Nexus Repository Cloud Release Notes

NEXUS-55200 – OCI proxy blob pulls complete successfully when the remote registry redirects requests to signed storage URLs (such as Azure Blob Storage SAS URLs) whose paths contain consecutive slashes, preserving the exact path required for signature validation instead of returning a misleading 404 BLOB_UNKNOWN error.

NEXUS-55186 – The Data Repair Plan task log now includes detailed per-entry information (e.g., blob ID, repository name, file path, action, and reason) for each planned repair operation, giving operators full visibility into what the task will do before executing it.

NEXUS-55134 – Alpine repository signing key configuration in the Nexus One UI now works correctly for all three repository types (i.e., proxy, hosted, and group) allowing repositories to be created and edited with proper key and passphrase fields that persist across saves.

NEXUS-55077 – Direct PUT uploads to a Conda hosted repository using a channel-prefixed URL (e.g., .../main/noarch/package.conda) now return a clear 400 Bad Request error, preventing a situation where uploads appeared to succeed but the package was stored at a different path and could not be retrieved using the same URL.

NEXUS-55062 – The npm asset Attributes tab now displays the complete set of package metadata fields in both the Classic UI and Nexus One UI.

NEXUS-54540 – Search results through group repositories now return components correctly when users have read access to the group but not its individual member repositories.

FIRE-879 – Container image scans for Firewall for Docker now correctly identify Python and Java components, including proper detection of RedHat backported packages, which may change previously reported scan results and affect existing policy evaluations.

NEXUS-55364 – Hosted Conda repositories using the Disable redeploy deployment policy now regenerate repodata.json, repodata.json.bz2, and channeldata.json after subsequent package uploads.

NEXUS-55223 – PyPI proxy repositories now return the format requested by each client when simultaneous requests for the same Simple index use different Accept headers.

NEXUS-54867 – High-availability clusters now create all required distributed cache indexes during startup, preventing cache writes from failing because of missing database constraints.

NEXUS-55284 – The repository edit page header now correctly displays the online status for active repositories.

NEXUS-55218 – The Change Repository Blob Store task now removes only blobs belonging to the moved repository, preserving blobs used by other repositories in the source blob store and maintaining asset availability during migration.

NEXUS-55030 – Authentication rate limiting now automatically releases blocked accounts after the advertised retry interval, and successful logins clear the failed-attempt counter without extending the lockout.

NEXUS-54977 – NuGet V3 group repository package index requests now return complete version lists, including base versions and versions with -release, -ga, or -final qualifiers from member repositories.

NEXUS-54962 – Automatic Malware Management now retains newly detected malicious findings on H2 databases instead of immediately marking them as retracted, preventing duplicate historical records during subsequent task runs.

NEXUS-54829 – Audit log entries for assets purged during cleanup now include the blob path, kind, and location needed to selectively recover deleted content.

NEXUS-54764 – Anonymous Docker authentication continues to work after the Admin – Delete orphaned API keys task runs, preventing repeated pull failures and rate-limit blocks that previously required a restart.

NEXUS-54739 – The Rebuild metadata task now restores Conan and Terraform repository metadata after a blob restore, allowing native clients to access restored components.

NEXUS-54368 – Task status in clustered deployments now reflects execution on another active node, preventing long-running tasks such as YUM repository metadata rebuilds from incorrectly displaying an Interrupted result when a different cluster node restarts.

NEXUS-54915 – Retain N versions cleanup policies now correctly retain the most recently published npm pre-release versions instead of incorrectly selecting them for deletion.

NEXUS-54771 – OCI proxy repositories now require remoteUrl values to use http:// or https://, providing consistent validation in the UI and REST API.

NEXUS-54579 – The Cleanup Policy Preview repository dropdown now lists supported npm, PyPI, Go, Helm, NuGet, Yum, RubyGems, Terraform, Swift, Apt, and Pub repositories when no Applied Repositories are configured, matching Maven and Docker behavior.

NEXUS-54132 – Docker proxy repositories without configured credentials now log anonymous bearer token exchange failures at debug level instead of warning level.

NEXUS-54855 – User token lookups now handle query parameters consistently while maintaining compatibility with existing integrations.

NEXUS-54913 – Ansible Galaxy proxy repositories correctly forward collection version requests — including paginated queries with ?limit and ?offset parameters — to the upstream server, resolving collection installation failures that previously returned HTTP 404.

