https://cybertoolchain.io/tools/sonatype New releases and features in Sonatype, tracked by The Cyber Toolchain. en Fri, 26 Jun 2026 00:00:00 GMT https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536396 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536396 Fri, 26 Jun 2026 00:00:00 GMT Adds native OCI repos and AWS ECR proxy support to Nexus Repository Cloud • Added `native OCI` hosted, proxy, and group repository types. • Added `AWS ECR` support within Docker proxy repositories for centralized image caching. Breaking changes: • The `Content Disposition` setting is removed for Maven and Raw repositories in cloud deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536425 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536425 Wed, 03 Jun 2026 00:00:00 GMT Nexus Repository Cloud adds Docker pull command generation, Conan V2 defaults, and exclusive URL encoding via Preserve Encoded Characters. • Generates docker pull commands that correctly reference your Sonatype Nexus Repository registry • Adds `Preserve Encoded Characters` setting in each proxy repository's configuration to control URL encoding exclusively • Conan proxy repositories now default to Protocol Version V2 and set Remote Storage URL example to https://center2.conan.io Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-93-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--721028 https://help.sonatype.com/en/sonatype-nexus-repository-3-93-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--721028 Mon, 01 Jun 2026 00:00:00 GMT Adds Go, Ansible Galaxy, and Alpine repo support; new User Token API lookup, OAuth2/OIDC REST API, uploader metadata permissions, IP Allow List, auth rate limits, and HPA Hel • Support for Go Hosted and Group Repositories • Support for Ansible Galaxy repository format • Support for Alpine Repository Format • New nameCode Parameter in User Token API to look up user token ownership • Granular Control of Uploader Metadata Visibility via `nexus:uploader-metadata:read` permission • Enhanced PyPI Repository Compatibility with PEP 658 inline metadata and PEP 691 JSON-based Simple API • New Endpoints in Security management: user roles API for programmatic role assignment management • IP Allow List feature available in Pro and Cloud editions to restrict access by source IP • OAuth2/OIDC Configuration REST API for managing authentication settings via REST • Authentication Attempt Rate Limits with `nexus.auth.ratelimit.*` configuration properties • Expanded Enterprise Deployment Options for Kubernetes supporting Helm chart 93.0.0+ with HPA and Azure Workload Identity Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536441 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536441 Wed, 27 May 2026 00:00:00 GMT Nexus Repository Cloud adds dynamic upstream service discovery for Terraform proxy repositories. • `Terraform proxy` repositories now `dynamically detect upstream service discovery paths`, improving compatibility with compliant registries such as OpenTofu registries and registry.coder.com Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536455 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536455 Thu, 21 May 2026 00:00:00 GMT Nexus Repository Cloud adds Alpine APK support, dynamic Terraform proxy discovery, immediate session invalidation on password change, and UUID v4 API keys. • Adds `steps` for Alpine Linux (APK) repository support (hosted, proxy, group types) with APKINDEX generation and RSA-based index signing • Terraform proxy repositories now dynamically read service discovery paths from upstream registries • Password change immediately invalidates all active sessions across devices and browsers • API keys for NuGet, npm, Docker, and Conan formats now use UUID v4 generation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536474 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536474 Wed, 13 May 2026 00:00:00 GMT Nexus Repository Cloud adds GO/Ansible repo support, new User Token API parameter, and uploader metadata permission. • Adds `nameCode` parameter to the User Token API to identify a token's owner and authentication realm by token name code • Adds a new `nexus:uploader-metadata:read` permission to control access to asset uploader usernames and IP addresses in the REST API and browse UI • Added support for GO hosted and group repositories • Added support for Ansible proxy, hosted, and group repositories Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536493 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536493 Fri, 08 May 2026 00:00:00 GMT New IAM API endpoints for programmatic role management; IP Allow List GA; H2 source support in Instance Migrator • Added new Security management user roles API endpoints (get, replace, add, remove) to allow administrators to programmatically manage user role assignments in cloud deployments • The IP Allow List feature is now generally available in Sonatype Nexus Repository Pro and Cloud editions • The Instance Migrator now supports H2 databases as a migration source Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html#what-s-new-and-noteworthy-in-3-92-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html#what-s-new-and-noteworthy-in-3-92-0- Thu, 07 May 2026 00:00:00 GMT Nexus Repository 3.92.0 adds Nexus One UI toggle, Dart/Flutter/Conda/Helm repo support, SSRF API, and Firewall webhooks. • Adds `Settings > System > Nexus One UI` toggle to preview the redesigned user interface • Adds Pub repository type for Dart and Flutter package management • Adds hosted and group repository support for Conda packages • Adds Helm group repository support for exposing multiple Helm repos via a single URL • Updates Instance Migrator to support migrating Swift, Terraform, and Conda hosted repositories • Exposes HikariCP database connection pool metrics via the Service Metrics Data API • Enables SSRF protection by default for new installations and adds an administrative API endpoint for managing it • Retains daily storage metrics indefinitely in the Usage Insights dashboard • Adds webhook support for Sonatype Repository Firewall events • Adds Bulk Waivers capability and associated API for managing quarantined components Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536517 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536517 Wed, 29 Apr 2026 00:00:00 GMT Adds Nexus One UI preview and PEP 658/691 support to PyPI proxy repos • Enables `Switch to Nexus One UI` toggle for preview of new interface (requires enabling via `Settings > System > Nexus One UI`) in v3.92.0+ • Adds PEP 658 and PEP 691 JSON API support to PyPI proxy repositories, caching responses for performance Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536532 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536532 Wed, 22 Apr 2026 00:00:00 GMT Adds Instance Migrator for migrating Swift repositories between Nexus Repository instances • Enables migration of Swift repositories (including package archives and manifests) between Nexus Repository Cloud instances via the new Instance Migrator feature. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536541 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536541 Mon, 20 Apr 2026 00:00:00 GMT New Dart/Conda/Helm repo support, SSRF protection API, and migration updates in Nexus Repository Cloud • Adds Dart (pub) package format support. • Adds `Conda` hosted and group repository support. • Adds `Helm` group repository support for aggregating multiple Helm repositories (disabled by default; configurable via system property). • The Instance Migrator now supports migrating Terraform and Conda hosted repositories between Nexus Repository instances. • Usage Insights dashboard retains daily storage metrics indefinitely. • Adds an admin REST API (`GET`/`PUT /v1/security/ssrf-protection`) for managing SSRF protection settings dynamically. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-90-0-release-notes.html#what-s-new-in-3-90-3- https://help.sonatype.com/en/sonatype-nexus-repository-3-90-0-release-notes.html#what-s-new-in-3-90-3- Wed, 08 Apr 2026 00:00:00 GMT Sonatype Nexus Repository 3.90.3 adds skipProcessing to BlobRepositoryMismatchTask • Added `skipProcessing` configuration option to `BlobRepositoryMismatchTask` for eligible direct upgrades Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-91-0-release-notes.html#what-s-new-and-noteworthy-in-3-91-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-91-0-release-notes.html#what-s-new-and-noteworthy-in-3-91-0- Tue, 07 Apr 2026 00:00:00 GMT Sonatype Nexus Repo 3.91 adds Swift group repos, global firewall webhooks, and Alpine Docker default. • Adds support for Swift group repositories to aggregate multiple Swift package sources into a single endpoint • Adds global webhooks in Repository Firewall to notify systems when components are quarantined or blocked due to policy violations • Updates Docker image tagging strategy to make Alpine-based images the default variant for tags 3.91.0, 3.91.0-alpine, and latest Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536574 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536574 Wed, 25 Mar 2026 00:00:00 GMT Nexus Repository Cloud March 25 adds Instance Migrator for OrientDB migration and Yum metadata regeneration. • Added `Instance Migrator` to migrate OrientDB-based Nexus Repository 3.70.5 instances to Nexus Repository Cloud or self-hosted Nexus Repository version 3.90.2+ • Yum repository migrations now automatically regenerate repository metadata, including `repomd.xml` and associated `.xml.gz` files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-70-0-release-notes.html#what-s-new-in-3-70-5- https://help.sonatype.com/en/sonatype-nexus-repository-3-70-0-release-notes.html#what-s-new-in-3-70-5- Mon, 23 Mar 2026 00:00:00 GMT Release 3.70.5 adds the Instance Migrator feature for seamless migration of self-hosted Nexus Repository data and configuration to Cloud or newer self-hosted versions. • Release 3.70.5 adds the Instance Migrator feature for seamless migration of self-hosted Nexus Repository data and configuration to Cloud or newer self-hosted versions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-90-0-release-notes.html#what-s-new-in-3-90-2- https://help.sonatype.com/en/sonatype-nexus-repository-3-90-0-release-notes.html#what-s-new-in-3-90-2- Mon, 23 Mar 2026 00:00:00 GMT New Instance Migrator enables zero-downtime migration from Nexus Repository 3.70.5 to Cloud or 3.90.2+ • Adds the `Instance Migrator` tool for migrating OrientDB-based Nexus Repository 3.70.5 deployments to Nexus Repository Cloud or self-hosted 3.90.2+ without service interruption. • Preserves hosted repository content, configurations, users, roles, and authentication mappings during migration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536599 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536599 Wed, 11 Mar 2026 00:00:00 GMT Nexus Repository Cloud adds Swift group repositories to aggregate multiple Swift package sources. • Adds support for Swift group repositories to aggregate multiple Swift package sources into a single endpoint. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-90-0-release-notes.html#what-s-new-in-3-90-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-90-0-release-notes.html#what-s-new-in-3-90-0- Thu, 05 Mar 2026 00:00:00 GMT Sonatype 3.90 adds Terraform group repos, Swift hosted repos, Recovery Mode, User Token API, and PCCS visibility. • `Support for Terraform group repositories` aggregates multiple Terraform hosted/proxy repos into a single endpoint with configurable TTLs and conflict resolution. • `Support for Swift hosted repositories` enables publishing and managing Swift packages as .zip files with MIME type validation. • `New Recovery Mode` provides a controlled operational state to prevent background tasks from interfering with data repair operations. • `Re-enabled Repair - Execute Data Repair Plan task` is now active by default, restoring the data reconciliation workflow. • `New User Token API` allows administrators to create, view, and delete user tokens via API endpoints. • `sonatype_filtered_versions` field in npm metadata exposes versions filtered out by Repository Firewall policies (PCCS). • `Granular Permissions for Log Management API` introduces `nexus:logging:read` permission and `nx-logging-read` privilege, removing the need for broad `nexus:*` access. Breaking changes: • Removed Legacy Application Health Check plugin and Hosted Repository Analysis capabilities (self-hosted only). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536608 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536608 Wed, 04 Mar 2026 00:00:00 GMT Nexus Repository Cloud adds global webhooks for Repository Firewall quarantine events • Repository Firewall now supports global webhooks for quarantine events Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536617 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536617 Wed, 25 Feb 2026 00:00:00 GMT Swift/Terraform repo support and User Token API (CRUD) added to Nexus Repository Cloud. • Adds `Swift` hosted repository format • Adds `Terraform` group repository format • Adds `POST /api/admin/users/tokens`, `GET /api/admin/users/tokens`, and `DELETE /api/admin/users/tokens/{id}` endpoints for User Token API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536630 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536630 Wed, 11 Feb 2026 00:00:00 GMT Sonatype Nexus Repository Cloud enables proxy URL validation by default and adds quarantine audit logging to Sonatype Repository Firewall. • `proxy.url.validation` is enabled by default to block outbound connections to private network addresses, localhost, and cloud metadata endpoints • Sonatype Repository Firewall writes `firewall.quarantine` audit log events when components are newly quarantined or when users attempt to download already quarantined components (requires self-hosted IQ version 201 or Sonatype Lifecycle Cloud) Breaking changes: • Outbound connections to private network addresses, localhost, and cloud metadata endpoints are now blocked by default unless `proxy.url.validation` is explicitly disabled or configured. