Bintray (including JCenter) Sunsetting on May 1st, 2021 - Publish to Maven Central instead

[jhg023]

Bintray (including JCenter) will be sunsetting on May 1st, 2021, meaning that it will no longer be available as an artifact repository. For more information, see: here.

The JDA artifact(s) will need to be hosted somewhere else, to which I recommend Maven Central. For more information on publishing to Maven Central, see this YouTube video.

[MinnDevelopment]

We are already aware of this and looking into alternatives.

[Wild1145]

Is there any update on when a new home for this is expected? Github security alerts are now warning that we're pointing to a vulnerable endpoint because the service is being sun-setted so we're looking at options ASAP To move the repo on our end to somewhere new, but just wanted to know if that was already under way on your end?

[DV8FromTheWorld]

To be clear, JCenter is being sunset, but the packages currently available on JCenter will be available through February of 2022 so none of your builds are going to break until Feb of 2022.
Publishing new versions of packages is being cut off on March 31 2021, so after that point no additional version of JDA will be pushed to JCenter.
Details available here

We are testing our a few options internally to decide what path to take for new packages. Version 4.2.1 will be published to the new repository once decided.

[Wild1145]

Appreciate the packages aren't going away in the immediate future, the reason it's been noticed (At least in my case) is Github's CodeQL have now declared anything on bintray.com to be a security risk under CWE-1104 which is why we're trying to move where we pull it from because all our builds now fail due to CodeQL Failing on PR's and any commits we now make to our repo's using JDA as an upstream dependency.

The check from CodeQL can be found here - https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql

[DV8FromTheWorld]

This seems kinda silly to deal with so soon given the actual 2022 deadline. Can you not disable this specific CodeQL check for now?

[Wild1145]

Not as far as I'm aware, we can mark it as a false positive / similar, but that only obviously is in the local repo. We can obviously ignore the error (Which is what we've done so far) but it is something we're looking on our projects to resolve ASAP to keep the number of security alerts to a minimum especially for something that in theory from our side should be as simple as changing a URL or just deleting an endpoint depending on where the artefacts get hosted in the future.

[DV8FromTheWorld]

Alrighty. I appreciate the detail and information. This is something on our immediate radar and is a blocker for releasing 4.2.1, so rest assured it will be handled soon.

[Gamebuster19901]

If you're using gradle, you can use source dependencies to retrieve JDA directly from github.

There is documentation of gradle source dependencies at:
https://blog.gradle.org/introducing-source-dependencies

And a working example when using JDA as a dependency:
TheGameCommunity/ExciteBot@1cba6d5

[DV8FromTheWorld]

Please note that this above example will be pulling from the release tag v4.2.0 which was release on June 26, 2020.

If you are going to do this, you may want to pull from a commit hash instead.

[Gamebuster19901]

I believe it actually pulls from this commit: 3a9fcd0 which was released 3 days later.

I don't believe you can specify a specific commit using gradle source dependencies. If you wish to use a specific commit, you can fork the repository, and rollback/fast forward/merge a branch to whatever commit you want.

Then in settings.gradle, you would change the username of the repository to your username:

sourceControl {
	gitRepository("https://github.com/USERNAME/JDA.git") {
		producesModule("net.dv8tion:JDA")
	}
}

And in build.gradle, pull from your branch:

    implementation('net.dv8tion:JDA') {
        version {
            branch = 'YOURBRANCH'
        }
    }

[DV8FromTheWorld]

Seems like a lot. I'd just use jitpack to be honest.

Either way, whether you're using jitpack or gradle's gitRespository, you're still going to be relying on JCenter as the dependencies defined by JDA are being pulled from JCenter in JDA's build.gradle.kts.

[DV8FromTheWorld]

This had been addressed. See the current README details for information about how to get builds from our new repository location
https://github.com/dv8fromtheworld/jda#download

[greg6775]

Why not publish to Maven Central instead?

[DV8FromTheWorld]

Eventually we will, I didn't have the time to jump through the hoops of getting Maven Central setup. Additionally, releasing to Maven Central takes a while before things actually show up in Central which we also didn't want to deal with currently.

Eventually we will be double publishing.