1.9.0 — Maven Central

The toolbox has moved to Maven Central. This is a coordinate change, so consumers must act — nothing resolves at the old coordinates from this version on.

Breaking: new coordinates

Before (JitPack, ≤ 1.8.3)	After (Central, 1.9.0+)
com.github.appoly.AppolyDroid-Toolbox:BaseRepo	uk.co.appoly.droid:baserepo
com.github.appoly.AppolyDroid-Toolbox:S3Uploader-Multipart	uk.co.appoly.droid:s3uploader-multipart
com.github.appoly.AppolyDroid-Toolbox:AppolyDroid-Toolbox-bom	uk.co.appoly.droid:bom

The group becomes uk.co.appoly.droid and artifact IDs are lowercased. Note the BOM's name changes shape, not just case.

mavenCentral() is almost certainly already in your repositories list, so there is nothing to add.

Keep your jitpack.io entry unless you have checked nothing else needs it. The toolbox no longer requires it, but other dependencies may — libraries under a com.github.* group are the ones to check, since some are JitPack-hosted and some (like com.github.skydoves:sandwich) are on Central despite the group name. Removing the repository is not a safe default.

Also arriving: FlexiLogger 2.1.3 → 2.1.4

The toolbox's own source is unchanged from 1.8.3 apart from publishing configuration, but the dependency graph is not. FlexiLogger moves from 2.1.3 to 2.1.4, arriving transitively via baserepo, datehelperutil, connectivitymonitor and s3uploader. If you do not declare a FlexiLogger version yourself, this bump rides in silently — and it is the layer logging and crash reporting go through, so it is worth knowing about rather than discovering. A patch bump, but not a no-op.

Aside from that, a resolved-classpath diff on a real consumer showed the only other changes were the toolbox modules themselves swapping group and case.

Why the move

Every publishing problem this library has had traced to one cause: JitPack rewrites the Gradle Module Metadata it serves, stripping the -sources classifier from the file entry inside a sources variant. Android Studio binds AAR sources from that variant, so 25 of 26 modules decompiled instead of showing source. Two attempts to work around it failed — one broke consumer builds outright, the other left Android Studio issuing ~25 doomed requests per sync. Central serves exactly what is uploaded, so the workarounds are deleted rather than ported.

Verified on the published artifacts, and independently in a consuming app: baserepo, nav3navigation and uistate — all AAR modules — serve sources variants with the -sources classifier intact, and those jars contain real Kotlin source.

Also in this release

• Signing, sources and javadoc via com.vanniktech.maven.publish; shared POM metadata lives once in the root build.
• Releases are signed with an organisation-held key and are immutable — a version can never be re-uploaded or corrected.
• ./scripts/publish.sh publishes from a developer machine, reading credentials from the shared 1Password vault, with --dry-run and --local modes.
• Publishing gates run in CI on every PR: tests, coverage floor, consumer R8 keep rules, and a check that the published metadata resolves cleanly for an Android consumer with no platform-variant duplicates.

Migrating

1.8.3 remains available on JitPack indefinitely as the last release there. Full notes: docs/maven-central-migration.md

🤖 Generated with Claude Code