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536644 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536644 Wed, 04 Feb 2026 00:00:00 GMT Sonatype Nexus Repository Cloud adds sonatype_filtered_versions field to PyPI package metadata • Adds `sonatype_filtered_versions` field to PyPI package metadata when versions are filtered. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-89-0-release-notes.html#what-s-new-and-noteworthy-in-3-89-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-89-0-release-notes.html#what-s-new-and-noteworthy-in-3-89-0- Tue, 03 Feb 2026 00:00:00 GMT Nexus Repository 3.89.0 adds Swift proxy format support, hosted Terraform repositories, and expanded Terraform authentication options. • Adds `Swift` proxy repository format to integrate Swift Package Manager (SPM) workflows • Adds `Terraform` hosted repository format for distributing versioned source archives, platform-specific binaries, and providers as .zip files • Enables anonymous access to `Terraform` repositories when enabled Breaking changes: • SAML login fails if the SAML2_AUTH_REQUEST cookie is blocked by browser or infrastructure policies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536654 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536654 Wed, 28 Jan 2026 00:00:00 GMT Sonatype Nexus Repository Cloud adds Swift proxy and Terraform hosted repository support. • Adds Swift proxy repositories for caching external Swift package registries • Adds Terraform hosted repositories for storing private provider modules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-88-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--539187 https://help.sonatype.com/en/sonatype-nexus-repository-3-88-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--539187 Tue, 13 Jan 2026 00:00:00 GMT Nexus Repository 3.88.0 adds Terraform proxy repos, SQL search, new APIs/configs for capabilities and security • Adds proxy repository support for Terraform to cache providers and modules from registry.terraform.io • Replaces Elasticsearch with SQL database for all search operations to improve consistency and simplify deployment • Adds `GET /v1/capabilities/types` API endpoint to programmatically retrieve capability types and metadata • Introduces `Repository: Browse Trim` capability and `Repair - Repository trim browse tree` task to manage empty browse nodes • Adds `nexus.security.password.iterations` and `nexus.security.secrets.iterations` config keys in `nexus.properties` to control PBKDF2 encryption strength • Adds optional URL validation for SSRF protection via `nexus.proxy.allowPrivateNetworks=false` config key in `nexus.properties` Breaking changes: • The `Repair - Execute Data Repair Plan` task is disabled by default and fails if attempted, requiring `nexus.reconcile.task.enabled=true` to re-enable manually until support is restored • SAML authentication now strictly requires the `entityId` in the IdP response to match the `entityId` configured in Nexus Repository Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536673 https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html#id536673 Fri, 09 Jan 2026 00:00:00 GMT Nexus Repository Cloud adds support for Terraform proxy repository format. • Adds `Terraform proxy repository format` to allow Nexus Repository Cloud to proxy Terraform registry content. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-87-0-release-notes.html#what-s-new-and-noteworthy-in-3-87-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-87-0-release-notes.html#what-s-new-and-noteworthy-in-3-87-0- Tue, 02 Dec 2025 00:00:00 GMT Nexus Repository 3.87 adds NuGet Release Integrity via Firewall, new Configuration API, and OAuth2/JWT auto-enablement. • Repository Firewall now provides Release Integrity protection for NuGet components • New Configuration API allows programmatic export/import of repository configuration and metadata migration between instances • OAuth2 realm is automatically enabled when `nexus.jwt.enabled` is set to `true` in Pro Breaking changes: • Java 21 is now the minimum required Java version; older versions will fail to run. • AWS SDK for S3 blob stores upgraded from 1.x to 2.33.5, making non-AWS S3-compatible storage (e.g., Dell) incompatible. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-86-0-release-notes.html#what-s-new-and-noteworthy-in-3-86-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-86-0-release-notes.html#what-s-new-and-noteworthy-in-3-86-0- Wed, 05 Nov 2025 00:00:00 GMT Sonatype Nexus Repository 3.86.0 adds OIDC SSO, license expiry alerts, SAML user REST API, and OCI Docker scanning support • Adds OpenID Connect (OIDC) authentication for Single Sign-On integration with providers like Okta, Keycloak, and Azure AD • Adds License Expiry Notification capability to send email alerts before Pro license expiration • Adds new REST API endpoints for managing SAML-backed user records in Nexus Repository Pro and Cloud • Adds Firewall for Docker Scanning support for OCI-compliant images including multi-architecture manifest lists and uncompressed layers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-85-0-release-notes.html#what-s-new-and-noteworthy-in-3-85-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-85-0-release-notes.html#what-s-new-and-noteworthy-in-3-85-0- Tue, 07 Oct 2025 00:00:00 GMT Nexus Repository Cloud adds predictable S3 bucket URLs; Firewall API standardizes `/api/v2/firewall/` paths. • Adds predictable S3 bucket URL format for binary downloads in Nexus Repository Cloud to simplify outbound traffic configuration • Standardizes Firewall API endpoint path to `/api/v2/firewall/` for all non-malware endpoints Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-84-0-release-notes.html#what-s-new-and-noteworthy-in-3-84-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-84-0-release-notes.html#what-s-new-and-noteworthy-in-3-84-0- Tue, 09 Sep 2025 00:00:00 GMT Sonatype Nexus Repository 3.84.0 adds OCI manifest and RPM support in Container Scanning, plus HA concurrency improvements. • `Sonatype Repository Firewall` now supports container images using the OCI Image Manifest Specification and Linux distributions with RPM package formats for scanning. • High availability deployments handle concurrent requests for the same asset more reliably by reducing transient read failures on blob attributes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-83-0-release-notes.html#what-s-new-in-3-83-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-83-0-release-notes.html#what-s-new-in-3-83-0- Tue, 12 Aug 2025 00:00:00 GMT Sonatype Nexus 3.83.0 adds container policy enforcement via Firewall, path-based Docker routing, configurable password hashing, and a new data consistency repair task. • Adds automated detection and quarantine of non-compliant Docker images through Repository Firewall with a new `Containers` dashboard for violations. • Adds support for Docker Registry path-based repository routing to simplify deployment without custom subdomains. • Adds configurable password hashing algorithms (`SHA-512`, `PBKDF2WithHmacSHA256`, `PBKDF2WithHmacSHA1`) and secrets encryption options. • Adds a new `Verify and Repair Data Consistency` task to recover missing component metadata, with support for scoping by blob store/repository and a `Dry Run` option. • Removes legacy `Repair - Reconcile component database from blob store` task in favor of the new consistency task. Breaking changes: • The legacy `Repair - Reconcile component database from blob store` task is removed; any scheduled tasks using this name are automatically deleted during upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-82-0-release-notes.html#what-s-new-and-noteworthy-in-3-82-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-82-0-release-notes.html#what-s-new-and-noteworthy-in-3-82-0- Wed, 09 Jul 2025 00:00:00 GMT Sonatype Nexus Repository 3.82.0 adds a new Capabilities API for programmatic management and improves quarantine message clarity. • Introduces the `Capabilities API` allowing administrators to programmatically view, create, update, and delete Capabilities via automation • Improves quarantine message behavior in CLI output for npm and NuGet formats when a component is blocked by Repository Firewall Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-81-0-release-notes.html#what-s-new-in-nexus-repository-3-81-1- https://help.sonatype.com/en/sonatype-nexus-repository-3-81-0-release-notes.html#what-s-new-in-nexus-repository-3-81-1- Wed, 11 Jun 2025 00:00:00 GMT Nexus Repository 3.81.1 moves metrics endpoints to /service/rest/metrics and fixes NuGet restore. • Moves all metrics REST API endpoints under the `/service/rest/metrics` prefix (e.g., `/service/rest/metrics/prometheus`, `/service/rest/metrics/data`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-81-0-release-notes.html#what-s-new-in-nexus-repository-3-81-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-81-0-release-notes.html#what-s-new-in-nexus-repository-3-81-0- Tue, 10 Jun 2025 00:00:00 GMT Nexus Repository 3.81.0 adds egress monitoring in Licensing Usage tab and Zscaler integration for Repository Firewall. • Adds Total Egress data to the Usage tab under Settings > System > Licensing for on-prem instances • Integrates Sonatype Repository Firewall with Zscaler for malware protection Breaking changes: • Dropwizard metrics `org_eclipse_jetty_webapp_WebAppContext_2xx_responses_total` are removed and replaced by `org_eclipse_jetty_ee8_nested_ContextHandler_CoreContextHandler_2xx_responses_total` and `org_eclipse_jetty_ee8_nested_ContextHandler_CoreContextHandler_requests_count` • Customized Jetty configuration must be updated due to the upgrade from Jetty 9 to Jetty 12 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-80-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--329581 https://help.sonatype.com/en/sonatype-nexus-repository-3-80-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--329581 Tue, 06 May 2025 00:00:00 GMT Nexus Repo 3.80 adds Hugging Face support for Firewall, Usage Center HA visibility, and new compact blob store task. • Adds `Hugging Face` component analysis to Sonatype Firewall (requires IQ 191) • Adds `Admin - Compact blob store` task with `Blob Older Than` property for S3 cleanup • Makes `Usage Center` accessible in UI for High Availability deployments • Adds `Historical Usage` table under the `Licensing > Usage` section Breaking changes: • Renamed logging module from `nexus-pax-logging` to `nexus-logging`; custom Jetty configs referencing `org.sonatype.nexus.pax.logging` will break unless updated to `org.sonatype.nexus.logging` • Removed `Expiration Days` setting from S3 blob store configuration; cleanup now requires the `Admin - Compact blob store` task Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-79-0-release-notes.html#what-s-new-in-nexus-repository-3-79-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-79-0-release-notes.html#what-s-new-in-nexus-repository-3-79-0- Tue, 01 Apr 2025 00:00:00 GMT Nexus 3.79.0 adds Malware Defense Evaluation and Firewall REST APIs, plus AWS S3 pre-signed URL support for Pro users. • Adds the `GET /service/rest/malware/evaluate` API for on-demand malware checks against threat intelligence, returning `attackVector` and `threatTypes` fields (requires IQ Server 189+) • Adds the Firewall REST API endpoints to manage protected namespaces for Namespace Confusion mitigation, including wildcard support and a `DELETE` method to clear all protected namespaces for a format • Enables pre-signed URL downloads for AWS S3 blob stores in Nexus Repository Pro to bypass server load for large binary artifacts Breaking changes: • Firewall Classic is sunset and replaced by Sonatype Repository Firewall Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-78-0-release-notes.html#what-s-new-in-3-78-0-- https://help.sonatype.com/en/sonatype-nexus-repository-3-78-0-release-notes.html#what-s-new-in-3-78-0-- Tue, 04 Mar 2025 00:00:00 GMT Sonatype Nexus Repository 3.78.0 introduces ARM Docker images, Spring Boot migration, npm Firewall integration, and removes legacy components • ARM Docker images now available for deployment on ARM infrastructure alongside existing x86_64 versions • npm Audit security enhanced with full Sonatype Repository Firewall integration for npm versions 7 and 8 • Nexus Repository migrates to Spring Boot architecture packaged as a single uber-jar, dropping Apache Karaf/OSGi support Breaking changes: • Custom OSGi bundle deployment is no longer supported due to the migration from Apache Karaf to Spring Framework • The `jetty-rewrite` module is removed during the upgrade to Jetty 12, invalidating any customizations in jetty config files • The Log4J Visualizer feature has been removed and is no longer available • The Bower format has been officially sunset and is no longer supported Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-77-0-release-notes.html#what-s-new-in-3-77-0-- https://help.sonatype.com/en/sonatype-nexus-repository-3-77-0-release-notes.html#what-s-new-in-3-77-0-- Tue, 04 Feb 2025 00:00:00 GMT Nexus Repository 3.77.0 adds Hugging Face proxy repos, automatic malware removal tasks, Conan v2 replication, Helm staging for Pro, and EULA API. • Adds `Hugging Face Proxy` repository format to manage and cache pre-trained AI/ML models • Adds `Automatic Malware Management` task configuration to automatically remove detected malware from proxy repositories (Pro only) • Adds Content Replication support for `Conan v2` format in Pro edition • Adds Helm staging functionality for Pro customers using H2 or PostgreSQL databases • Adds status check alert for deployments using embedded `H2` database when usage exceeds recommended limits • Adds new EULA REST API endpoint to accept Community Edition End User License Agreement during upgrade Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-76-0-release-notes.html#what-s-new-in-3-76-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-76-0-release-notes.html#what-s-new-in-3-76-0- Tue, 07 Jan 2025 00:00:00 GMT Sonatype Nexus Repository 3.76.0 adds native Conan 2.0 support, a Malware Remediation task, and auto-populated GCP blob store region. • Adds `Conan 2.0` format support for C/C++ package management in Nexus Repository Pro • Adds a dedicated `Malware Remediation` task to inspect proxy repositories for malicious components • Automatically detects and populates the region field when creating new GCP blob stores Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-75-0-release-notes.html#what-s-new-in-3-75-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-75-0-release-notes.html#what-s-new-in-3-75-0- Tue, 03 Dec 2024 00:00:00 GMT Nexus Repository 3.75.0 adds native PHP/Composer proxy support, Google Cloud KMS for GCS blob stores, and explicit Cargo auth control. • Adds native Proxy PHP/Composer repository support to Nexus Repository Pro, enabling storage and retrieval of Composer components alongside other dependencies. • Adds option to enable Google Cloud Key Management Service (KMS) encryption for new Google Cloud Storage (GCS) blob stores by providing a KMS Key ID. • Adds `Hide` button to the Malware Warning banner to dismiss it during the current session. • Improves Cargo package browsing in the UI by extracting and displaying attributes (name, license, authors, vendor, description, version, homepage) from `cargo.toml` files. • Adds new checkbox `Restrict repository content to authenticated users` for Cargo proxy and group repositories that sets `auth-required: true` in `/config.json` responses. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-74-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--275280 https://help.sonatype.com/en/sonatype-nexus-repository-3-74-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--275280 Tue, 05 Nov 2024 00:00:00 GMT GCP HA support, blob store enhancements, and expanded Conan search capabilities in Nexus Repository 3.74.0. • Adds Google Cloud Platform support for highly available Nexus Repository deployments on GKE (Pro Only) • Adds native Google Cloud Blob Store support for artifact storage (Pro Only) • Enables automatic license distribution across clustered deployments via REST API or UI • Allows definition of custom region lists for AWS Blob Store configuration • Supports AWS S3 failover buckets for cross-region high availability (Pro Only) • Adds External Secrets Operator support for managing sensitive configuration in HA deployments (Pro Only) • Introduces strict base version matching and expanded search fields for Conan format Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-73-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--267600 https://help.sonatype.com/en/sonatype-nexus-repository-3-73-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--267600 Thu, 10 Oct 2024 00:00:00 GMT Sonatype Nexus Repository 3.73.0 adds Rust/Cargo support, malware warnings, re-encryption key rotation, and parent_id indexing. • Adds native support for the Rust / Cargo format (Pro only), enabling hosted, proxy, and group repositories with Cargo's sparse protocol for versions 1.68+. • Introduces a Malware Warning Banner in the Nexus Repository UI to alert administrators and users when open-source malware components are detected in repositories. • Enables administrators to rotate the encryption key used for reversible storage of sensitive data (e.g., passwords) via the re-encryption feature. • Adds a new index on `parent_id` to improve `getByDisplayPath` query performance, running on startup. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-72-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--257896 https://help.sonatype.com/en/sonatype-nexus-repository-3-72-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--257896 Wed, 04 Sep 2024 00:00:00 GMT Sonatype Nexus Repository 3.72.0 adds configurable DB refetch limit for search in HA, new CSV columns, and zero-downtime upgrade support. • Enables zero-downtime upgrades on rolling HA deployments • Adds publication and last downloaded date columns to Cleanup Preview CSV • Adds configurable database refetch limit for Search capability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-71-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--252273 https://help.sonatype.com/en/sonatype-nexus-repository-3-71-0-release-notes.html#what-s-new-and-noteworthy-in-this-release--252273 Thu, 08 Aug 2024 00:00:00 GMT Nexus Repository 3.71.0 defaults to H2 database, adds OCI Docker support and new HTTP Config REST API • Sets `H2` as the default embedded database for all new installations, including OSS • Enables rolling upgrades for High Availability (HA) deployments in preparation for 3.72.0 • Adds OCI Distribution Spec 1.0/1.0.1 compliance for Docker repositories • Exposes a new HTTP Configuration REST API to retrieve, update, and reset HTTP settings Breaking changes: • Requires migration to H2 or external PostgreSQL database; Java 8/11 and OrientDB are no longer supported for upgrades • Requires upgrade to Java 17 for all installations of version 3.71.0 and later Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-69-0-release-notes.html#what-s-new-in-sonatype-nexus-repository-3-69-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-69-0-release-notes.html#what-s-new-in-sonatype-nexus-repository-3-69-0- Tue, 04 Jun 2024 00:00:00 GMT Sonatype Nexus Repository 3.69.0 adds Java 17 support for H2/PostgreSQL deployments, user token expiration configuration, and SAML API/UI improvements • Adds `sonatype/nexus3:3.69.0-java17` Docker image to support running Nexus Repository Pro on Java 17 with H2 or PostgreSQL databases • Adds configurable user token expiration for Sonatype Nexus Repository Pro deployments, allowing administrators to set a defined expiry period for user authentication tokens • Extends the Users API's delete endpoint with an optional user realm source parameter to uniquely identify users across multiple LDAP servers • Adds UI capability in the user administration section to manually delete cached authenticated SAML user records Breaking changes: • OrientDB databases no longer support Java 17; attempting to use Java 17 with OrientDB will prevent Nexus Repository from starting Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-68-0-release-notes.html#what-s-new-in-3-68-0- https://help.sonatype.com/en/sonatype-nexus-repository-3-68-0-release-notes.html#what-s-new-in-3-68-0- Tue, 07 May 2024 00:00:00 GMT Nexus Repository 3.68.0 adds repository size viewing, SHA256/SHA512 generation for raw uploads, role wildcards, and removes legacy HA-C. • Adds repository size visibility in the UI and via `GET v1/repositories/{repositoryName}` / `GET v1/repositories` APIs for Pro deployments on PostgreSQL • Generates SHA256 and SHA512 checksums when uploading to raw repositories via API • Supports asterisk (`*`) wildcards in the search bar when filtering privileges and roles Breaking changes: • Nexus Repository will not start for any deployments that use legacy High Availability Clustering (HA-C); migration is required before upgrading to 3.68.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-67-0-release-notes.html https://help.sonatype.com/en/sonatype-nexus-repository-3-67-0-release-notes.html Tue, 02 Apr 2024 00:00:00 GMT Nexus Repository 3.67.0 adds official Java 11 runtime support alongside existing Java 8 option. • Adds the ability to run Nexus Repository on Java 11 or Java 8 • Provides specific Docker image tags for selecting the Java runtime version Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-66-0-release-notes.html https://help.sonatype.com/en/sonatype-nexus-repository-3-66-0-release-notes.html Tue, 05 Mar 2024 00:00:00 GMT Nexus Repository 3.66.0 adds embedded DB usage alerts and UI progress tracking for Repair tasks. • Adds in-product usage alerts when deployments with embedded databases (OrientDB or H2) approach 20,000 requests per day or 100,000 components Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-65-0-release-notes.html https://help.sonatype.com/en/sonatype-nexus-repository-3-65-0-release-notes.html Tue, 06 Feb 2024 00:00:00 GMT Nexus Repository 3.65.0 adds version-retention cleanup for Maven/Docker and group repo blob store changes via UI task • Adds `retain.latest` option to cleanup policies for Maven and Docker formats on PostgreSQL Pro deployments • Enables `Admin - Change repository blob store` task on group repositories in PostgreSQL-backed Pro instances Breaking changes: • Component search and tagging queries now return fewer results due to improved precision; keyword searches like 'nexus-core' no longer match 'nexus-main-core'. • Tag association for components now uses exact matches instead of loose string matching (e.g., tag on version '1.0.0' applies only to that exact version). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype https://help.sonatype.com/en/sonatype-nexus-repository-3-63-0-release-notes.html https://help.sonatype.com/en/sonatype-nexus-repository-3-63-0-release-notes.html Tue, 05 Dec 2023 00:00:00 GMT New HA Helm chart configurability, audit logging enhancements, and repository filtering • Adds `additionalVolumes`, `additionalVolumeMounts`, `additionalContainers`, `statefulsetAnnotations`, `podAnnotations`, `nodeSelectors`, `hostAliases`, `preStartCommand`, `postStartCommand`, `initContainers`, `tlsSecrets` for ingress, `additionalLabels`, `additionalSelectors`, `ingressAndServiceForDockerRegistries`, `securityContext`, `serviceAnnotations`, and `existingPersistentVolumeClaim` to the High Availability Helm Chart • Adds audit logging for SAML user login, logout, and config-changed events • Adds audit logging for local authentication, LDAP, and Crowd user login and logout events • Enables filtering the Repositories table by blob store name Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sonatype