Skip to content

Remove Sonatype resolver#28084

Merged
JamieB-gu merged 1 commit intomainfrom
remove-sonatype-resolver
Jul 10, 2025
Merged

Remove Sonatype resolver#28084
JamieB-gu merged 1 commit intomainfrom
remove-sonatype-resolver

Conversation

@JamieB-gu
Copy link
Copy Markdown
Contributor

@JamieB-gu JamieB-gu added this to the Health milestone Jul 10, 2025
@JamieB-gu JamieB-gu requested a review from rtyley July 10, 2025 15:36
@JamieB-gu JamieB-gu self-assigned this Jul 10, 2025
@JamieB-gu JamieB-gu requested a review from a team as a code owner July 10, 2025 15:36
Copy link
Copy Markdown
Member

@rtyley rtyley left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes!

@github-actions
Copy link
Copy Markdown
Contributor

@JamieB-gu JamieB-gu merged commit 71b6a10 into main Jul 10, 2025
12 checks passed
@JamieB-gu JamieB-gu deleted the remove-sonatype-resolver branch July 10, 2025 15:58
@prout-bot
Copy link
Copy Markdown

Seen on ADMIN-PROD (merged by @JamieB-gu 12 minutes and 57 seconds ago)

@prout-bot
Copy link
Copy Markdown

Seen on FRONTS-PROD (merged by @JamieB-gu 13 minutes and 27 seconds ago)

rtyley added a commit to rtyley/librarymanagement that referenced this pull request Jul 10, 2025
The current deprecation messages for `sonatypeRepo()` & `sonatypeOssRepos()` (added with sbt#517) say:

> use the following instead: resolvers += Resolver.sonatypeCentral**Snapshots**

...but following this advice can expose projects to using **snapshot** artifacts when they did not previously! This is unfortunate, as snapshots artifacts are inherently more risky, due to being mutable.

For example, invocations of `sonatypeOssRepos()` like [this](https://github.com/guardian/frontend/blob/76234e013f550ac600fbf0bb924c19a1a6165295/project/plugins.sbt#L10):

```scala
resolvers ++= Resolver.sonatypeOssRepos("releases")
```

...should _not_ be replaced by `sonatypeCentralSnapshots()`, as, AFAIK, only non-snapshot releases would be in `sonatypeOssRepos("releases")`.

In an ideal world (where snapshots are not, and were not, being used!) the `sonatypeOssRepos()` entry should just be [removed](guardian/frontend#28084) (as I don't _think_ there is any useful equivalent now that we're using Central Portal? In the old days we could get our artifacts a little quicker with `sonatypeOssRepos()`).

Only if snapshots are in use should users replace the entry with `sonatypeCentralSnapshots()`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants