Nexus Repository Cloud Release Notes

OCI proxy repositories now apply the same Remote Storage URL validation as other proxy formats in the UI and REST API. The validation requires http:// or https:// URLs and keeps the stored configuration consistent with the submitted URL.

Role creation and updates now require users to hold every privilege and child role that they assign, preventing non-administrators from granting permissions beyond their own authority.

Configuration options now appear based independently on deployment environment and licensed edition, ensuring administrators see the appropriate settings for their self-hosted or cloud deployment.

Nexus Repository now caches fully processed npm and PyPI package metadata in proxy repositories with Firewall enabled, eliminating redundant parsing and filtering on every request.

Various bug fixes.

Nexus One UI is now the default experience for all users, giving you the modernized interface without additional configuration. You can switch back to Classic UI at any time from UI Settings or by selecting Switch to Classic UI option.

Service account tokens (sat.<value>) now support HTTP Basic authentication across all supported repository formats, simplifying automated workflows. Deleting a service account also removes its associated tokens.

Sonatype Nexus Repository Health Check now operates automatically across proxy repositories, removing the need for the Configure for all proxy repositories option.

Multiple user interface enhancements for the Nexus One UI, including improved role creation on smaller displays, more intentional and permission-aware role deletion, and consolidated repository details and configuration on the Repository Settings page with automatic redirects from previous repository profile links.

Various bug fixes.

Sonatype Nexus Repository now supports preemptive authentication for Conda proxy repositories, sending credentials with the initial upstream request.

Pagination for Hugging Face repositories in chained proxy configurations now correctly rewrites Link headers so paginated requests route through the proxy without duplicating the repository path.

Multiple user interface enhancements for the Nexus One UI, including clearer service account credentials for Basic authentication, streamlined role creation and management with searchable privilege and contained-role selection, and improved repository browsing with easier navigation, keyboard controls, permission-aware actions, and access to HTML View.

Various bug fixes.

Sonatype Nexus Repository improves chained proxy support for Ansible Galaxy, Terraform, Pub, OCI, and Swift, including more reliable authentication and request routing through intermediate Nexus Repository instances.

Sonatype Repository Firewall now supports the Dart/Flutter (pub) format and automatically quarantines packages that violate policy. After upgrading, Firewall policy enforcement also applies to existing pub proxy repositories, which may affect package availability based on configured policies.

Administrators can now configure Layer Download Timeout (minutes) for individual Docker proxy repositories in Sonatype Repository Firewall settings.

The Security Management API now supports management of locally cached OAuth2 user records, making it easier to maintain records associated with configured identity providers.

The PyPI proxy REST API now supports custom index paths for PyPI-compatible registries. This makes it easier to proxy registries that use non-standard PyPI index paths.

Multiple user interface enhancements for the Nexus One UI, including improved component detail information, expanded Repository Health Check data, editable externally mapped roles, shareable search criteria, more accurate search result counts, consistent timestamps, and streamlined repository navigation and sorting.

Various bug fixes.

Multiple user interface enhancements for the Nexus One UI, including streamlined user and role management with real-time permission previews, sortable Unified Search results, and expanded repository usage details with storage metrics and group membership information.

Various bug fixes.

The Delete User action has moved from the users list to the Edit User page as a dedicated toolbar button with a type-to-confirm dialog, matching the pattern used for repository deletion. This change reduces the risk of accidental deletions while also providing clearer feedback for protected system accounts like admin and anonymous.

Sonatype Nexus Repository no longer includes the deprecated Nexus Repository 2-to-3 migration wizard in the Classic UI, reducing unmaintained code and removing an obsolete administrative workflow.

Multiple user interface enhancements for the Nexus One UI, including expanded OAuth2 and SSL certificate management, format-specific dependency snippets, more accurate repository type information, improved version loading and ordering, and faster component detail pages with smoother version switching.

Various bug fixes.

