Clojurians Log v2

Managed to add a google mirror in settings.xml, my OSS CI is working again

So what's the general recommendation to deal with the 429 from maven?

A) cache, b) use a repository manager in front of Maven, c) use a tool that does proper backoffs and retries from 429s. I'm working on updating tools.deps to newer maven libs to do that

or vendor all deps ;)

deps.clj released

https://github.com/clojure/brew-install/blob/1.12.5/stable.properties still has .1638 -- is that intentional?

Ah, .1645 is a preview release? There's no "release" on GitHub for this yet.

Does this improve things with the mvn hiccup we saw recently?

Sorry, I thought I had hit the button to promote to stable but I did not - now done

no, it will not improve anything re mvn, but it does help repository managers understand traffic better.

ok will release deps.clj tomorrow

It was a good excuse for me to update my update-clj.sh script to support devel as well as stable so I can pull the devel.properties file 🙂

the big picture issue on Maven Central is that they are starting to rate limit IPs that appear to be "offenders" - I don't know what exactly that profile looks like, and it's entirely likely that you can be lumped in with others incorrectly on a CI host. Maven Central has beefed up their https://central.sonatype.org/faq/429-error/ with a lot more info on how to understand and debug what is happening in this case (having the user agent set may help them identify traffic patterns better).

from some digging, recent Lein releases are using the Maven resolver 3.9 / 1.9 (different parts of the libs) which uses an Apache http client which correctly retries based on the 429 headers. tools.deps is using Maven resolver 3.8 / 1.8 versions, which do not. Upgrading this is not hard for the Maven resolution side, but is completely broken for pom.xml reading, which I also do in tools.deps. this is some long standing debt that I've had half done forever, so I am now biting the bullet on finishing it, but it is no picnic.

on the upside though, I had useful conversations with Sonatype, and got them connected to Clojars for an industry repository consortium group :)