28

I just sync'd an artifact to Maven Central from oss.sonatype.org. Immediately after doing so, a problem was discovered (of course). I haven't announced the new artifact yet, it is very unlikely that anyone is using it yet, so I'd like to take it down before anyone starts using the broken version.

How can I remove a broken artifact from Maven Central?

ndmeiri
  • 4,979
  • 12
  • 37
  • 45
emmby
  • 99,783
  • 65
  • 191
  • 249

5 Answers5

30

Can't be done. It's A Rule. But if you want to try, contact the Sonatype people who support oss.sonatype.org. So you generally push a new, higher, version with the fix, and tell everyone to use it.

bmargulies
  • 97,814
  • 39
  • 186
  • 310
7

If you accidentally distributed an artifact which does not work or has bug or whatever the usual solution in Maven is to create a new version which fixes the problems. That's it. Deleting in Maven Central is not be done and shouldn't ever happen.

khmarbaise
  • 92,914
  • 28
  • 189
  • 235
  • 2
    The problem I have is that I've split packages or changed the group-id. It's not about a new release it's above removing out of date released in the wrong place in the repo hierarchy. – Gray Mar 13 '13 at 16:29
  • Simply as @bmargulies mentioned can't be done. That's it. Are we talking about maven central ? – khmarbaise Mar 13 '13 at 16:41
  • maven central, yes. I _have_ seen packages get deleted from there so I think this is more about sonatype then it is about limitations on the central. – Gray Mar 13 '13 at 16:44
  • I've never seen artifacts being deleted from Maven central. So do you have an example? May be only artifacts which have been deployed by particular groupId's ... might work. May be you can open a ticket for [Maven Central](https://docs.sonatype.org/display/Repository/Sonatype+OSS+Maven+Repository+Usage+Guide) – khmarbaise Mar 13 '13 at 16:49
  • Yeah some of the apache stuff has moved around over time. I've also seen older releases with security problems disappear. Doesn't happen often but it happens. – Gray Mar 13 '13 at 16:51
  • Counter-example: https://issues.sonatype.org/browse/OSSRH-33337 – Gili Mar 30 '20 at 14:53
3

It's hard to resist the urge to just release the staged repository (it's only a click away), but as suggested in the Sonatype OSS Usage Guide

You will want to download them and do some manual testing (or hold a community vote) before finally releasing them.

If it's the first time you've released, then you'll have to comment on your OSS Sonatype JIRA ticket to get Central synch activated. Presumably this is an opportunity to say "Wait! This artifact is broken. Please please please don't synch it to Maven Central!" :)

But as others have said, if it's released then it's too late - you'll have to release a new version (and ensure your users are aware not to use the broken one).

Beta releases are a good idea for new/major releases - people are a bit more forgiving if you've stuffed something up, and you don't lose your desired version number.

James Bassett
  • 9,458
  • 4
  • 35
  • 68
3

You can't remove an artifact from Maven Central because others might have used it already. Maven will not check for updates for non-snapshot versions of artifacts, so if someone has used the old version and a new version was uploaded, those people would never see the new version.

The workaround is to release a new version of your artifact.

prunge
  • 22,460
  • 3
  • 73
  • 80
-3

If you don't want to create a new version, another solution would be to push the fixed artifact under the same version.

gvlasov
  • 18,638
  • 21
  • 74
  • 110