Maven Central Publishing Limits⚓︎

What's Changing?⚓︎

Maven Central is introducing publishing usage visibility and limits for high-volume publishing activity. These limits are focused on the highest-volume publishing patterns across Maven Central, based on usage data from roughly the top 10% of publishers.

Most community open source projects should not be affected. Maven Central remains free for ordinary community open source publishing. Community open source projects with unusual publishing patterns may request higher limits or an exemption for review.

Publishing limits are evaluated per organization and may include one or more namespaces. Maven Central tracks three monthly publishing metrics: file count, release size, and release count. These metrics are evaluated using three-month averages, so occasional deviations, short-term bursts, or urgent release activity, such as a security fix for a CVE, should not by themselves cause enforcement.

Your organization's current usage, thresholds, warnings, and trends are available in the Usage Center. During the soft-limit phase, publishers may see informational notifications when they approach or exceed the current free publishing thresholds. These notifications do not block, throttle, or prevent publishing.

The Usage Center is intended to provide advance warning before enforcement ever affects publishing. The goal is that publishers are not surprised by a block. During rollout, and over time as projects grow, publishers should have visibility into their usage, warnings when they are approaching limits, and time to adjust publishing patterns, correct namespace or organization issues, request higher limits or an exemption, or move to a paid option if appropriate.

The soft-limit phase is designed to give publishers plenty of time to understand their usage, adjust publishing patterns if needed, correct namespace or organization issues, and request higher limits or an exemption before rate limiting begins. It is also a feedback and tuning period: thresholds may change as we better understand real-world impact.

Rate limiting begins on August 11, 2026. Organizations regularly publishing above the free thresholds will need a resolution in place — an adjusted limit, an exemption, or Maven Central Publisher Pro — to continue without interruption.

Why is Sonatype Making This Change?⚓︎

This change is part of a broader industry effort to keep public package infrastructure reliable, secure, and open for the long term. Across ecosystems, registries are facing the same pressures: rising automation, CI/CD, security scanning, machine-driven software supply chains, and commercial platforms using public registries as production infrastructure.

For more context on this broader effort, see:

Maven Central is part of that same shift. It is critical infrastructure for the Java ecosystem: a shared place where community open source projects publish release-ready components and millions of developers reliably consume them.

But publishing demand is no longer evenly distributed. Maven Central now supports both ordinary community open source releases and high-scale publishing patterns from commercial platforms, automated pipelines, SDKs, generated clients, agents, integrations, and other software delivery systems.

Those patterns create a different kind of demand on shared infrastructure. In some cases, Maven Central is being used not just as community open source distribution, but as the last-mile delivery channel for commercial software ecosystems.

The data shows that publishing demand is concentrated. In the past 90 days, 10% of namespaces accounted for:

more than 88% of all files published to Maven Central
more than 90% of total storage consumed by new releases
over 70% of all new release events

Info

Publishing size, file count, and release frequency are useful signals for identifying these patterns. They are not perfect measures of intent, and they are not meant to punish legitimate open source activity. They create a review point where publishing behavior looks like commercial-scale or infrastructure-driven distribution, so Maven Central can preserve free publishing for the community while giving higher-volume commercial and infrastructure-scale publishers a clear path that helps support the infrastructure they depend on.

What Stays the Same?⚓︎

Maven Central's core purpose is not changing. It remains a public distribution platform for release-ready community open source software in the Java ecosystem.

For most publishers:

Existing publishing workflows remain unchanged.
Public artifacts already published to Maven Central remain available for download.
Developers and consumers can continue to rely on Maven Central as the default source for public Java components.
Community open source projects should generally be unaffected by these limits. Projects with unusual publishing patterns can request higher limits or an exemption for review.

These changes are focused on high-volume publishing patterns that operate at commercial or infrastructure scale. They are not intended to disrupt community open source publishing, emergency fixes, or legitimate projects whose publishing patterns happen to look unusual in the data.

What Are the Maven Central Publishing Limits?⚓︎

Maven Central tracks three monthly publishing metrics per organization: file count, release size, and release count. Limits are evaluated per organization and may include one or more namespaces.

The current thresholds, your organization's usage, and where your organization stands relative to those thresholds are available in the Usage Center. Because thresholds may be adjusted during the soft-limit phase, the Usage Center is the source of truth for current limits, warnings, and trends.

The Usage Center is also where publishers should expect to see advance warning before publishing is affected. Warnings are intended to give publishers time to understand usage, respond to growth, correct namespace or organization issues, request higher limits or an exemption, or move to a paid option before enforcement occurs.

