[noahjalex]

Why

The first post-merge snapshot after #299 failed because Vanniktech 0.17 still uploads to the retired legacy OSSRH endpoint, which now returns HTTP 405. The repository also still identifies snapshots as 4.8.3 even though the next draft release is 4.9.0.

What

• Upgrade the wrapper to Gradle 8.13, Kotlin to 1.9.20, and Vanniktech publishing to 0.35.0 (the newest mutually supported AGP 8 stack)
• Publish snapshots and signed releases through Sonatype Central Portal
• Use the repository's Central Portal token and GPG secrets
• Replace the legacy close/release workflow with the Portal-compatible release task
• Set the next development version and snapshot installation instructions to 4.9.0-SNAPSHOT and the Central Portal snapshot repository

Risk Assessment

Medium — this changes release infrastructure and updates the Kotlin compiler/runtime dependency from 1.7.20 to 1.9.20, but does not change SDK source. The com.afterpay namespace has been recovered and the repository now has the Central Portal and GPG secrets referenced by both publishing workflows.

References

• Failed snapshot: https://github.com/afterpay/sdk-android/actions/runs/32746459647
• Namespace recovery and secret provisioning: https://sq-block.slack.com/archives/C02FD8Z50/p1787936876415969?thread_ts=1787590538.037559&cid=C02FD8Z50
• Sonatype migration guide: https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/
• Must land before Fix sandbox UI gallery initialization #300 and COMSE-124: Add info modal close control #298: Fix sandbox UI gallery initialization #300 · COMSE-124: Add info modal close control #298
• Locally validated the exact SDK/sample CI tasks, all unit tests, lint, formatting, release AAR/POM/source/Javadoc generation, in-memory GPG signing without a key ID, and snapshot/stable publication task graphs without uploading artifacts

Update — 2026-08-28

After rechecking the dependency matrix, moved to Vanniktech 0.35.0, Gradle 8.13, and Kotlin 1.9.20: the newest mutually supported stack that keeps the repository on AGP 8.2.2. Josh is right that Vanniktech 0.37.0 and Gradle 9.7.1 are current; using that pair requires a separate AGP 9 and built-in Kotlin migration rather than isolated version bumps.

Generated with Amp