中文
帮助我们保持 Maven Central 的可持续性：查阅新的发布限制，验证您的发布就绪状态，并对 CARE 政策草案提出意见。
确认您的发布就绪状态
软件供应链正进入一个漏洞发现可能急剧加速的时期。AI 辅助研究将使得以前所未有的规模识别开源组件中的问题成为可能，而这是整个生态系统此前从未需要承受的。限制因素将不仅仅是发现本身，还将包括验证、协调、修补以及在需要时快速发布修复版本的能力。
对于 Maven Central 的发布者而言，这意味着提前做好准备至关重要。
如果您的某个组件中发现了一个漏洞，特别是那些被广泛使用或作为传递性依赖深度嵌入的组件，那么能否快速发布一个干净的修复版本可能会变得至关重要。我们请求所有发布者现在就花时间确认自己已为发布做好准备，以免在出现时间紧迫的事件时措手不及。
请检查以下事项：
确保您的 Maven Central 发布凭证是最新的且可正常访问。
确认正确的人员仍然有权为您的命名空间进行发布。
验证您的签名密钥有效、可用，并且您当前的发布流程能够使用它们。
确认您的构建和发布自动化流程仍然工作正常。
如果您已超过一年或更长时间未发布，请在真正需要之前测试您的发布路径。
如果您的项目自旧版 OSSRH 发布流程迁移后尚未发布过，请确保您的构建已更新为适配当前的 Central 发布基础设施。
一些近期未发布过的发布者可能错过了从 OSSRH 到当前 Central 发布基础设施的过渡。如果您属于这种情况，现在是时候解决这个问题了——而不是在协调漏洞响应期间才来处理。
当前的发布文档可在此获取：Register to Publish Via the Central Portal - Documentation
关于登录的实用提示：Central 使用 Auth0 进行身份验证，支持多种登录方式，包括用户名/密码、Google 和 GitHub 社交登录。这些被视为独立的账户。如果您登录后没有看到您的命名空间，很可能是您之前使用了不同的登录方式或账户。在历史上，新系统出现之前，用户名/密码曾是唯一的登录机制，因此近期未登录过的发布者可能需要使用其原始账户，或联系 Central 支持团队来协调恢复访问权限。
发布限制
为了帮助保持 Maven Central 的健康、可持续性，并为整个生态系统提供可靠服务，我们将对前 10% 的高发布量维护者实施发布限制。大多数发布者不会受到此变更的影响，并且开源项目可以申请提高其限制额度。您可以在此阅读详细信息并了解更多：
查阅 Maven Central CARE 政策
我们还请求发布者查阅 Maven Central 的 CARE 政策。
CARE 代表 Central Approved Remediation for Emergencies（中央批准的紧急修复）。CARE 的目的是提供一个狭窄且受控的机制，以便在漏洞影响现有组件，而常规的维护者发布途径不可用、出现延迟或不足以应对所涉风险时，进行紧急修复。其意图是在保护生态系统的同时，保持坐标连续性，尊重维护者的权利，并将紧急权限严格限定在最小范围内。
请查阅最新的 CARE 政策，并使用政策顶部链接的反馈帖子提供您的意见：Draft Central Approved Remediation for Emergencies - CARE - Documentation
对维护者的支持
我们也认识到，一些维护者可能会对 AI 辅助漏洞发现带来的数量、复杂性或协调负担感到不堪重负。Maven Central 是关键软件供应链基础设施的一部分，我们与整个行业致力于解决这些问题的各个团体保持着联系，包括 OpenSSF、Akrites 以及其他协调修复工作。如果您正面临漏洞响应问题而不知道向何处求助，请告知我们。我们或许能够为您联系可以提供帮助的人员和资源。
如果您在恢复访问权限、更新发布设置、验证迁移路径、理清命名空间权限或寻找合适的修复资源方面需要帮助，请联系 Central 支持团队。
感谢您为保持 Maven Central 的可靠性、响应能力和为下一波修复工作做好准备所付出的努力。
Brian Fox
Sonatype 联合创始人兼首席技术官
英文
Help us keep Maven Central sustainable: Review the new publishing limits, verify your readiness to publish, and weigh in on the draft CARE policy.
Confirm Your Publishing Readiness
The software supply chain is entering a period where vulnerability discovery is likely to accelerate sharply. AI-assisted research will make it possible to identify issues across open source components at a scale the ecosystem has not previously had to absorb. The limiting factor will not be discovery alone. It will be validation, coordination, patching, and the ability to publish fixed versions quickly when they are needed.
For Maven Central publishers, that means preparation matters.
If a vulnerability is found in one of your components, especially one that is widely used or deeply embedded as a transitive dependency, the ability to publish a clean fix quickly may become critical. We are asking all publishers to take time now to confirm that they are ready to publish before there is a time-sensitive incident.
Please review the following:
- Make sure your Maven Central publishing credentials are current and accessible.
- Confirm that the right people still have access to publish for your namespaces.
- Verify that your signing keys are valid, available, and usable by your current release process.
- Confirm that your build and release automation still works.
- If you have not published in the last year or longer, test your publishing path before you need it.
- If your project has not published since the move away from the legacy OSSRH publishing flow, make sure your build is updated for the current Central publishing infrastructure.
Some publishers who have not released recently may have missed the transition from OSSRH to the current Central publishing infrastructure. If that applies to you, now is the time to sort it out — not during a coordinated vulnerability response.
Current publishing documentation is available here: Register to Publish Via the Central Portal - Documentation
A practical note on login: Central uses Auth0 for authentication, and multiple login methods are available, including username/password, Google, and GitHub social login. These are treated as separate accounts. If you log in and do not see your namespaces, it is likely that you previously used a different login method or account. Historically, username/password was the only mechanism before the new system, so publishers who have not logged in recently may need to use their original account or work with Central Support to reconcile access.
Publishing Limits
To help keep Maven Central healthy, sustainable, and reliable for the entire ecosystem, we are implementing publishing limits on the top 10% of high-volume maintainers. Most publishers will not be affected by this change and OSS projects can request their limits to be extended. You can read the details and learn more here:
Review the Maven Central CARE Policy
We are also asking publishers to review the Maven Central CARE policy.
CARE stands for Central Approved Remediation for Emergencies. The purpose of CARE is to provide a narrow, controlled mechanism for emergency remediation when a vulnerability affects an existing component and the ordinary maintainer publication path is unavailable, delayed, or insufficient for the risk involved. The intent is to help protect the ecosystem while preserving coordinate continuity, respecting maintainer rights, and keeping emergency authority tightly scoped.
Please review the latest CARE policy and provide feedback using the feedback thread linked at the top of the policy: Draft Central Approved Remediation for Emergencies - CARE - Documentation
Support for Maintainers
We also recognize that some maintainers may be overwhelmed by the volume, complexity, or coordination burden of AI-assisted vulnerability discovery. Maven Central is part of critical software supply chain infrastructure, and we are connected with groups across the industry working on these issues, including OpenSSF, Akrites, and other coordinated remediation efforts. If you are facing a vulnerability response problem and do not know where to turn, let us know. We may be able to connect you with people and resources that can help.
If you need help restoring access, updating your publishing setup, validating your migration path, sorting out namespace permissions, or finding the right remediation resources, please contact Central Support.
Thank you for helping keep Maven Central reliable, responsive, and ready for the next wave of remediation work.
Brian Fox
Co-founder & CTO, Sonatype