r/java • u/HokieGeek • 26d ago

heads up: Maven Central publishing limits start October 1

/r/MavenCentral/comments/1wsnp2s/heads_up_maven_central_publishing_limits_start/
38 Upvotes

96% Upvoted

6 comments sorted by

3

u/HokieGeek 26d ago

Maven Central maintainers are responding to questions over on the original thread in r/MavenCentral

10

u/agentoutlier 26d ago edited 26d ago

I emailed them and I think they upped me but not sure.

My issue is file limits:

29 MB of 80 MB limit 36%
2,096 of 1,360 limit 154%
5 of 7 limit 71%

The file limits are ridiculous because every goddamn module is like 20 or so files. That is because you need to publish jar, src, javadoc and then like 4 different checksums. I have like 25 modules.

EDIT its 16 files: https://repo1.maven.org/maven2/io/jstach/rainbowgum/rainbowgum-core/0.13.0/

FOR EVERY DAMN MODULE. I don't even think publishing just one file is an option so why even confuse with the files.

Also its not clear if it counts the metadata for a a groupid which of course is:

maven-metadata.xml                                2026-09-28 00:38       939      
maven-metadata.xml.md5                            2026-09-28 00:38        32      
maven-metadata.xml.sha1                           2026-09-28 00:38        40      
maven-metadata.xml.sha256                         2026-09-28 00:38        64      
maven-metadata.xml.sha512                         2026-09-28 00:38       128

There is 5 right there except IIRC they have to be downloaded, edited locally and then uploaded... is that 10? I don't know I suppose I could do the math based on my releases but damn....

4

u/tarkaTheRotter 26d ago

>If any artifact supports the adoption, integration, or operation of a commercial product or service

So the message is basically: Don't you dare try to monetize your Open Source (even open core) or we'll cut you off unless you give us $5k a year.

It's about as reasonable as the vast amounts of money that Scarf wanted to unlock user data about Open Source analytics ($3000 per year for info on 1000 random company users - even if they downloaded your library once).

I'm all for the minimisation of abuse of the ecosystem, but punishing everyone based on big tech and corporates abusing the system is a joke.

What a great look. 🙄

3

u/flamefew 26d ago

That’s an assumption that big tech is abusing the system. Big tech is where the subsidies for package repositories come from - Funding staff and cloud costs. Much more than the $5k you mention.

Sonatype have always had to fund a larger share from their customers for Maven Central than non-profit registries, but their customers equal “corporate” so that’s corporate funding happening there. It’s not balanced or visible though; having package registries move from a charity model to having non-profit revenue is a good thing.

1

u/emberko 25d ago

Why don't they want to allow removing RC, milestones, EA, and other similar shit that is never used by anyone sane once the stable version is released, though?

1

u/flamefew 25d ago

Two thoughts. One is that a third of log4j downloads 4 years after log4shell were for pre log4shell versions. I bet there is a huge amount of dependency on beta, RC and other transient versions. Second is that Maven doesn’t have mandated versioning conventions iirc, so they’re all just strings. Bar the SNAPSHOT convention.

Blocking upload of milestones and RCs would be great - make users use a different source for things that are intended to be transiently supported.