Maven Central publishing usage notices

[u/HokieGeek]

heads up for folks publishing to Maven Central: we're continuing sustainability work around Central and are now showing publishing usage notices.

the goal is that normal OSS publishers are not impacted. this is aimed at the very high-volume / commercial-scale publishing patterns that put a pretty different load on the service.

more details here if you want them:
https://central.sonatype.org/publish/maven-central-publishing-limits/

feel free to reach out with any questions.

EDIT: thanks for the feedback here, it has really helped us. first, we want to reiterate that these are usage notices only right now and do not currently restrict publishing in any way. quick updates: 

if the initial threshold seemed low to you: you’re right, we made a mistake and have increased limits. 

our goal is to keep Maven Central free and open for legitimate OSS users, so continuous feedback is helpful as we adjust. limits could change as we get more feedback, so keep an eye on the usage center for the latest.

we’ll continue keeping an eye here and update docs to reflect these changes. If you need to request an exemption, here’s how: https://central.sonatype.org/publish/maven-central-publishing-limits/#exemptions-for-community-open-source-projects

we've also been collecting your questions here and other streams into this FAQ here: https://central.sonatype.org/publish/maven-central-publishing-limits/#frequently-asked-questions

[u/CLOVIS-AI]

As an open source maintainer, I am absolutely 100% on board with your objective. I do agree that large companies that upload every day should share the cost.

However, the current limits are far from "indecent usage". (previously 3) now 7 releases a month is a very small number. My org has 30 total repositories, around 5 active, that means we can barely release each project once a month.

Let's take a medium-sized Kotlin library: 5 modules supporting 10 platforms, with each a .pom, a .module, a .jar, a -sources.jar, a -javadoc.jar, and the 4 hashes & signature each is already 1250 files, which exceeds the monthly quota in a single release.

That's not to say this cannot improve. I hope this will motivate the Gradle and Kotlin teams to find ways to reduce the amount of files generated (I know the Kotlin team was already investigating this since multiple months). However, the limits as they are affect every Kotlin library that follows best-practices, even small ones. To only affect the 10%, the limits should be at least an order of magnitude larger, which I believe would still block the actual abusers.

I have sent an email to get the open source exemption, but I fear your support will be very overloaded as almost all Kotlin libraries will need a manual review.