[davidschachterADFA]

Summary

ADFA-6864. Removes maven { url = uri("https://jitpack.io") } from plugins/AI-Core/settings.gradle.kts. No AI-Core dependency comes from it. Built from an empty Gradle cache, AI-Core resolved all 287 libraries from Google and Maven Central and sent no request to jitpack.io. The 287 are its eight implementation dependencies (androidx, Material, Kotlin stdlib, coroutines, Markwon, Gson), its seven test dependencies, and everything they pull in.

Gradle asks every repository listed in settings.gradle.kts, so JitPack remains a possible source until the line goes. FAIL_ON_PROJECT_REPOS only stops build files from adding repositories of their own. For a fixed version, Gradle asks JitPack only when Google and Maven Central lack the library. For a dynamic version such as 1.+, it asks every repository and takes the newest, so JitPack could supply a newer copy even of a library the other two have. Nothing in AI-Core triggers either case today: every version is fixed, and every library is on Google or Maven Central. This is a supply-chain tidy-up, found by the /plugin-review security audit (finding F17).

The line came in with the move under plugins/ (ADFA-6167). Seven other plugins and the Demo (jME) template still have it, and this PR leaves them alone. ADFA-6865 covers the five AI-Agent plugins and the template. Layout-Editor and Icons-Repository use com.github.* libraries, but that name does not mean the library comes from JitPack: all four (glide, colorpickerview, svg-generator, svg-support) are on Maven Central. Whether anything those four pull in needs JitPack was not checked.

Verification

An independent review on 2026-10-30 started from an empty Gradle cache (Gradle 9.6.1):

• Resolved all 27 resolvable configurations of AI-Core, with no errors. All 287 libraries came from Google or Maven Central, and the HTTP log has no request to jitpack.io.
• Put the line back and resolved again. The resolved graph was identical, so removing the line changes no library or version.
• Built assemblePlugin and checked the build record with scripts/verify-provenance.sh (revision e7b64d1c, from git, not dirty).

The only automatic check on pull requests here, "Toolchain versions", reads files and never runs Gradle, so it does not test this change. The workflows that build plugins run only by hand.

Not verified

• Not run on a device. The resolved libraries are identical, so no change is expected at runtime.

Test plan

• assemblePlugin for AI-Core passes without the line, from an empty Gradle cache
• No request to jitpack.io, and the resolved graph is identical with the line put back
• AI-Core unit tests: 1,255 passed, 0 failed
• addons check exits 0
• Device

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vh2DAaJxvRXKRYkgiDqwGQ

[davidschachterADFA]

@Daniel-ADFA @hal-eisen-adfa, could one of you review this? It's a one-line deletion that removes the unused jitpack.io repository from AI-Core's settings.gradle.kts. One approval is enough to merge.

It's been checked more thoroughly than the diff suggests. An independent review built AI-Core from an empty Gradle cache. All 287 libraries came from Google and Maven Central, with no request to jitpack.io. With the line put back, the downloaded libraries were identical. assemblePlugin, the 1,255 unit tests and the addons check all pass. It hasn't been run on a device; since the libraries are identical, no runtime change is expected. The description has the details.

Posted by Claude Code for David Schachter.