Migrating Nexus Repository instances now preserves Symbol Server data continuity, helping prevent disruptions to Symbol Server functionality.

Improved the handling of sensitive webhook configuration values in capability API responses.

Various bug fixes.

Added support for Composer hosted and group repositories.

Terraform repositories now support non-URL authentication, allowing Terraform clients to authenticate without embedding credentials in service endpoint URLs. Credentials are sent using standard Authorization: Bearer headers, reducing the risk of exposure in infrastructure, proxy, and audit logs.

Nexus Repository now gzip-compresses npm package metadata when supported by the client, reducing cloud egress by up to 5–7x for npm-heavy workloads.

Authentication rate limiting now evaluates all login attempts before credentials are processed, preventing bypasses that could allow unlimited attempts with valid credentials. This provides consistent protection across supported authentication endpoints, including npm, pub, Ansible Galaxy, and Terraform.

Yum group repositories now merge and serve modules.yaml.gz metadata from member repositories, allowing clients to resolve modular packages without bypassing the group.

Nexus Repository now supports the npm abbreviated packument format, reducing package metadata payloads by up to 89% when supported by npm clients. This speeds up npm install operations and reduces bandwidth usage without requiring any configuration changes.

Various bug fixes.

Added support for Chocolatey registry in NuGet hosted, proxy, and group repositories.

Added support for Microsoft Symbol Server in NuGet hosted, proxy, and group repositories.

The HuggingFace proxy now implements the /tree/ API restoring snapshot_download() and hf download for huggingface_hub 1.22.0+ and for large repositories (>1,000 files). Pinning huggingface_hub to ≤1.21.0 is no longer required.

Hugging Face repositories now support bearer token authentication compatible with huggingface-cli login and hf auth login, including huggingface_hub 1.0 and later.

Cleanup policies now extend Retain Select Versions support to additional repository formats, helping teams protect the newest component versions while automating repository cleanup. Administrators can also assign repositories from the cleanup policy form and preview or run targeted cleanup operations on demand through a new REST API. For supported formats, see the Cleanup Criteria help documentation.

Azure blob store API endpoints now return specific HTTP error codes for common configuration failures, making it easier to identify permission and feature-related issues when enabling direct downloads.

The content selector preview endpoint now enforces repository browse permissions so users can preview assets only from repositories they are authorized to access. The response also returns only essential asset information, reducing exposure of sensitive metadata.

Nexus Repository now protects against a denial-of-service vulnerability caused by excessively large Maven POM metadata. Oversized pom.name and pom.description values are automatically truncated during ingestion.

PyPI proxy repositories now support pre-emptive authentication, enabling successful proxying of private authenticated repositories such as GitLab.com-hosted PyPI instances.

Added support for temporary AWS credentials for Amazon ECR proxy repositories by allowing you to configure an optional AWS session token alongside your access key and secret key. This update enables authentication with AWS STS and IAM Identity Center (SSO) credentials while preserving existing support for long-lived AWS access keys.

Various bug fixes.

Proxy repositories now support repository-specific URL encoding rules, enabling format-specific configurations such as encoding + as %2B for PyPI repositories that use PEP 440 local version strings. Existing global configurations continue to work unchanged.

PyPI proxy repositories now support preemptive authentication, enabling successful proxying of private repositories that do not issue authentication challenges, such as GitLab.com-hosted PyPI repositories.

Various bug fixes.

Sonatype Nexus Repository Cloud now checks authentication rate limits. Once the authentication rate limit is exceeded, all subsequent authentication attempts receive a 429 Too Many Requests response until the rate limit expires, regardless of whether the credentials are valid.

Various bug fixes.

Added support for native OCI (Open Container Initiative) hosted, proxy and group repositories.

Added support for AWS Elastic Container Registry (ECR) in Docker proxy repositories, enabling centralized access to and caching of images from private ECR registries.

