[kevinherron]

Update org.sonatype.central:central-publishing-maven-plugin from 0.11.0 to 0.12.0 and the local Maven toolchain from 3.9.16 to 3.10.0.

The recent release failed after the GitHub runner moved to Maven 3.10: plugin 0.11.0 included local repository metadata in the Central bundle. Sonatype's release notes identify the fix in 0.12.0. Remove the release workflow's manual Maven 3.9.16 installation so publishing uses the runner-provided Maven again. Java remains at 17.

The plugin version is updated at the shared root POM property, covering both release and snapshot publishing. Maven 3.10.0 is set in .mise.toml; its migration notes were checked for validation, resolution, and credentials changes.

Applied versions

• org.sonatype.central:central-publishing-maven-plugin: 0.11.0 → 0.12.0.
• Apache Maven (org.apache.maven:apache-maven, managed through mise): 3.9.16 → 3.10.0.

Validation

All Maven commands ran through the repository's Maven command runner using Codex GPT 6.1 Sol with xhigh reasoning.

• Non-quiet root versions:display-dependency-updates and versions:display-plugin-updates reports passed before the upgrades. They reported no dependency updates and this one plugin update.
• mise exec -- mvn --version confirmed Maven 3.10.0 and Temurin 17.0.19+10.
• mise exec -- mvn -q --settings .github/maven-settings.xml -Prelease validate and the equivalent -Pdeploy-snapshot validate passed on Maven 3.10.0.
• mise exec -- mvn -q spotless:apply passed with no formatting changes.
• mise exec -- mvn -q clean compile passed.
• mise exec -- mvn -q clean verify passed on Maven 3.10.0: 6,285 tests, zero failures, zero errors, four skipped (6,258 Surefire tests and 27 Failsafe tests).
• A temporary standalone release POM ran plugin 0.12.0's publish goal on Maven 3.10.0 with skipUpload=true and no credentials. Its log confirmed removal of maven-metadata-local.xml, _remote.repositories, and .locks. The generated ZIP contained only the release POM and its four checksum files. Uploading was explicitly skipped.
• General-purpose review of the complete diff by Codex GPT 6.1 Sol with xhigh reasoning: APPROVED, no findings.
• git diff --check passed.

The repository-wide gates also passed on Maven 3.9.16 before the toolchain update. Actual artifact upload, signing, and Central validation were not exercised.

License CI

The license check on the updated head failed with an Eclipse Foundation HTTP 504 after about 60 seconds while querying 40 items. The initial head and its retry failed the same way. None produced a license-vetting verdict or an unvetted-license finding.

A main-branch run on October 16 queried 40 items and succeeded in about 1.3 seconds. The logs point to an external service timeout. The license gate is unchanged; its result remains unresolved until the service responds successfully.

Deferred upgrades

No applicable stable upgrades were deferred. Preserve the existing exclusions for Netty 4.2+, Checkstyle 13+, and prerelease versions. Maven Site Plugin remains at the existing 4.0.0-M9 version.

No overlapping Maven update PR was open. Local verification has no unresolved build failures.

Run date: 2026-10-19 (America/Los_Angeles). Worktree: /home/kevin/.t3/worktrees/milo/t3-e4b2b17b. Base: main at 6f500a0e75b96f70998206ee4b19692b97c89635.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates central-publishing-maven-plugin from 0.11.0 to 0.12.0 through the shared property in pom.xml.

• Release and snapshot publishing use plugin version 0.12.0.

_{Reviews (1) · Last reviewed commit: "Maven dependency updates 2026-10-19" · Reviewed by Greptile}