Code improvement description

We currently disable Gradle Wrapper distribution URL validation (--no-validate-url) as a workaround because the wrapper task’s URL validation fails when running behind Dependabot’s proxy.

https://github.com/dependabot/dependabot-core/blob/e7b8811f3496ae5e4d741dd246aab721884228b4/gradle/lib/dependabot/gradle/file_updater/wrapper_updater.rb#L126

Context / Background
When the Gradle wrapper task runs, Gradle validates the configured distribution URL by issuing a HEAD request, for example:

HEAD https://services.gradle.org/distributions/gradle-9.3.0-bin.zip

This head request then redirects to GitHub and ultimately fails with

WARN: Cannot read TLS response from mitm'd server tls: first record does not look like a TLS handshake

Logs

proxy | 2026/01/28 13:48:55 [025] HEAD https://services.gradle.org:443/distributions/gradle-9.3.0-bin.zip
proxy | 2026/01/28 13:48:55 [025] 307 https://services.gradle.org:443/distributions/gradle-9.3.0-bin.zip
proxy | 2026/01/28 13:48:55 [027] HEAD https://github.com:443/gradle/gradle-distributions/releases/download/v9.3.0/gradle-9.3.0-bin.zip
proxy | 2026/01/28 13:48:55 [027] * authenticating git server request (host: github.com)
proxy | 2026/01/28 13:48:55 [027] 302 https://github.com:443/gradle/gradle-distributions/releases/download/v9.3.0/gradle-9.3.0-bin.zip
proxy | 2026/01/28 13:48:55 [029] HEAD https://objects.githubusercontent.com:443/github-production-release-asset-2e65be/696192900/b5669ad6-764c-4b3a-a4eb-d6e13f57ec47?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20260128%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260128T134856Z&X-Amz-Expires=1800&X-Amz-Signature=63661c31353f570bf663e5fcab68ebc77bb23b0b7ff5c9f390ef8b559a1d23ac&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dgradle-9.3.0-bin.zip&response-content-type=application%2Foctet-stream
proxy | 2026/01/28 13:48:55 [029] WARN: Cannot read TLS response from mitm'd server tls: first record does not look like a TLS handshake
proxy | 2026/01/28 13:48:55 [031] HEAD https://objects.githubusercontent.com:443/github-production-release-asset-2e65be/696192900/b5669ad6-764c-4b3a-a4eb-d6e13f57ec47?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20260128%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260128T134856Z&X-Amz-Expires=1800&X-Amz-Signature=63661c31353f570bf663e5fcab68ebc77bb23b0b7ff5c9f390ef8b559a1d23ac&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dgradle-9.3.0-bin.zip&response-content-type=application%2Foctet-stream
proxy | 2026/01/28 13:48:55 [031] WARN: Cannot read TLS response from mitm'd server tls: first record does not look like a TLS handshake

To keep updates working, we pass --no-validate-url and set validateDistributionUrl=false, which skips the distribution URL validation step.

This workaround only seems necessary due to a proxy-related issue. When running without the Dependabot proxy (for example, through my own proxy), the validation works as expected.