Sonatype Nexus Repository now validates realm configurations submitted through Security > Realms against registered realm IDs, preventing invalid or unauthorized realm IDs from running at startup.

PyPI repositories now support Simple API v1.1 (PEP 700), providing package metadata that enables modern clients such as pip and uv to make faster, more efficient dependency resolution decisions. Existing PEP 503 HTML and Simple API v1.0 behavior remain unchanged for full client compatibility.

Sonatype Repository Firewall cloud deployments now automatically activate the Ansible Galaxy security realm at startup, ensuring existing tenants use the correct AnsibleGalaxyToken authentication configuration without manual intervention.

The Content Disposition setting is no longer available for Maven and Raw repositories in cloud deployments. Download behavior is automatically managed by cloud storage, ensuring a consistent download experience.

Various bug fixes.

Docker repository management now simplifies connector configuration with port suggestions, provides richer image metadata in search results, and generates docker pull commands that correctly reference your Sonatype Nexus Repository registry.

URL encoding is now controlled exclusively through the Preserve Encoded Characters setting in each proxy repository's configuration.

New Conan proxy repositories now default to Protocol Version V2 and automatically update the Remote Storage URL example to https://center2.conan.io.

Various bug fixes.

Terraform proxy repositories now dynamically detect upstream service discovery paths, improving compatibility with compliant registries such as OpenTofu registries and registry.coder.com.

Various bug fixes.

The Usage page in Repository Cloud now includes additional context explaining differences between Peak Storage and repository totals.

Terraform proxy repositories now dynamically read service discovery paths from upstream registries, enabling compatibility with compliant registries that use non-standard module or provider paths.

Changing a user's password now immediately invalidates all active sessions across devices and browsers, requiring re-authentication with the updated credentials to improve account security.

API keys for NuGet, npm, Docker, and Conan formats now use UUID v4 generation. Existing keys remain valid, but Sonatype recommends regenerating keys to take advantage of the improved security model.

Nexus Repository now supports Alpine Linux (APK) repositories with hosted, proxy, and group repository types, including APKINDEX generation, RSA-based index signing, and a unified endpoint for Alpine-based CI pipelines.

Various bug fixes.

Added support for GO hosted and group repositories.

Added support for Ansible proxy, hosted, and group repositories.

Administrators can now use a new nameCode parameter in the User Token API to identify a token's owner and authentication realm by token name code.

Added a new nexus:uploader-metadata:read permission to allow administrators to control access to asset uploader usernames and IP addresses in the REST API and browse UI.

Nexus Repository now temporarily rate limits authentication attempts across UI and API login endpoints after three failed login attempts to help protect against brute force attacks.

Various bug fixes.

Added new endpoints to the Security management: user roles API to allow administrators to programmatically get, replace, add, and remove user role assignments in cloud deployments, enabling more precise and automation-friendly permission management.

Improved page load performance throughout Nexus Repository.

The IP Allow List feature is now available in Sonatype Nexus Repository Pro and Cloud editions, with existing configurations preserved during upgrade.

The Migrator CLI now blocks migrations to unsupported H2-backed Nexus Repository targets before data transfer begins, helping prevent failed or corrupted migrations.

The Reconcile task now re-ingests blobs located in the wrong blobstore after repository move operations, ensuring blob data aligns with the repository’s configured blobstore.

Proxy repository credentials are now cleared when the remote URL changes, preventing credentials from being reused against unintended destinations. Administrators must re-enter credentials after updating the URL.

The Instance Migrator now supports H2 databases as a migration source.

Refreshed the artifact upload interface with improved layout consistency, corrected visual issues, and a more polished upload experience.

Various bug fixes.

Preview Sonatype Nexus Repository's new user interface using the Switch to Nexus One UI toggle. Not that an administrator must enable this feature via Settings > System > Nexus One UI before the toggle will be visible (available in 3.92.0).

PyPI proxy repositories now support the PEP 658 and PEP 691 JSON API, caching JSON responses to improve performance for modern Python tools.