NEXUS-54820 – Build integrity for log4j-core is now enforced at the build level.

NEXUS-54817 – Go hosted repositories now resolve modules with uppercase prerelease characters in their versions when requested through GOPROXY.

NEXUS-54760 – Ansible Galaxy proxy repositories now return Content-Type: application/json for v3 collection metadata endpoints.

NEXUS-54715 – HEAD requests to npm group repositories now return the expected response when the requested package is not cached instead of returning an HTTP 500 error.

NEXUS-54691 – User tokens are now preserved when upgrading from OrientDB to H2 or PostgreSQL, including tokens that share the same creation timestamp.

NEXUS-54604 – Data Repair Plan blob attribute scanning for S3, Azure, and Google Cloud blob stores now runs concurrently and reads each .properties file only once, preventing CPU count from limiting reconciliation workers.

NEXUS-54601 – Large or concurrent Docker and OCI layer commits to S3-backed blob stores now complete successfully without prematurely opening S3 connections for subsequent chunks.

NEXUS-54571 – Ansible Galaxy metadata served through chained proxies now uses only the downstream Sonatype Nexus Repository host information in download URLs, preventing air-gapped clients from attempting to connect directly to upstream servers.

NEXUS-54322 – In HA clusters, user deletion, deactivation, and role assignment changes now invalidate security caches across all nodes within seconds, preventing outdated credentials or permissions from remaining valid on remote nodes.

NEXUS-54233 – Browse-node updates now run independently for each repository, preventing heavy upload activity in one Raw repository from delaying newly uploaded components from appearing in the Browse UI for other repositories.

NEXUS-54818 – Updated a third-party HTTP client dependency to address a critical security vulnerability and prevent related policy evaluation failures during builds.

NEXUS-54753 – OCI repository creation and updates now complete successfully when legacy Docker repositories exist in the same Sonatype Nexus Repository instance.

NEXUS-54717 – HTTP HEAD requests to Docker manifest endpoints now update the asset's lastDownloaded timestamp in hosted and proxy repositories, preventing cleanup policies from targeting actively used images.

NEXUS-54602 – Improved logging safeguards in Sonatype Nexus Repository logs and support bundles.

NEXUS-54127 – Sonatype Nexus Repository now prevents deletion of Docker or OCI blobs that are still referenced by active manifests, preserving repository integrity.

NEXUS-53722 – The classic UI repositories administration page now retrieves repository size metrics more efficiently, improving load times for instances with large numbers of repositories.

NEXUS-54596 – Cargo group repository config.json requests no longer create or store unnecessary assets on each request.

NEXUS-54576 – NuGet packages publish successfully to hosted repositories with Disable Redeploy enabled when packages share embedded PDB files or contain PDB files alongside DLLs.

NEXUS-54572 – NuGet symbol assets (.snupkg and .pdb files) now include the required metadata, enabling searches and preventing HTTP 500 errors during symbol package operations.

NEXUS-54568 – Upgraded Verify and Repair Data Consistency tasks now preserve the default selection for Keep database records when blob is missing when users save other task settings.

NEXUS-54563 – The Repair - Execute Data Repair Plan task now removes orphaned database records for assets with missing blob files.

NEXUS-54558 – PyPI proxy repositories configured with an empty indexPath now omit the /simple/ prefix when routing requests to flat-layout upstream registries.

NEXUS-54552 – npm package metadata browse nodes remain available for deletion after all associated tarball assets are removed from a proxy repository.

NEXUS-54550 – Docker proxy repositories backed by Amazon ECR now accept pre-generated ECR authorization tokens as HTTP Basic authentication credentials.

NEXUS-54526 – npm proxy repositories now retrieve packages successfully when GitHub Packages redirects requests to Azure Blob Storage, with authentication credentials applied to the appropriate host.

NEXUS-54508 – The Firewall Mode option no longer appears for repository formats that Sonatype Repository Firewall does not support, preventing configuration save errors for APT, Helm, and Terraform proxy repositories.

NEXUS-54507 – Concurrent HEAD and GET requests for the same uncached proxy repository asset now complete successfully without returning HTTP 500 errors.

NEXUS-54469 – Docker proxy repositories now return a stable Last-Modified header for cached manifests so clients correctly recognize unchanged images.