The charts below show how publishing activity is distributed across Maven Central. They provide context for why the limits are focused on the highest-volume publishing patterns rather than ordinary community open source release activity.

These limits are based on sustained usage patterns, not isolated release events. Occasional bursts, such as urgent security fixes or short-term release spikes, should not by themselves cause enforcement.

The table below shows monthly publishing volumes at selected percentiles across all Maven Central organizations, based on the past 90 days of data. Limits are set at the point where the top 10% of publishers by volume begin.

Percentile	File Count	Release Size (MB)	Release Count
90th	1,167	78	7
91st	1,310	94	7
92nd	1,538	115	8
93rd	1,852	150	9
94th	2,269	193	11
95th	2,805	247	13
96th	3,824	349	15
97th	5,188	522	19
98th	8,030	877	27
99th	17,724	1,808	50

Note

If you notice discrepancies in how your namespaces are organized, contact central-support@sonatype.com.

Most community open source projects are expected to remain unaffected. Projects with unusual publishing patterns can request higher limits or an exemption for review.

Maven Central Publishing Limits Timeline⚓︎

Publishing limits are being introduced in phases so publishers have time to understand their usage, respond to warnings, and resolve issues before enforcement begins.

Phase	Date	What Happens
Soft Limits	June 16, 2026	Usage visibility and notifications are available in the Usage Center. Publishers may see warnings when approaching or exceeding current thresholds. Publishing continues without interruption. Use this phase to review usage, understand trends, adjust publishing patterns, correct namespace or organization issues, request higher limits or an exemption, or evaluate Maven Central Publisher Pro if appropriate.
Rate Limiting	August 11, 2026	Organizations regularly publishing above the free thresholds will need a resolution in place — an adjusted limit, an exemption, or Maven Central Publisher Pro — to continue without interruption.

During the soft-limit phase, notifications are informational only. They do not block, throttle, or prevent publishing.

After rate limiting begins, the Usage Center will continue to provide visibility and warnings as usage changes over time. The goal is that publishers have advance notice before enforcement affects publishing, whether they are affected during the initial rollout or later as their publishing activity grows.

How to Monitor Usage⚓︎

You can find your organization's publishing usage by logging into Maven Central and navigating to Publishing -> Usage Center.

The Usage Center displays organization-level metrics aggregated across all namespaces, including:

Release size
File count
Release count

Usage cards show whether your organization is within limits, approaching limits, or at critical levels. Warnings begin before publishing is affected so publishers have time to understand what is happening and decide what to do next.

You can also view namespace-level metrics in a detailed table. Data visibility depends on your access permissions within the organization. Usage data can be exported as CSV for further analysis.

The View Trends option shows usage trends over the last three months. This helps distinguish sustained publishing patterns from occasional bursts, such as security fixes, short-term release spikes, or other unusual events.

If your usage appears incorrect, check whether your namespaces are grouped as expected under your organization. If the grouping looks wrong, contact central-support@sonatype.com with the relevant organization, namespace, and a description of the issue.

What Should I Do Next?⚓︎

If your organization is within the free limits, no action is required.

If your organization is approaching or exceeding the free limits, start by identifying which path best describes your publishing activity.

Community Open Source Publishing⚓︎

Use this path if your project is primarily publishing release-ready community open source software for public use in the Java ecosystem.

Community Open Source Publishing — details

Most community open source projects should not be affected by these limits. Maven Central remains free for ordinary community open source publishing. The current thresholds are drawn from analysis of all publishing activity over the last three months and set at approximately the top 10% of publishers by volume.

Some legitimate community open source projects may have unusual publishing patterns. A project may publish frequently, produce many platform variants, include native binaries, generate many related artifacts, or need to publish urgent security fixes. Those patterns may look unusual in usage data even when the project is operating in good faith and serving the community.

If your community open source project receives warnings in the Usage Center or appears to be approaching limits, review your usage first. The three-month trend view can help distinguish sustained publishing patterns from occasional bursts or emergency releases.

If your usage is expected for your project, you may request higher limits or an exemption for review. The intent is not to create an ongoing monthly approval process for legitimate community open source projects. Once the project and publishing pattern are understood, the organization can be adjusted appropriately.

When contacting central-support@sonatype.com, include:

Namespace
Organization
Description of the project
Explanation of the publishing pattern
Whether the usage is sustained, occasional, or related to a specific event such as a security fix
Reason higher limits or an exemption are needed

Company or Commercial Publishing⚓︎

Use this path if Maven Central is part of how your company distributes software to customers, users, platforms, integrations, or downstream systems.

