Release request: ship Maven credential origins (#1282). Maven 3.10 breaks Central snapshot deploys #1284

Request

Please cut a release (v6.0.2, or v6.1.0 if you prefer a minor bump for a new input) that contains #1282 (mvn-server-repository-origins, merged 2026-10-07 as 2a69be2). The latest release, v6.0.1 (2026-09-09), does not contain it.

Why it is urgent

The GitHub-hosted runner images now ship Maven 3.10.0. It only sends a settings.xml server's credentials to the hosts tied to that server id (release notes). The id central, which is the central-publishing-maven-plugin default and what most projects pass as server-id, is already tied to https://repo.maven.apache.org by Maven's built-in central repository. So Maven withholds the token from https://central.sonatype.com and every snapshot deploy fails:

[WARNING] Not using credentials of server 'central' for repository https://central.sonatype.com/repository/maven-snapshots: the origins declared for this id are [https://repo.maven.apache.org]. Add 'https://central.sonatype.com' to <repositoryOrigins> of that server in settings ...
[ERROR] Failed to execute goal org.sonatype.central:central-publishing-maven-plugin:0.8.0:publish ... Could not transfer artifact ... from/to central (https://central.sonatype.com/repository/maven-snapshots/): HTTP Status: 401

With the released versions, projects can only:

• add -Dmaven.repository.credentialScope=id, which switches off the new protection, or
• overwrite the settings.xml this action generates with a hand-written one.

#1282 is the clean fix, but nobody can use it without pinning an unreleased commit of main in a job that holds publishing secrets.

Affected projects (from the references on #1282)

• deploy-to-maven-central keeps failing pmd/pmd#7153, Fix #7153: Add -Dmaven.repository.credentialScope=id to ./mvnw deploy pmd/pmd#7155
• Fix snapshot deploy 401 on Maven 3.10 graphql-java-kickstart/graphql-java-tools#840, Declare central.sonatype.com as a repository origin once setup-java supports it graphql-java-kickstart/graphql-java-tools#841 (waiting for a release)
• Declare Sonatype credential origins once setup-java releases support eaftan/safere#999 (waiting for a release), Fix Central publishing credential lookup on Maven 3.10 eaftan/safere#1000
• Restore id-only credential matching for the CI deploy gephi/graphstore#305
• CI: pass -Dmaven.repository.credentialScope=id to every deploy (Maven 3.10) bernardladenthin/BitcoinAddressFinder#378, Fix snapshot deploy 401 on Maven 3.10; upgrade llama.cpp to b11476 bernardladenthin/java-llama.cpp#482, CI: pass -Dmaven.repository.credentialScope=id to every deploy (Maven 3.10) bernardladenthin/srcmorph#215, CI: pass -Dmaven.repository.credentialScope=id to every deploy (Maven 3.10) bernardladenthin/streambuffer#171
• Eclipse projects, e.g. eclipse-daanse (all repos, via a shared deploy workflow) and osgi/org.osgi.util.converter

Most of these merged the credentialScope=id workaround and are waiting for a release to switch to:

server-id: central
server-username-env-var: MAVEN_USERNAME
server-password-env-var: MAVEN_PASSWORD
mvn-server-repository-origins: |
  central:https://central.sonatype.com

Thanks for the quick fix in #1282. A release would let all of these projects move off the workaround.