NEXUS-54468 – npm packument responses larger than 10 MiB are now gzip-compressed when clients request compression.

NEXUS-54434 – Permission-gated pages now load correctly after a browser refresh or direct navigation without redirecting users to the Welcome page.

NEXUS-54208 – OIDC logout now provides consistent sign-out behavior for users authenticating through an external identity provider.

NEXUS-54130 – Not Found Cache entries in HA deployments are now coordinated across nodes, providing consistent responses for the same repository path.

NEXUS-52267 – The Compact Blob Store task now processes soft-deleted blobs in S3 blob stores more efficiently through batched, parallel deletion.

NEXUS-49734 – Administrators can now manage locally cached OAuth2 user records through the Security Management REST API without forwarding changes to the remote identity provider.

NEXUS-44892 – PyPI proxy repository REST APIs now support a configurable suffix field for registries that expose package indexes under custom subpaths.

NEXUS-54339 – Docker proxy repositories now return all available upstream tags, with the previous 10,000-tag limit replaced by a configurable property.

NEXUS-54214 – PyPI group repositories now preserve complete PEP 700 metadata regardless of the capitalization used in project name requests.

NEXUS-53560 – Webhook capabilities now recover automatically from transient activation failures after the downstream service becomes available, though capabilities already in a permanent failure state require one manual disable and re-enable after upgrading.

NEXUS-54440 – PyPI proxy repositories now fall back to the JSON index when a cached HTML index does not contain the requested package version, preventing 404 errors caused by the two indexes expiring at different times.

NEXUS-54371 – NuGet V2 proxy repositories now re-query the upstream remote during FindPackagesById() calls even when matching packages exist in the local cache, restoring the version-discovery behavior that was inadvertently removed in 3.94.0.

NEXUS-54364 – OCI proxy repositories now route all outbound traffic — including manifest requests, bearer token exchanges, and blob downloads — through the globally configured HTTP/HTTPS proxy under Administration → System → HTTP.

NEXUS-54336 – OCI proxy repositories cap sha256 manifest scans at 1,000 entries per request, preventing unbounded database queries that caused image downloads to stall for 16 or more minutes on repositories with large manifest counts.

NEXUS-54326 – Cargo proxy and group repositories now serve sparse-index metadata directly, improving cargo fetch performance by avoiding unnecessary S3 redirects.

NEXUS-54290 – Users authenticated through Remote User Token (RUT) header authentication are now routed directly to the appropriate page on initial UI load, rather than being left on the login form despite having already been authenticated by the upstream proxy.

NEXUS-54250 – Resolved a Nexus One UI malware risk banner display issue.

NEXUS-54199 – Inviting and deleting Auth0-managed users in Nexus Repository Cloud now generates audit events, making these security-relevant actions visible in the audit log and queryable through the Audit REST API.

NEXUS-54143 – Blob store group member removal now processes all blobs in a single pass with back-pressure, completing successfully even when source blobs have missing .bytes files, and emits diagnostic log entries identifying

NEXUS-54141 – NuGet V3 registration index requests now complete successfully when stored components contain incomplete format metadata, returning valid responses instead of a 500 error.

NEXUS-54068 – Resolved a UI issue related to the Malware Risk banner.

NEXUS-54043 – Migrating npm hosted repositories preserves dist-tags exactly, including latest and custom tags, regardless of the import batch size selected.

NEXUS-53644 – The OrientDB CVE security alert is now suppressed on PostgreSQL and H2-backed instances, appearing only for deployments that actually run OrientDB.

NEXUS-51211 – R proxy repositories now support installing older CRAN package versions from the archive using renv, remotes, and devtools.

NEXUS-54261 – Sonatype Nexus Repository now displays the Remote Index Path field for PyPI proxy repositories, allowing repositories that use non-standard upstreams to be created and edited with an empty or /simple index path.

NEXUS-54133 – Nexus 2 to Nexus 3 migration connections now complete successfully with the RESTEasy 7-compatible HTTP client wrapper.

NEXUS-54092 – Hosted Terraform module repositories now correctly serve module archives that use semantic version numbers with .tgz, .tbz2, and .txz file extensions.

NEXUS-54087 – Staging move operations that conflict with an in-progress upload now return an HTTP 409 response instead of an internal server error.

