fix(deps): update dependency com.gradleup.nmcp:com.gradleup.nmcp.gradle.plugin to v1.6.1

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
com.gradleup.nmcp:com.gradleup.nmcp.gradle.plugin	1.3.0 → 1.6.1

---

Release Notes

gradleup/nmcp (com.gradleup.nmcp:com.gradleup.nmcp.gradle.plugin)

v1.6.1

2026-07-01

Restores some checksums:

• maven-metadata.md5, maven-metadata.sha1 (because maven outputs a scary warning without them)
• All the .sha512 checksums (because Gradle uses them to validate caches contents)

All in all, nmcp now publishes .md5, .sha1, .sha512 for all files except for signature files (.asc) where no checksums are required.

Long term, I'd love to drop the .md5 and .sha1 checksums. That would require both maven and Sonatype to stop requesting them.

Many thanks to @​marcphilipp and @​leonard84 for helping me navigate this issue 💙

v1.6.0

2026-06-21

Nmcp 1.6.0 stop publishing the following checksums:

• signature checksums (.asc.md5, .asc.sha1, .asc.sha256, .asc.sha512)
• all non-required checksums (.sha256, .sha512)
• all maven-metadata checksums (for local publishing, maven-metadata.xml is never sent to Central Portal)

You can send the checksums by setting publishAllChecksums

nmcpAggregation {
  publishAllChecksums.set(true)
}

v1.5.0

2026-04-30

Nmcp 1.5.0 adds nmcpPublishDeployment() to publish an existing deployment to the Central Portal (#​251):

./gradlew nmcpPublishDeployment -PnmcpDeploymentId=$deploymentId'

Many thanks @​marcphilipp for the contribution!

v1.4.4

2026-01-24

Nmcp 1.4.4 retries more aggressively when Sonatype is flaky, and makes it more explicit that publishAllProjectsProbablyBreakingProjectIsolation() is still OK to use if you don't mind about project isolation.

• Implement retry for snapshots/deployment upload/status check (GradleUp#244)
• Move the empty files check to execution (GradleUp#243)
• Update deprecation message (GradleUp#247)

v1.4.3

2026-01-02

Version 1.4.3 adds NmcpAggregationExtension.allowDuplicateProjectNames (#​239) as an escape hatch for the duplicate name check (#​233)

v1.4.2

2025-12-31

Version 1.4.2 fixes for snapshots returning 400 on XML 1.1 and handles some configuration errors more gracefully.

👷‍♂️ All changes

• Make sure to send XML 1.0 (Fixes 400 error when publishing snapshots) GradleUp#231
• Add NmcpAggregationExtension.localRepository() GradleUp#234
• Fail if there are duplicate project names GradleUp#233
• Display an error if the aggregation is empty GradleUp#236

v1.4.1

2025-12-30

Nmcp 1.4.1 refines the aggregation dependency resolution to avoid including by mistake projects that do not apply com.gradleup.nmcp.

👷 All changes

• Fix zip files could contain unexpected files GradleUp#227
• Bump Kotlin, OkHttp, xmlutil and a bunch of other dependencies GradleUp#228

v1.4.0

Nmcp can now be 100% configured from settings.gradle[.kts]:

// settings.gradle.kts
plugins {
  id("com.gradleup.nmcp.setting").version("1.4.0")
}

nmcpAggregation {
  centralPortal {
    username = TODO()
    password = TODO()
    // ...
  }
}

This version also contains a few quality of life improvements courtesy of @​SimonMarquis and fixes an issue that could sometimes cause maven-metadata.xml to be out of sync.

What's Changed

• Clamp remaining time to seconds GradleUp#213
• maven-metadata.xml: make sure the base version is always added to the list of versions GradleUp#214, GradleUp#222
• Set an explicit configuration name to load nmcp-tasks nmcp GradleUp#215
• Register tasks earlier so that they are generated as typesafe tasks accessors GradleUp#219
• Expand the zip files when passing it to allFiles nmcp GradleUp#218
• Publish to nmcp repo tasks should never be up-to-date nmcp GradleUp#221
• Allow to configure the whole build from the settings script nmcp GradleUp#223

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every 3 weeks on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.