Various bug fixes.

Swift repositories can now be migrated between Nexus Repository instances using the Instance Migrator. Package archives and manifests are transferred, while auto-generated metadata is excluded and regenerated on the target instance, enabling seamless migrations.

Various bug fixes.

Added support for the Dart (pub) package format.

Added support for Conda hosted and group repositories.

The Instance Migrator can now migrate Terraform and Conda hosted repositories between Nexus Repository instances.

Added support for Helm group repositories, allowing aggregation of multiple Helm repositories into a single endpoint (disabled by default; configurable via system property).

The Usage Insights dashboard now retains daily storage metrics indefinitely, aligning with the retention model used for egress metrics. This ensures a complete and continuous view of storage trends across all time periods, eliminating gaps in historical data.

Refreshed the login experience with a unified design across both self-hosted and Cloud deployments. The updated interface aligns with Sonatype’s standard design system, delivering a more consistent and polished user experience without introducing any functional changes.

In cloud deployments, the Users page now includes an Invite User button, replacing Create Local User. This streamlines onboarding through your identity provider and simplifies the interface by automatically filtering to OAuth2 users. Self-hosted deployments are unchanged.

Introduced a new admin REST API (GET/PUT /v1/security/ssrf-protection) for managing SSRF protection settings dynamically without requiring a restart. This includes support for configuring allowed IPs and domains, ensures cluster-wide consistency, and permanently blocks access to cloud metadata endpoints.

Various bug fixes.

Introduced an Instance Migrator that allows OrientDB-based Nexus Repository 3.70.5 instances to either Nexus Repository Cloud or self-hosted Nexus Repository version 3.90.2+.

See the Instance Migrator help documentation for full requirements and migration details.

Added an informational alert in the Historical Usage section to clarify that usage data is updated every 48 hours. This helps set expectations and explains why recent repository changes may not be immediately reflected in storage metrics.

Yum repository migrations now automatically regenerate repository metadata, including required files such as repomd.xml and associated .xml.gz files. This ensures migrated repositories remain complete and fully functional without requiring manual intervention.

Various bug fixes.

Nexus Repository now supports Swift group repositories. This allows you to aggregate multiple Swift package sources into a single endpoint for simplified dependency management.

Various bug fixes.

Repository Firewall now supports global webhooks for quarantine events, automatically notifying your systems when components are quarantined or blocked due to policy violations. This enables real-time integration with your security workflows and incident response systems, allowing you to immediately track and respond to potentially risky components.

Various bug fixes.

Support for Swift hosted repository format.

Support for Terraform group repository format.

The User Token API now allows administrators to create, view, and delete user tokens. With the appropriate privileges, administrators can generate tokens for specific users and realms, retrieve token summaries (excluding sensitive fields), and manage tokens across individual or all realms, including options to include expired tokens in responses.

Various bug fixes.

Proxy URL validation is enabled by default to block outbound connections to private network addresses, localhost, and cloud metadata endpoints.

Sonatype Repository Firewall now writes firewall.quarantine audit log events when components are newly quarantined or when users attempt to download already quarantined components. Note that you must be using self-hosted IQ version 201 or Sonatype Lifecycle Cloud (SaaS) for this to take effect.

Improvements to the Sonatype Nexus Repository Cloud login page.

Various bug fixes.

PyPI package metadata now includes a sonatype_filtered_versions field when versions are filtered.

Various bug fixes.

Support for Swift proxy repositories.

Support for Terraform hosted repositories.

Various bug fixes.

Added support for Terraform proxy repository format. Note that Terraform currently requires user token-based authentication, which requires a paid Nexus Repository Pro or Nexus Repository Cloud license. This means that, at the moment, Community Edition users are unable to authenticate for Terraform repositories. Anonymous access is not currently available for Terraform proxy repositories, though that will be enabled shortly.

Various bug fixes.