
+  testImplementation(libs.auto.value.annotations)
+  testImplementation(libs.auto.value)
 
   // Lombok support in Returns Receiver Checker
-  testImplementation("org.projectlombok:lombok:${lombokVersion}")
+  testImplementation(libs.lombok)
 }
 
 tasks.register("cloneTypetoolsJdk", CloneTask) {

gradle.properties

@@ -5,16 +5,4 @@ org.gradle.parallel=true
 org.gradle.jvmargs=-Xmx4g -Dfile.encoding=UTF-8
 org.gradle.caching=true
 
-# If you update errorproneVersion:
-#  * Temporarily comment out "-Werror" in build.gradle files.
-#  * Repeatedly run `./gradlew clean compileJava` and fix all errors.
-#  * Uncomment "-Werror".
-
-autoValueVersion=1.11.1
-errorproneVersion=2.44.0
 googleJavaFormatVersion=1.30.0
-hashmapUtilVersion=0.0.1
-junitVersion=4.13.2
-lombokVersion=1.18.42
-plumeUtilVersion=1.12.2
-reflectionUtilVersion=1.1.5

gradle/libs.versions.toml

@@ -0,0 +1,77 @@
+## Generated by adding the following to setting.gradle
+## plugins {
+##    // See https://jmfayard.github.io/refreshVersions
+##    id("de.fayard.refreshVersions") version "0.60.6"
+## }
+## and then running:
+## ./gradlew refreshVersionsMigrate  --mode=VersionCatalogOnly
+
+[plugins]
+
+com-gradleup-shadow = { id = "com.gradleup.shadow", version = "9.2.2" }
+
+de-undercouch-download = { id = "de.undercouch.download", version = "5.6.0" }
+
+net-ltgt-errorprone = { id = "net.ltgt.errorprone", version = "4.3.0" }
+
+com-diffplug-spotless = { id = "com.diffplug.spotless", version = "8.0.0" }
+
+com-gorylenko-gradle-git-properties = { id = "com.gorylenko.gradle-git-properties", version = "2.5.3" }
+
+biz-aqute-bnd-builder = { id = "biz.aQute.bnd.builder", version = "7.1.0" }
+
+[versions]
+
+junit-junit = "4.13.2"
+
+[libraries]
+
+# If you update errorproneVersion:
+#  * Temporarily comment out "-Werror" in build.gradle files.
+#  * Repeatedly run `./gradlew clean compileJava` and fix all errors.
+#  * Uncomment "-Werror".
+error-prone-core = "com.google.errorprone:error_prone_core:2.44.0"
+
+javac = "com.google.errorprone:javac:9+181-r4173-1"
+
+require-javadoc = "org.plumelib:require-javadoc:2.0.0"
+
+error-prone-annotations = "com.google.errorprone:error_prone_annotations:2.44.0"
+
+guava = "org.checkerframework.annotatedlib:guava:33.1.0.2-jre"
+
+options = "org.plumelib:options:2.0.3"
+
+plume-util = "org.plumelib:plume-util:1.12.2"
+
+reflection-util = "org.plumelib:reflection-util:1.1.5"
+
+asm = "org.ow2.asm:asm:9.9"
+
+junit = { group = "junit", name = "junit", version.ref = "junit-junit" }
+
+auto-value-annotations = "com.google.auto.value:auto-value-annotations:1.11.1"
+
+auto-value = "com.google.auto.value:auto-value:1.11.1"
+
+auto-value-parcel = "com.ryanharter.auto.value:auto-value-parcel:0.2.9"
+
+lombok = "org.projectlombok:lombok:1.18.42"
+
+aws-java-sdk-ec2 = { module = "com.amazonaws:aws-java-sdk-ec2" }
+
+aws-java-sdk-kms = { module = "com.amazonaws:aws-java-sdk-kms" }
+
+aws-java-sdk-bom = "com.amazonaws:aws-java-sdk-bom:1.12.793"
+
+javax-servlet-api = "javax.servlet:javax.servlet-api:4.0.1"
+
+commons-io = "commons-io:commons-io:2.21.0"
+
+spark-sql = "org.apache.spark:spark-sql_2.12:3.3.2"
+
+hashmap-util = "org.plumelib:hashmap-util:0.0.1"
+
+stubparser = "org.checkerframework:stubparser:3.27.1"
+
+classgraph = "io.github.classgraph:classgraph:4.8.184"

javacutil/build.gradle

@@ -11,9 +11,9 @@ dependencies {
 
   // This is used by org.checkerframework.javacutil.TypesUtils.isImmutableTypeInJdk.
   // https://mvnrepository.com/artifact/org.plumelib/plume-util
-  implementation("org.plumelib:hashmap-util:${hashmapUtilVersion}")
-  implementation("org.plumelib:plume-util:${plumeUtilVersion}")
-  implementation("org.plumelib:reflection-util:${reflectionUtilVersion}")
+  implementation(libs.hashmap.util)
+  implementation(libs.plume.util)
+  implementation(libs.reflection.util)
 
   // External dependencies:
   // If you add an external dependency, you must shadow its packages both in checker.jar and