NEXUS-53973 – Cleanup now removes orphaned asset_blob database records even when the corresponding blob files are missing from the blob store.

NEXUS-53918 – Repositories with stale cleanup policy references are automatically corrected during upgrade, allowing affected repositories to initialize successfully.

NEXUS-53864 – NuGet v3 proxy repositories now reject zero-byte JSON and XML responses from upstream servers instead of caching them as valid assets.

NEXUS-53847 – The GET /v2/security/saml/users endpoint now returns paginated results, allowing organizations with more than 1,000 SAML user mappings to retrieve the complete dataset.

NEXUS-53389 – S3 blob store configuration now validates AWS regions when the configuration is saved and rejects invalid values with a clear error message.

NEXUS-54198 – Improved logging for user management operations to simplify troubleshooting.

NEXUS-54089 – Docker hosted repositories now complete cosign sign and cosign attest operations significantly faster when large numbers of SHA-256 manifests are present.

NEXUS-54026 – npm hosted repositories now update dist-tags.latest to the most recently published version after Instance Migrator and export/import operations.

NEXUS-54023 – The My Account → User Token page now loads correctly for non-admin users with only the nx-usertoken-current privilege.

NEXUS-53749 – npm JSON responses are now gzip-compressed when clients request compression with the Accept-Encoding: gzip header.

NEXUS-53976 – Repository Evaluation Settings now load and save correctly when Nexus Repository is deployed behind a reverse proxy with a custom nexus-context-path.

NEXUS-53457 – The Migrate existing secrets upgrade task now completes successfully by automatically removing references to non-existent cleanup policies.

NEXUS-52934 – Assets remain accessible throughout Change Repository Blob Store migrations until all database references are updated to the destination blob store.

NEXUS-35825 – Proxy repository assets restored with the Execute Data Repair Plan task now receive cache metadata that prevents unnecessary CacheInfo missing, assuming stale content log warnings.

NEXUS-33892 – Group repository caches are now automatically invalidated when routing rules on member proxy repositories are added, removed, or modified.

NEXUS-22163 – Yum group repositories now merge and serve modules.yaml.gz metadata from member repositories, allowing DNF clients to resolve modular packages through the group repository.

NEXUS-15051 – npm repositories now return the abbreviated packument format when clients request application/vnd.npm.install-v1+json.

NEXUS-54025 – Basic Auth credential verification no longer performs per-request password hash provider lookups, eliminating lock contention that reduced throughput for username/password authenticated clients.

NEXUS-53975 – Terraform proxy repositories can now send credentials with the initial request when pre-emptive authentication is enabled, allowing chained proxy configurations to authenticate successfully.

NEXUS-53923 – Updated an upgrade step to schedule blob reference migration tasks unconditionally as lightweight background operations, eliminating the blocking full-table scan that previously ran on the startup thread and caused upgrades to stall for hours on large instances.

NEXUS-53874 – Dart/Pub hosted repositories now accept package names beginning with an underscore, aligning with the official pub.dev specification.

NEXUS-53861 – Read-only users browsing repositories in the Preview UI no longer see an enabled Delete button for assets, components, or folders they lack permission to remove.

NEXUS-53830 – Docker layer uploads to Azure blob store repositories now use server-side copy for single-chunk transfers, reducing the time required to push large layers.

NEXUS-53826 – Terraform, Ansible Galaxy, and Swift hosted repositories no longer cache "not found" responses, so post-upload verification requests return the correct status instead of a stale 404.

NEXUS-53662 – The PUT /service/rest/v1/security/users/{userId} endpoint now accepts user update requests that omit firstName, lastName, or emailAddress, matching the documented API contract.

NEXUS-53486 – The Default Role Realm is now retained during node shutdown, preserving access to User Tokens and other realm-dependent features after AWS ASG instance refreshes or ECS task changes.

NEXUS-53458 – The Settings → Repositories page loads at normal speed during post-upgrade blob-size copy task execution, as the task completion check now caches negative results for 30 seconds instead of querying the database once per repository on every page render.

NEXUS-51524 – The Repair - Execute Data Repair Plan task UI now displays the complete plan count across all available plans, regardless of total volume, by retrieving aggregated statistics from a new server-side summary endpoint instead of a single paginated page capped at 100 entries.

