Gradle "Using insecure protocols ... is unsupported" (Gradle 7) in CI
Gradle 7+ refuses to use a plain http:// repository unless you explicitly opt in. A repository URL still on http triggers Using insecure protocols ... is unsupported, failing resolution by default.
What this error means
After upgrading to Gradle 7, a build that referenced an http:// repo fails with Using insecure protocols with repositories, without explicit opt-in, is unsupported. The same build worked on Gradle 6, which only warned.
* What went wrong:
A problem occurred configuring root project 'app'.
> Using insecure protocols with repositories, without explicit opt-in, is
unsupported. Switch Maven repository 'maven(http://nexus.internal/repo)' to
redirect to a secure protocol (like HTTPS) or allow insecure protocols.Common causes
An http:// repository URL
Gradle 7 made insecure-protocol repositories an error rather than a warning. Any repo declared with http:// is rejected unless explicitly allowed.
A plugin or convention adds an http repo
Even if your build is clean, an applied plugin or a shared convention can declare an http:// repository that triggers the same failure.
How to fix it
Switch the repository to HTTPS
Almost every repo serves HTTPS. Update the URL to the secure endpoint.
repositories {
maven { url = uri("https://nexus.internal/repository/maven-public/") }
}Opt in only for a trusted internal http repo
If an internal repo genuinely has no HTTPS, opt in explicitly - never for public repos.
repositories {
maven {
url = uri("http://nexus.internal/repository/maven-public/")
isAllowInsecureProtocol = true
}
}How to prevent it
- Use HTTPS URLs for every declared repository.
- Audit applied plugins/conventions for stray http:// repos before upgrading Gradle.
- Front internal artifacts with an HTTPS-terminating proxy.