Blogs

A long time connection of mine recently asked on the community slack:

Do you know how we can force maven central to update the Liferay artifacts?

Example here : https://mvnrepository.com/artifact/com.liferay.portal/release.dxp.bom

We see no new version since 1 month. We are waiting for 2025.q1.16 and 2025.q1.17...

My client has a proxy for maven artifact and do not authorize other sources than Maven Central.

If you’ve ever wondered why Maven Central doesn’t always have the latest or expected Liferay artifacts, you’re not alone. We’ve run into two persistent issues: (1) artifacts are delayed in appearing on Maven Central, and (2) sometimes the artifacts that do appear are different than the ones we host ourselves. Let’s break this down together.

1. Why are our artifacts late on Maven Central?

Here’s the situation: when we publish a new release, we push it first to our own repository. Only later—sometimes hours, sometimes days—do those artifacts make their way to Maven Central through a sync process that we don’t control. That means there’s always a lag between when we cut a release and when it’s available on Maven Central.

From your perspective, that can be frustrating. You hear “the new version is out!” but when you try to pull it from Maven Central, nothing’s there yet. Unfortunately, that delay isn’t something we can change—it’s a quirk of how the synchronization process works on their side.

2. Why are Maven Central artifacts sometimes different?

The second issue is a bit trickier. Occasionally, we discover a problem with an artifact (for example, a BOM file) after it has been published. In those cases, we fix the artifact and republish it to our repository.

Here’s where Maven Central’s policy comes in. As they told us directly:

“Unfortunately, our sync process doesn’t overwrite already synced artifacts. For details on this long-standing policy, have a look here: https://central.sonatype.org/faq/can-i-change-a-component/”

In other words, once something has been synced to Maven Central, it’s locked in. Even if we fix it, the corrected version never makes it there. That means Maven Central may host an outdated or buggy version, while our repository has the right one. This isn’t about negligence on our part—it’s simply how the system is set up.

3. Why you should use the Liferay repository

So, what’s the best path forward? Simple: use our repository.

Our repo is always up to date the moment we release. If we need to push a fix, it’s there immediately—no waiting, no sync delays. On top of that, because we control it directly, it’s much safer from a supply chain perspective. We can guarantee that what you’re getting is exactly what we published, not something stuck in a middleman’s cache.

If you’re running in production or building tooling around Liferay, we strongly recommend configuring your builds to use repository-cdn.liferay.com. In fact, we’ve already made this the default behavior in Liferay Workspace, so if you’re using that, you’re set. But if not, this is a good time to convince your clients, teams, or operations folks to add / approve our repo alongside Maven Central.

Trust me—you’ll save yourself some headaches, get fixes faster, and sleep better knowing your builds are more secure.