NEXUS-37620 – The Repair - Rebuild Maven repository metadata task now regenerates missing Maven metadata checksum files even when the underlying metadata content has not changed.

NEXUS-53833 – PyPI hosted repository simple index requests no longer create blob store files or updated-uploaded audit log entries during read operations.

NEXUS-53755 – The top-level search More Criteria menu now includes Name and Version fields, making version-based filtering available across all package formats.

NEXUS-53739 – JVM heap usage alerts are now logged at WARN level during normal G1GC major collections, reducing unnecessary ERROR-level log entries.

NEXUS-53719 – Permission checks for users authenticated through external realms now cache role-to-permission mappings per request, improving UI performance for users with large role sets.

NEXUS-53697 – NuGet hosted repositories now return correct partial content responses for byte-range requests, enabling clients to download only the requested portion of a package.

NEXUS-52826 – Group repositories now display aggregated Firewall Report protection status based on their proxy members, and the Firewall Report column is correctly identified as non-sortable.

NEXUS-53476 – Existing cached .whl.metadata assets are automatically migrated to use the application/octet-stream content type during upgrade; remove any reverse proxy rules or workarounds that were previously used to override this header to prevent conflicts.

NEXUS-53733 - PyPI proxy repositories now send the correct upstream If-None-Match header to preserve 304 Not Modified responses and prevent unnecessary downloads and blob creation for cached simple index pages.

NEXUS-53682 - Source RPMs in hosted Yum repositories now generate primary.xml metadata with the correct arch="src" value, ensuring yum and dnf clients resolve source and binary packages correctly.

NEXUS-53599 - Blob store metrics are now preserved when promoting a blob store to a group, eliminating the need to run the Recalculate Blob Store Storage task.

NEXUS-53586 - The selected Source filter in Security > Users is now preserved after deleting a non-local user.

NEXUS-53496 - Duplicate Ansible collection publish attempts now return HTTP 409 Conflict with a Galaxy-compatible error response instead of HTTP 400.

NEXUS-53492 - PyPI group repositories now return a single authoritative index entry per filename, allowing hosted packages to take precedence and enabling successful PEP 658 hash verification.

NEXUS-53454 - High Availability deployments now prevent duplicate repository.search.update tasks from being scheduled across multiple nodes.

NEXUS-53372 - Yum group repositories now serve cached metadata without triggering unnecessary rebuilds when hosted members contain stale cache attributes.

NEXUS-53263 - Components associated with tags now remain searchable for users with Repository Content Selector permissions after rebuilding repository search indexes.

NEXUS-52942 - Docker group repository tag pagination now preserves the requested group repository path in the Link response header.

NEXUS-52176 - IQ Server connection verification failures now report actionable error messages in nexus.log instead of the misleading compatibility error.

NEXUS-51662 - Multi-term searches on PostgreSQL now respect term order when nexus.search.multi.wildcard.regex.enabled=true.

NEXUS-51451 - Conan proxy repositories now return cached search results when the remote repository is manually blocked instead of returning an HTTP 500 error.

NEXUS-51368 - Raw repository filename searches now return correct results for filenames containing period (.) characters.

NEXUS-50783 - Removing a member from a Maven group repository now completes immediately while orphaned asset cleanup runs in the background.

NEXUS-29099 - Task log file handles are now released immediately after task completion to prevent open file counts from increasing over time.

NEXUS-53496 -Ansible Galaxy hosted repositories with redeployment disabled now return the Galaxy-compatible HTTP 409 response and conflict.collection_exists error body when duplicate collection versions are published.

NEXUS-53383 - Pub repository uploads now correctly identify the root pubspec.yaml in package archives containing multiple pubspec.yaml files, ensuring accurate validation and metadata generation.

NEXUS-53373 - Air-gapped telemetry script requests now complete within a configurable timeout and serve cached content when the remote telemetry service is unavailable.

NEXUS-53343 - Rebuild - Repository Search tasks now keep existing search index records available throughout the rebuild and remove orphaned entries only after repopulation completes.

NEXUS-53300 - NuGet v3 hosted repository queries now return expected results when PostgreSQL-backed Repository Content Selector privileges use path-based expressions.

NEXUS-53265 - NuGet tag association by non-admin users with Repository Content Selector privileges now succeeds when content selectors use mixed and/or expressions with explicit operator precedence.

