Bump com.gradleup.nmcp from 1.2.0 to 1.6.1

[dependabot]

Bumps com.gradleup.nmcp from 1.2.0 to 1.6.1.

Release notes

Sourced from com.gradleup.nmcp's releases.

v1.6.1

v 1.6.1 restores some checksums:

• maven-metadata.md5 and maven-metadata.sha1 (because maven outputs a scary warning without them)
• All the .sha512 checksums (because Gradle uses them to validate caches contents)

All in all, nmcp now publishes .md5, .sha1, .sha512 for all files except for signature files (.asc) where no checksums are required.

Long term, I'd love to drop the .md5 and .sha1 checksums. That would require both maven and Sonatype to stop requesting them.

Many thanks to @​marcphilipp and @​leonard84 for helping me navigate this issue 💙

On a separate note, this version also deprecates publishAllPublicationsToMavenCentral in favor of using either the aggregation or the settings plugin.

v1.6.0

Nmcp 1.6.0 stops publishing the following checksums:

• signature checksums (.asc.md5, .asc.sha1, .asc.sha256, .asc.sha512)
• all non-required checksums (.sha256, .sha512)
• all maven-metadata checksums (only for local publishing, maven-metadata.xml is never sent to Central Portal)

This is all disabled by default.

If you like the checksums, you can send them again by setting publishAllChecksums:

nmcpAggregation {
  publishAllChecksums.set(true)
}

If you do, please let me know why, I'm curious!

1.5.0

Nmcp 1.5.0 adds nmcpPublishDeployment() to publish an existing deployment to the Central Portal (#251):

./gradlew nmcpPublishDeployment -PnmcpDeploymentId=$deploymentId'

Many thanks @​marcphilipp for the contribution!

v1.4.4

Nmcp 1.4.4 retries more aggressively when Sonatype is flaky, and makes it more explicit that publishAllProjectsProbablyBreakingProjectIsolation() is still OK to use if you don't mind about project isolation.

• Implement retry for snapshots/deployment upload/status check (GradleUp/nmcp#244)
• Move the empty files check to execution (GradleUp/nmcp#243)
• Update deprecation message (GradleUp/nmcp#247)

v1.4.3

... (truncated)

Changelog

Sourced from com.gradleup.nmcp's changelog.

Version 1.6.1

2026-07-01

Restores some checksums:

• maven-metadata.md5, maven-metadata.sha1 (because maven outputs a scary warning without them)
• All the .sha512 checksums (because Gradle uses them to validate caches contents)

All in all, nmcp now publishes .md5, .sha1, .sha512 for all files except for signature files (.asc) where no checksums are required.

Long term, I'd love to drop the .md5 and .sha1 checksums. That would require both maven and Sonatype to stop requesting them.

Many thanks to @​marcphilipp and @​leonard84 for helping me navigate this issue 💙

Version 1.6.0

2026-06-21

Nmcp 1.6.0 stop publishing the following checksums:

• signature checksums (.asc.md5, .asc.sha1, .asc.sha256, .asc.sha512)
• all non-required checksums (.sha256, .sha512)
• all maven-metadata checksums (for local publishing, maven-metadata.xml is never sent to Central Portal)

You can send the checksums by setting publishAllChecksums

nmcpAggregation {
  publishAllChecksums.set(true)
}

Version 1.5.0

2026-04-30

Nmcp 1.5.0 adds nmcpPublishDeployment() to publish an existing deployment to the Central Portal (#251):

./gradlew nmcpPublishDeployment -PnmcpDeploymentId=$deploymentId'

Many thanks @​marcphilipp for the contribution!

Version 1.4.4

2026-01-24

Nmcp 1.4.4 retries more aggressively when Sonatype is flaky, and makes it more explicit that publishAllProjectsProbablyBreakingProjectIsolation() is still OK to use if you don't mind about project isolation.

• Implement retry for snapshots/deployment upload/status check (GradleUp/nmcp#244)
• Move the empty files check to execution (GradleUp/nmcp#243)
• Update deprecation message (GradleUp/nmcp#247)

... (truncated)

Commits

• f0114cb Also publish checksums for the artifact metadata
• 6e57dbc Update bootstrap nmcp
• bc10949 Reintroduce some checksums (#266)
• 1f34b28 Deprecate publishAllPublicationsToCentralPortal (#264)
• 92e0f77 Version is now 1.6.1-SNAPSHOT (#261)
• b6ffb40 Remove another place where checksums where added (#259)
• 942bcd8 Do not publish checksums for maven-metadata (#258)
• 4ad0a51 Update dependencies (#257)
• cf04ce0 Filter out checksums (#256)
• 7ef98bf Version is now 1.5.1-SNAPSHOT (#254)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)