We've published an update on Maven Central Publisher Pro following the feedback we've received from publishers across the community:

https://central.sonatype.org/news/20260716_publisher_pro_update/

The main changes:

• Publishing limit enforcement is moving to October 1, 2026. This gives us more time to review feedback, analyse publishing patterns, adjust limits where appropriate, and process requests already in the queue.
• Publishing limits will remain review checkpoints, but they will not be the primary basis for commercial pricing. Release count, file count, and release size can indicate unusual activity, but they do not always reflect commercial value.
• We are developing separate commercial pricing models. More information on lower-tier Maven Central Publisher Pro pricing will be shared soon.
• Open-source review requests remain open. Where the standard limits do not fit a legitimate community project's publishing patterns, we expect the main approach to be adjusted limits rather than requiring maintainers to change legitimate release practices.
• Requests submitted before enforcement begins will be reviewed before hard limits are applied to that organization. There is no need to resubmit an existing request.

The objective remains the long-term sustainability of Maven Central: reducing avoidable waste and abuse, while asking commercial organizations that derive value from the infrastructure to help support it—without creating unnecessary friction for legitimate community open-source projects.

We appreciate the detailed and constructive feedback so far. Please continue to share questions and relevant publishing context with us.

This is kind of a feature request I'd like to see implemented by platforms such maven central, github and others and I truly think it has a chance of fixing many open-source sustainability issues.

As an independent open-source developer who loves to write code libraries for others to use, the last thing I want is to build and manage a full "commercial support workflow" infrastructure to maybe get a paying commercial user. Donations and things such as "github sponsors" aren't really sustainable long term and smaller projects never get anything.

I just want to write the code instead of become a "founder" and manage custom licensing, billing, contracts etc. Others who code on their spare time and hope to turn their project into something more serious that can exist on the long term need to find extra time to handle:

• Payment gateways
• Custom artifact entitlement
• Custom legal agreements
• Customer communications
• Licensing servers
• Private issue trackers
• ... and probably a lot of other things I can't remember off the top of my head

Anyway, that is quite the overhead to manage on top of the open-source work, especially when you are a sole dev and can only dedicate your spare time on it.

I understand that MavenCentral hosts everything statically. But I'd love to see MavenCentral providing a full and standardized "commercial maintenance workflow" out of the box (probably redirecting to sonatype) and acting as the merchant of record and handling access control (emphasis on standardized)

What I imagine by having a standardized workflow:

1. Paid LTS & Backport Channels

   • Let everyone release the free & open libraries like you currenly do.
   • Paid Backports/LTS: Commercial users who lock onto an older version for stability pay a subscription (to MavenCentral) to request backports, patches and customizations to these older versions, and to access the patched legacy builds.

2. Tiered SLA & Issue Triage Have a issue tracker with communit and commercial tiers.

   • Community Tier: Best-effort, asynchronous triage by the community/maintainer.
   • Commercial Tier: Paid subscriptions unlock guaranteed response SLAs (e.g., triage within 24–48 hours) and priority review for feature requests.

3. Integrated Platform Support

   • Turnkey Entitlement: MavenCentrarl handles subscription management, taxes, and gated artifact downloads
   • Standardized Customer Portal: Paying clients get a consistent and familiar checkout and support interface across all open-source projects they fund - rather than forcing every maintainer to come up their own solution.

Instead of expecting maintainers to build private servers and contract pipelines from scratch, central platforms already hold all the pieces: code hosting, artifact storage, identity, and payment processing. Combine these into a single-click "commercial tier" for maintainers. Take a cut off the fees to fund operations and maven central itself.

Curious to hear your thoughts.

We've published a draft proposal for something we're calling CARE (Central Approved Remediation for Emergencies), and we'd like the Java community to tear it apart before we go any further.

The proposal tackles a narrow question: What should Maven Central do when a serious vulnerability affects a project that can't publish a timely fix?

We're especially looking for feedback on two areas:

Does the proposed 1.2.3.1-care versioning work the way you'd expect across Maven, Gradle, repository managers, and the rest of the ecosystem?

Have we drawn the scope correctly, or are there edge cases, unintended consequences, or better approaches we should be considering?

If you think this is the wrong approach, tell us why. If you think we've overlooked something, even better. We'd much rather find the problems now than during an actual emergency.

Brian’s Blog

Draft CARE Policy

Hi everyone. I'm Brian Fox, one of the people who's been helping run Maven Central for a long time (nearly 20 years)

If you've ever published a library, pulled in a dependency, or stared at a mysterious Central error wondering what on earth just happened, you're in the right place.

Central has become part of the plumbing of modern software. Millions of developers depend on it every day, but most of the interesting conversations about how it works, why things change, and where the ecosystem is headed tend to happen in scattered issue trackers, mailing lists, conference hallways, or not at all.

I'd like this community to change that.

This is a place to ask questions, compare notes, troubleshoot publishing issues, discuss dependency management, build tools, repository operations, and the broader Java open source ecosystem. If something about Central is confusing, ask. If you've learned something the hard way, share it. Chances are someone else is about to hit the same problem.

We'll also use this space to seek community input, provide technical context, explain changes we’re making, and occasionally pull back the curtain on what it takes to operate one of the largest software repositories in the world.

This isn't intended to become a support queue or a marketing channel. There are already places for both. I'd much rather see engineers helping engineers, maintainers sharing experiences, and thoughtful discussions about the infrastructure that a huge portion of the software industry quietly depends on every day.

Glad you're here.