Vladimir Sitnikov

Note: Scorecard has an exception for gradle-wrapper.jar https://github.com/ossf/scorecard/pull/2039, so having gradle-wrapper.jar in the repository does not violate Scorecard

@alanv , would you please replace `non-hermetic builds` with `non-reproducible builds` in the issue title? --- I guess dependency order might be important for the case when different jars have...

I wonder how good (bad?) would it be to completely ban `HashSet`, `HashMap`, and use `Linked*` variants by default. See: * https://github.com/google/error-prone/issues/3230 * https://github.com/policeman-tools/forbidden-apis/issues/199

The order of dependencies matters when several artifacts contain the same file, so sorting the items is not an option

Does this duplicate https://github.com/gradle/gradle/issues/12412?

Well, you mention wrapper update, and you want to keep sha256. Do you suggest the subsequent executions should fail?

@larrywest , log4j 1.2 is still used a lot, and there's no drop-in replacement. That is why fixing 1.2 makes perfect sense, so the users can just upgrade log4j 1.x...

`@file:JsModule("fs/promises")` produces ``` Caused by: java.lang.IllegalStateException: Module 'fs/promises' not found at org.jetbrains.kotlin.gradle.internal.ExecKt$execWithErrorLogger$1.invoke(exec.kt:91) at org.jetbrains.kotlin.gradle.internal.ExecKt$execWithErrorLogger$1.invoke(exec.kt) at org.jetbrains.kotlin.gradle.internal.ProgressKt.operation(progress.kt:23) at org.jetbrains.kotlin.gradle.internal.ProgressKt.operation$default(progress.kt:15) at org.jetbrains.kotlin.gradle.internal.ExecKt.execWithErrorLogger(exec.kt:75) at org.jetbrains.kotlin.gradle.targets.js.webpack.KotlinWebpackRunner.execute(KotlinWebpackRunner.kt:24) at org.jetbrains.kotlin.gradle.targets.js.webpack.KotlinWebpack.doExecute(KotlinWebpack.kt:229) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at...

The following works (I'm not sure if it should work or if it should not): ```kotlin @file:JsModule("fs") @file:JsQualifier("promises") package ... import kotlin.js.Promise external fun unlink(paths: String): Promise ```

Does ``` get() = definedExternally set(value) = definedExternally ``` add anything significant? It looks like it adds nothing, and it makes the code harder to follow. That is why I...