[Android] HTTP 403 downloading React Android 0.86.3 and Hermes debug AARs #59471

Description

On October 25, 2026, HTTPS GET requests for these Android debug artifacts returned HTTP 403 Forbidden, with zero artifact bytes downloaded:

React Android 0.86.3:
https://repo.reactnative.dev/maven2/com/facebook/react/react-android/0.86.3/react-android-0.86.3-debug.aar

Hermes Android 250829098.0.17:
https://repo.reactnative.dev/maven2/com/facebook/hermes/hermes-android/250829098.0.17/hermes-android-250829098.0.17-debug.aar

The Android build is blocked before APK generation. A preceding HEAD request to Maven Central redirected to the React Android URL above, consistent with Sonatype’s documented policy:
https://central.sonatype.org/faq/429-operational-dependencies/

Expected: published Android artifacts download successfully.
Actual: both GET requests returned HTTP 403.

This occurred in an Expo 57.0.27 project using React Native 0.86.3, before the application could run. Please advise whether this belongs here, in Expo’s tracker, or in a separate artifact-infrastructure channel.

Response headers and error bodies were not retained, so the cause is unknown. These are recorded failures, not a fresh availability check. Related issue #58427 concerns an earlier iOS 404; we are not assuming the same cause.

Steps to reproduce

Historical steps performed on October 25, 2026:

1. Attempt an Android Debug build requiring React Android 0.86.3 and Hermes Android 250829098.0.17.
2. Observe Maven Central redirecting the React Android artifact to repo.reactnative.dev.
3. Attempt one HTTPS GET for each artifact URL in the description.
4. Both return HTTP 403 Forbidden with zero artifact bytes downloaded; no APK is generated.
   No retries or version changes were performed. We have not established whether all clients are affected. HEAD requests may behave differently from the failed GET requests.

React Native Version

0.86.3

Affected Platforms

Build - MacOS, Runtime - Android

Output of npx @react-native-community/cli info

Leave this pending. We need actual output from the Mac, with private paths reviewed before sharing. Don’t paste an invented environment report. Running npx can download software if the CLI isn’t installed, so we should check the existing local CLI first.
8Leave this pending. We need actual output from the Mac, with private paths reviewed before sharing. Don’t paste an invented environment report. Running npx can download software if the CLI isn’t installed, so we should check the existing local CLI first.

Stacktrace or Logs

Summary of recorded outcomes, not raw response headers:

React Android 0.86.3-debug.aar:
HTTPS GET returned HTTP 403 Forbidden.
Artifact bytes downloaded: 0.

Hermes Android 250829098.0.17-debug.aar:
HTTPS GET returned HTTP 403 Forbidden.
Artifact bytes downloaded: 0.

Failure record saved: 2026-10-25 21:55:43 UTC.
Individual request timestamps, response headers and error bodies were not retained.
No APK was generated.

MANDATORY Reproducer

https://github.com/disruptdesignsllc-ai/react-native-android-aar-403-repro

Screenshots and Videos

No response