What the vendor cannot host, you will maintain: ten years of Alibaba's published middleware

A decade of Alibaba's published middleware, for architects choosing which parts of their own system to delegate to a large company's components. The record shows the servers (registry, broker, coordinator) still shipping every year while the in-process libraries decelerated, stalled at alpha or went read-only with an unfixed critical defect, and it shows the property that predicts which is which. A reader can afterwards run a dependency-fate audit from public artefacts and put an operability test into their adoption process.

What you get out of it

• Placement, not popularity, predicted which published components kept being maintained: the servers a publisher can host kept a steady release cadence, while the libraries that run inside the adopter's process decelerated or stopped.
• Each fix in the serializer's nine-year advisory chain set the lower bound of the next advisory's affected range, which is a design verdict on the feature rather than a maintenance backlog.
• The governance specification that was supposed to move policy out of the in-process library has had no commit since 29 March 2023, and the library's README still refers readers to it.
• Externalising control created a second authentication problem: the registry's auth filter recognised peer servers by a client-supplied user-agent header (CVE-2021-29441, exploit-prediction score 83.483%).
• Features reserved for the paid edition, such as grayscale release and service warm-up, mark the capabilities the free library will not grow, which is the cheapest forward-looking signal an adopter has.

Scope

Why this, now. Two of this stack's long-lived in-process components reached their end states in 2026, one archived in July with a critical remote-code-execution advisory that records no patch, which makes the decade legible in a way it was not a year ago.

What it does not cover. Alibaba's internal systems, its databases, its model stack and the operation of Alibaba Cloud itself, plus all production telemetry: no request rates, no utilisation figures and no incident impact, because this session's network policy reached only code hosts and package registries.