NEXUS-53263 - Components governed by Repository Content Selector privileges remain searchable after tag association, and repeated tag operations no longer return HTTP 404 responses.

NEXUS-52995 - Policy-Compliant Component Selection diagnostic logs for npm proxy repositories now include the catalog date and policy constraint details for quarantined component versions.

NEXUS-52942 - Docker group repository pagination Link headers now reference the original group repository path instead of the resolved member proxy path.

NEXUS-37907 - Task completion emails now display correct durations for scheduled tasks that run longer than 24 hours.

NEXUS-29245 - npm dist-tag add and npm dist-tag rm commands now work with group repositories by delegating tag operations to the configured writable member repository.

NEXUS-29099 - Task log file handles are now released immediately after task completion, preventing the accumulation of open file descriptors.

NEXUS-53281 – Firewall quarantine requests now remain compatible with IQ Server versions earlier than 204 by omitting the quarantineEnabled field when unsupported, preventing HTTP 400 errors. (Also included in self-hosted 3.93.1)

NEXUS-53184 – NuGet V2 FindPackagesById() now returns only exact package ID matches, preventing unrelated packages from appearing in search results. (Also included in self-hosted 3.93.1)

NEXUS-53007 – NuGet API key rate limiting is now scoped to individual token hashes, preventing invalid tokens from affecting other users.

NEXUS-52855 – Rebuild Maven repository metadata tasks now complete successfully when the specified groupId or artifactId is not present in a repository.

NEXUS-52827 – Search results now sort correctly by repository name across all repository formats.

NEXUS-52799 – Maven proxy repositories with strict content type validation now correctly download and cache macOS universal binary .exe artifacts.

NEXUS-51877 – Rebuild repository search tasks now skip empty component batches, preventing malformed SQL statements from being logged by PostgreSQL.

NEXUS-51643 – Helm chart push rejections now return JSON-formatted HTTP 409 responses, allowing helm cm-push to display rejection details correctly.

NEXUS-51449 – The Repository Health Check column is now hidden as expected when an IQ Server Firewall license is configured.

NEXUS-53468 - Sonatype Nexus Repository now correctly routes Terraform proxy repository requests for providers with long namespace names without interpreting the namespace as an authentication token.

NEXUS-53396 – Conda proxy repositories configured with channel-specific upstream URLs now send the correct package path to Sonatype IQ Server, allowing malicious packages to be identified and quarantined as expected.

NEXUS-53394 - Google Cloud Storage 503 errors during blob store compaction are retried with backoff, and compaction runs that cannot delete soft-deleted blobs now appear as failed in the UI.

NEXUS-53338 - Pull replication now fetches modified assets from the source immediately without applying the proxy staleness check or configured maximum metadata age.

NEXUS-53310 - Ansible Galaxy proxy repository metadata now returns component download URLs using the correct scheme, hostname, and port from each inbound request.

NEXUS-53297 - PyPI package indexes at all group levels now automatically show newly uploaded or cached package versions without requiring manual cache invalidation.

NEXUS-53266 - Sensitive HTTP authentication headers, including Authorization: Bearer, Authorization: Basic, X-Auth-Token, and X-API-Key, are now redacted from log files before support ZIP bundles are generated.

NEXUS-53242 - Hugging Face proxy repositories now download complete non-LFS blob files by converting HEAD requests to GET requests when following redirects to blob storage.

NEXUS-53199 - After login, the UI becomes interactive while permissions load asynchronously, removing the blocking Loading Permissions window for users with large role sets.

NEXUS-52769 - RAW proxy repositories with preserveEncodedCharacters=true now forward signed redirect URLs containing consecutive slashes byte-for-byte so upstream storage signatures validate correctly.

NEXUS-51938 - All nodes in an HA cluster now flush their shared HTTP connection pool when proxy or HTTP client settings change.

NEXUS-51661 - Trailing wildcard searches with fewer than three characters before the wildcard now return an HTTP 400 response with a clear error message, and the minimum prefix length can be configured with nexus.search.wildcard.minPrefixLength.

NEXUS-51522 - Docker repositories with mixed-case names created before version 3.90 can now be updated through the REST API, except for newly enabling path-based routing.

NEXUS-50701 - SSRF validation now uses the configured global HTTP proxy when direct DNS resolution fails, allowing proxy repository creation and artifact retrieval in locked-down network environments.