Company or Commercial Publishing — details

This may include SDKs, generated clients, agents, integrations, platform components, commercial open source projects, developer tools, or other software published as part of a business or commercial delivery model.

Maven Central Publisher Pro is intended for organizations whose publishing activity regularly exceeds the free limits because Maven Central is part of a commercial or infrastructure-scale distribution model. Publisher Pro provides increased publishing capacity and access to Sonatype support for organizations publishing large SDKs, generated clients, agents, integrations, platform components, developer tools, or other high-volume release streams through Maven Central.

Learn more about Maven Central Publisher Pro and evaluate whether it is the right option for your organization.

Frequently Asked Questions⚓︎

Are these limits final?

Not necessarily. The soft-limit phase is designed to give publishers visibility into their usage and give Sonatype feedback about real-world impact before rate limiting begins. Thresholds may be adjusted as we learn more from actual publisher behavior, community feedback, namespace grouping issues, and exemption requests.

Will I receive warning before publishing is blocked?

Yes. The Usage Center is intended to provide advance warning before enforcement affects publishing. Publishers should see when their organization is approaching or exceeding limits, giving them time to review usage, adjust publishing patterns, correct namespace or organization issues, request higher limits or an exemption, or move to a paid option if appropriate.

The goal is that publishers are not surprised by a block.

Are limits based on one release, one day, or one unusual spike?

No. Publishing limits are based on three-month averages. They are intended to identify sustained high-volume publishing patterns, not isolated release events.

Short-term bursts, occasional release spikes, or urgent releases should not by themselves cause enforcement.

What happens if my project needs to publish an urgent security fix?

Urgent security releases, including fixes for CVEs, should not by themselves cause enforcement. Maven Central exists to support the Java ecosystem, especially when projects need to deliver important fixes to users.

If your project needs to publish an urgent security fix or other time-sensitive community release and you are concerned limits may interfere, contact central-support@sonatype.com. We will work with you to make sure legitimate community open source releases can get out.

Do these limits apply to community open source projects?

By design, the limits are set at approximately the 90th percentile of all publishers by volume, meaning roughly 90% of all projects are unaffected. Maven Central remains free for ordinary community open source publishing.

Some legitimate community open source projects may have unusual publishing patterns, such as frequent releases, many platform variants, native binaries, generated artifacts, or large release outputs. Those projects can request higher limits or an exemption for review.

What qualifies for higher limits or an exemption?

Higher limits or exemptions are intended for legitimate community open source projects whose publishing patterns exceed the default thresholds but are still consistent with Maven Central's role as public open source infrastructure.

Examples may include projects with unusual release models, many supported platforms, native binaries, large but legitimate artifacts, generated artifacts required by the project, or urgent security-related publishing needs.

Each request is reviewed based on the project, organization, namespace, and publishing pattern.

Is an exemption a recurring monthly approval process?

That is not the intent. For legitimate community open source projects, the goal is not to create an ongoing bureaucracy. Once the project and publishing pattern are understood, the organization can be adjusted appropriately.

What if my project is open source but backed by a company?

Open source projects backed by companies are not automatically excluded from community open source treatment. The important distinction is what the project is used for. Generally speaking, if the project is not part of a commercial go-to-market motion, it will qualify for community open source treatment.

If the project is primarily publishing release-ready community open source software for public use in the Java ecosystem, it may qualify for higher limits or an exemption if its publishing pattern is unusual.

If Maven Central is being used as part of a company's commercial distribution path for SDKs, generated clients, agents, integrations, platform components, developer tools, or customer-facing software delivery, Maven Central Publisher Pro may be the appropriate path.

What counts as company or commercial publishing?

Company or commercial publishing generally means Maven Central is part of how a business distributes software to customers, users, platforms, integrations, or downstream systems.

This may include SDKs, generated clients, agents, integrations, platform components, commercial open source projects, developer tools, or other software published as part of a commercial product, service, or delivery model.

Commercial publishing through Maven Central is legitimate and often valuable to the Java ecosystem. But commercial enterprises that rely on open source infrastructure as part of their business have a responsibility to help support that infrastructure.

Why are limits evaluated at the organization level?

Limits are evaluated at the organization level because publishing activity is often managed across multiple namespaces, projects, teams, or release pipelines within the same organization.

If your namespaces are grouped incorrectly, or if the organization-level view does not match how your project is actually governed, contact central-support@sonatype.com with the relevant organization, namespaces, and a description of the issue.

