Published maven-metadata.xml delisted 3.1.6 and newer from version list

[jskillin-idt]

Hey all,

It appears that Maven Central's copy of maven-metadata.xml is invalid, which is causing Gradle to fail to build. Gradle's position on this appears to be that the metadata should be correct, and while I could go down the road of writing a "custom version lister" as described to work around the invalid metadata, I figured I'd report the issue here first.

Here's what I see right now:

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>io.smallrye</groupId>
  <artifactId>jandex</artifactId>
  <versioning>
    <latest>3.1.5</latest>
    <release>3.1.5</release>
    <versions>
      <!-- cut older versions out for brevity -->
      <version>3.1.0</version>
      <version>3.1.1</version>
      <version>3.1.2</version>
      <version>3.1.3</version>
      <version>3.1.4</version>
      <version>3.1.5</version>
    </versions>
    <lastUpdated>20240513095516</lastUpdated>
  </versioning>
</metadata>

I am trying to build with Quarkus, which desires at least v3.1.6: https://github.com/quarkusio/quarkus-platform/blob/3.2.12.Final/generated-platform-project/quarkus-universe/bom/pom.xml#L11728

[Ladicek]

From the GitHub Actions log, it seems the maven-metadata.xml file is generated during the release process by the Nexus Staging Maven Plugin, of which we use the latest version. Clearly the <lastUpdated> date is the date of the last release (3.0.7), so the file was updated. I don't understand why it omits the last few versions in the 3.1.x stream :shrug:

[Ladicek]

I just released Jandex 3.2.0 and the maven-metadata.xml seems to include all the 3.1.x releases again. Alas, it doesn't include the 3.0.6 and 3.0.7 release, but that should be OK I guess.

Closing this, but I have no idea why this happens :shrug:

[jskillin-idt]

Hey Ladicek,

I appreciate you looking into this so quickly. I wondered how maven-metadata.xml even understands the full set of available versions to be able to publish that metadata, but I didn't have the time myself to go too deep, so unfortunately I also am unable to provide any meaningful information myself.