Foreign releases in public repository

[NotMyFault]

Service(s)

Artifactory

Summary

While looking at jenkinsci/jenkins#10036 it appears that there are various releases in https://repo.jenkins-ci.org/public/com/github/eirslett/frontend-maven-plugin/ which do not exist in the central repository: https://repo.maven.apache.org/maven2/com/github/eirslett/frontend-maven-plugin/

Due to this, renovate keeps picking up release builds you cannot find in the proper development repository.

Where are these builds coming from and how can we get a rid of them?

Reproduction steps

No response

[dduportal]

@NotMyFault does it work if you specify, in your Renovabot setup, first the Central then Jenkins repos (ref. https://docs.renovatebot.com/configuration-options/#registryurls) ?

[NotMyFault]

@NotMyFault does it work if you specify, in your Renovabot setup, first the Central then Jenkins repos (ref. docs.renovatebot.com/configuration-options#registryurls) ?

Unfortunately, I have no time to investigate into that atm, but it affects dependabot too jenkinsci/jellydoc-maven-plugin#129

[jonesbusy]

Similar issue with dependabot on #4472

Some releases are not found because of invalid maven-metadata.xml

From what I understood we removed the central remote from public ? But why we still see cached artifact since they must be downloaded directly from central ?

[jonesbusy]

https://github.com/jenkinsci/gson-api-plugin/actions/runs/13087630952/job/36520682354

Different artifact but other occurence.

Can we switch to includes for attlassian proxy? My concern is that we miss important updates 😕

[jonesbusy]

https://github.com/jenkinsci/joda-time-api-plugin/actions/runs/13117038975/job/36593757045

Other occurence here. Joda-time with a funny 0.98 version is considered latest.