What if my Usage Center data looks wrong?

First, check the namespace-level detail in the Usage Center. Usage is aggregated at the organization level, so unexpected namespaces or project groupings may explain the numbers.

If the data still appears incorrect, contact central-support@sonatype.com with:

Organization
Namespace or namespaces
Description of the issue
Why the usage appears incorrect
Any relevant context about project ownership or publishing workflow

Why use file count, release size, and release count?

No single metric perfectly distinguishes community open source publishing from commercial-scale or infrastructure-driven publishing.

File count, release size, and release count are useful signals because they help identify sustained high-volume publishing patterns. They are not perfect measures of intent, which is why the soft-limit phase, Usage Center warnings, higher-limit requests, and exemption review process all exist.

Some projects may also be doing things that are unexpected or unusual — packaging extremely large artifacts, generating an unusually high number of files, or publishing at a release frequency that does not match typical community open source patterns. These metrics create an inspection point to start a conversation about what is actually going on. Maven Central operates at a scale that makes it impossible to inspect every project up front, so this process is designed to surface the cases that warrant a closer look.

Why does file count include signatures, checksums, source jars, javadocs, and related files?

Because the thresholds are derived from actual Maven Central publishing activity, the inclusion of these files should not affect any project disproportionately. Every publisher produces signatures, checksums, POMs, source jars, and javadocs — these files are part of what everyone publishes by definition, so they are already reflected in the usage data the thresholds are based on. The ratio of supporting files to primary artifacts is roughly consistent across the ecosystem, meaning the resulting limits are proportional regardless of how you count.

Counting only primary artifacts would also introduce ambiguity that is difficult to resolve consistently. It can be very hard to distinguish a main artifact from an attached artifact, and Maven Central supports many different packaging systems with different conventions. Files are straightforward to count, and because the limits are derived from real usage patterns rather than an arbitrary multiplier, the metric works fairly even if the raw number looks large.

What about SDKs, generated clients, agents, integrations, native binaries, or many platform variants?

These publishing patterns can produce high file counts, large release sizes, or frequent releases. Whether they fall under community open source review or Maven Central Publisher Pro depends on what the project is used for.

If the project is primarily community open source and not part of a commercial go-to-market motion, request higher limits or an exemption for review.

If the publishing supports a company's commercial distribution model, customer integrations, platform delivery, generated client strategy, agent distribution, or other business workflow, Maven Central Publisher Pro may be the appropriate path.

What happens to artifacts that are already published?

Already-published artifacts remain available under Maven Central's normal immutability model. Publishing limits do not remove existing artifacts when an organization approaches or exceeds a limit.

What happens if an organization stops paying for Maven Central Publisher Pro?

Already-published artifacts remain subject to Maven Central's normal immutability model. Stopping a paid plan does not remove previously published artifacts.

Future publishing capacity may be affected if the organization exceeds free limits and no paid option, higher limit, or exemption is in place.

Does this affect people downloading dependencies from Maven Central?

No. These publishing limits apply to publishing activity, not dependency consumption. Download-related rate limits and abuse controls are separate from publishing limits.

Does this mean Maven Central is no longer free?

No. Maven Central remains free for ordinary community open source publishing. Most community open source projects should not be affected.

The paid path is for organizations whose publishing activity regularly operates at commercial or infrastructure scale.

Will self-service Publisher Pro be available?

The intent is to provide a clearer path for organizations that need higher publishing capacity, including self-service options where appropriate. Organizations that already know they publish at commercial or infrastructure scale can contact Sonatype to discuss Maven Central Publisher Pro.

Who should I contact if I need help?

Start with the Usage Center. It shows your organization's publishing usage, thresholds, warnings, namespace-level details, and trends.

If you believe your community open source project needs higher limits or an exemption, or if your namespace grouping appears incorrect, contact central-support@sonatype.com with the relevant organization, namespaces, and details.

For commercial-scale publishing or Maven Central Publisher Pro, contact Sonatype to discuss the right path.

Still Need Help?⚓︎

If you are unsure whether your organization is affected, start with the Usage Center in Maven Central. It shows your organization's publishing activity across release size, file count, and release count.

If your usage appears incorrect, your namespaces are not organized as expected, or you believe your community open source project may need higher limits or an exemption, contact central-support@sonatype.com with the relevant organization, namespace, and a description of the issue.

For questions about higher-volume publishing capacity, Maven Central Publisher Pro, or commercial-scale publishing needs, contact Sonatype to discuss the right path for your organization.