does "mavenCentral" really need to be included in pluginManagment? I assume it's needed if a plugin has dependencies?

for historical reasons, plugin portal proxies jcenter. but yes if the plugin has any dependencies that aren't on the portal (or jcenter) then you need to add wherever it is (such as mavenCentral)

Some plugins also don't get published to the portal at all, but only to Maven Central (see e.g. https://github.com/vanniktech/gradle-maven-publish-plugin/issues/669). These obviously also need

mavenCentral()

added.

That's not fully correct. Gradle Plugin Portal redirects to JCenter for dependencies it does not serve itself. JCenter forwards to MavenCentral for dependencies it does not serve itself. So by having Gradle Plugin Portal, you have automatically all three repositories, as long as JCenter does not have one of its regular outages. Having

mavenCentral()

after

gradlePluginPortal()

is useless, because either the portal already served it directly or indirectly or got an error which causes the second not to be tried at all. Having

mavenCentral()

before

gradlePluginPortal()

can save you a small amount of time as the indirection through JCenter is not necessary and can save you from JCenter outages if the actual dependency is on MavenCentral, not JCenter.

redirects or proxies? not that it matters much to me, if it's really unnecessary

yeah I shouldn't have said proxy, it should be an http redirect on resources that the portal doesn't itself host

what's a plugin marker?

redirects or proxies? not that it matters much to me, if it's really unnecessary

I was careful with the terminology. 😉 Gradle Plugin Portal redirects to JCenter, JCenter forwards to (i.e. proxies) Maven Central.

what's a plugin marker?

https://docs.gradle.org/current/userguide/plugins.html#sec:plugin_markers

so, if you have a plugin that does the inverse of what the aforementioned plugin does. Meaning at one point they published on maven central, too, and now they only publish to the portal. I'm guessing the inverse problem that's being experienced there will happen?

Not sure what you are trying to ask

in the afformentioned plugin they've stopped publishing to portal, so people are getting an old version. Which is why @ephemient is saying to put

mavenCentral()

first. Seems to me that the same problem might be true of another plugin which stopped publishing to

mavenCentral()

Ah, you only get an old version if you use dynamic versions maybe

they need to remove their code from the portal if they aren't going to keep it updated

Just use concrete versions and you are fine 🙂

removing from repositories isn't a thing you are expected to ever do with maven repositories

who wants to do that? it'd ruin my magically self updating build

Also better for not suddenly getting breaking builds due to plugin updates

nah, that's good detection 😉

I never use dynamic versions

dynamic versions are bad and dynamic plugin versions especially

and the reasons for lockfiles 😉

Yeah, well, then you are doomed probably 😄

but it seems like you would never find out their was a new version... the dynamic version wouldn't find it, correct?

Iirc. when looking for a dynamic version, it checks the first repo, if it finds in the available versions a version that matches the dynamic version, no further repositories are checked

if I point at the portal, a dynamic version'll never find the new version on maven central

Tbh, everyone publishing a plugin and not publishing to the portal (at least additionally) is majorly doing something wrong anyway

yeah, I'd agree

That also means the web ui only shows the latest version deployed to the portal or not list the plugin at all if always only published to MC

or make it explicitly resolve to maven central and not have all things check there first

Actually that argument with the dynamic versions that I didn't have in mind, might be a good enough reason to stop them doing that non-sense 😄

as a side note to this, is there any way to have the portal show "deprecated" or "unmaintained"?

Initiated by whom?

the author

The plugin author can probably update the description

is there a way to do that without publishing a new version?

At least via https://github.com/gradle/plugin-portal-requests/ if there is no other way