POM Metadata

There are artifacts in the Central Maven repository that don't have POMs. They come from projects with repositories that have been synced into central without extra checks (particularly historical ones that were in Maven 1 format). We know about the problems but can't do anything unless you provide a POM for it or you ask the project in question to add the POM when they add the artifacts.

We don't change dependencies in POMs already in the repository anymore as builds need to be reproducible. Same applies to POMs that don't exist. We can only add a POM with no dependencies, because doing any other way would break previous builds that were using that artifact.

An alternative is to create a new version with the fixes. If the broken artifact is org.foo/bar/1.0 you can provide a fixed POM, JAR,... under org.foo/bar/1.0-1 (add a comment to the POM explaining what is being fixed and why). See Maven Repository Upload for the instructions to get this new version in the repository.

You need to contact the original publisher of the metadata to make sure in next versions it will be fixed or improved before getting it into the repository.

Other Issues

For any other types of issues related to metadata in the repository (POM related, or maven-metadata.xml, or anything else), open an issue at MVNCENTRAL with the relevant information and explain the reasons why it is an issue.

Important: by default assume that we won't trust your info, so you must provide all links to the project documentation you can to convince us that your solution is right.