Change legacy central url

[juergen-fast]

search.maven.org is the legacy search platform with an uptime of 95,88% in the last 90 days (see https://status.maven.org/).
central.sonatype.com is the modern search platform with an uptime of 100%.

So please change the default of centralUrl to https://central.sonatype.com/solrsearch/select

[aikebah]

The problem I have with it is that the solrsearch is not part of their documented API
https://central.sonatype.com/api-doc

Their help is still referring to 'legacy search'
https://central.sonatype.org/pages/support/#consumers

https://central.sonatype.org/faq/what-happened-to-search-maven-org/#what-about-the-searchmavenorg-api

[simonseyer]

Hi @aikebah. Can you by chance check if a switch to the new APIs is possible by now? Thank you in advance 🙏

[jmtt89]

Hi, according to this other comment #7686 (comment), there is a response from the Sonatype team regarding this matter.

meanwhile we can test it using "--centralUrl" argument for dependency-check-cli

[schlm3]

Hi, according to this other comment #7686 (comment), there is a response from the Sonatype team regarding this matter.

meanwhile we can test it using "--centralUrl" argument for dependency-check-cli

Thanks @jmtt89 for that hint.
Together with the info from #7686 (comment), I was able to configure my dependency-checker job such that it is working again now.
Just add "--centralUrl https://central.sonatype.com/solrsearch/select" to your commandline.

[aggeboe]

Using the gradle plugin here.
./gradlew dependencyCheckAnalyze -Danalyzer.central.url="https://central.sonatype.com/solrsearch/select" seems to work just fine.

[boardbloke]

@jeremylong - are you able to provide an opinion?

I note here you said the result of using https://central.sonatype.com/search has api incompatibilites that cause problems

#7686 (comment)

Here though, sonatype seem to be saying https://central.sonatype.com/solrsearch/select is a "compatibility api" - #7686 (comment) - whatever that means.

Just wondering whether using this latter url will cause loss of functionality when doing a dependencyCheckAnalyze ? Are there tests that can be run to validate whether its good enough?

[habelson]

Using the gradle plugin here. ./gradlew dependencyCheckAnalyze -Danalyzer.central.url="https://central.sonatype.com/solrsearch/select" seems to work just fine.

This works for me... up to a point. It appears it gets rate limited

[aggeboe]

This works for me... up to a point. It appears it gets rate limited

Hmm. We have dependency-check enabled in more than 100 azure pipelines, scanning both PRs and merge to main. And just completed 100s of PRs this morning (weekly renovate) without a single rate limit or otherwise dependency-check related error.

We do have both centralized maven and gradle caches in place, though.

[jeremylong]

As mentioned in #7686 - the new API is not compatible. You've basically disabled the Central Analyzer if you switched to using the newly provided API as the response schema is different.

I'm closing this issue as a duplicate. Please use #7686 for further discussion.