NEXUS-25793 - PyPI proxy repositories now return valid empty package index pages with HTTP 200 responses for upstream packages that have no downloadable files.

NEXUS-53463 – PyPI group repositories automatically invalidate cached indexes when Repository Firewall policy filtering (PCCS) is enabled or disabled on a member proxy repository.

NEXUS-52050 - Clicking the Sonatype logo now navigates correctly to the appropriate landing page.

NEXUS-28581 – Log messages generated when the proxy thread cooperation limit is exceeded now include the current limit, cooperating thread count, and the nexus.proxy.cooperation.threadsPerKey property.

NEXUS-53317 – YUM group and proxy repositories now automatically remove stale browse tree entries when merged repository metadata is replaced.

NEXUS-51526 – The Repair - Data Repair Plan task now removes orphaned asset database records when the corresponding .bytes file is missing and Keep db records is disabled

NEXUS-53214 – Ansible Galaxy hosted repositories configured with Disable RIQ edeploy now allow publishing new collection versions while continuing to block redeployment of existing versions. (Also included in self-hosted 3.93.1)

NEXUS-53183 – Collection installations from Ansible Galaxy hosted repositories now correctly resolve dependencies and complete successfully. (Also included in self-hosted 3.93.1)

NEXUS-53062 – Chained PyPI proxy repositories now successfully retrieve packages from upstream Nexus Repository instances that redirect artifact requests to S3 presigned URLs by removing the Authorization header before following cross-host redirects. (Also included in self-hosted 3.93.1).

NEXUS-52961 – Support zip exports now include an oauth2UserExport.json file containing OAuth2 user account data from the oauth2_user table. (Self-hosted deployments only)

NEXUS-52846 – Logout requests for instances configured with Okta OIDC now include the required id_token_hint parameter and complete successfully.

NEXUS-52813 – PyPI hosted repositories now immediately reflect newly uploaded package versions in the per-package simple index for packages with non-normalized names, eliminating the need for a manual metadata rebuild.

NEXUS-52580 – Terraform hosted repository Data Repair Plan recovery now restores the versions.json asset with the correct MODULE_VERSIONS kind, allowing subsequent module uploads to succeed.

NEXUS-52551 – Chained PyPI proxy repositories now generate correct outbound package download URLs for .whl files without duplicating repository path segments (Also included in self-hosted 3.93.1)

NEXUS-52921 – Swift proxy repositories now normalize Git tags by removing leading v and V prefixes, allowing SwiftPM dependency resolution to succeed for packages that use version tags such as v5.3.0.

NEXUS-52856 – Keyword-only searches now display the group repository name when access is granted through a group repository instead of showing the underlying member repository.

NEXUS-52812 – Outbound TLS connections now complete successfully in FIPS mode on Java 21 by enforcing compatible TLS and keystore settings.

NEXUS-52759 – Groovy script execution now works correctly on Java 25 following the upgrade to Groovy 5.0.6. Groovy scripts that rely on indirect imports may require updates due to stricter SecureASTCustomizer sandbox enforcement.

NEXUS-52625 – YUM and RPM components with large asset counts are now partially indexed when PostgreSQL search limits are exceeded, allowing matching content to remain searchable.

NEXUS-52620 – Blob store creation and updates through the User Interface now complete successfully when Nexus Repository is accessed over HTTPS with inbound SSL enabled.

NEXUS-52583 – Permission loading for users with large numbers of roles now completes significantly faster, reducing login delays in the UI. (Fixed for self-hosted in 3.93.0)

NEXUS-52571 – LDAP and SAML users can now be saved successfully after all local roles are removed.

NEXUS-52414 – Wildcard component searches that include path separators now return expected results in PostgreSQL-backed deployments.

NEXUS-52027 – Policy-Compliant Component Selection now selects the highest stable release when an npm package's latest dist-tag references a quarantined version and only falls back to a pre-release version when no stable release is available.

NEXUS-52006 – lastDownloaded timestamp updates now use a database-backed operation that prevents orphaned temporary property files from accumulating on NFS and CIFS blob stores.

NEXUS-51967 – PyPI proxy repositories now report their Policy-Compliant Component Selection status correctly to IQ Server when quarantined versions are removed.

NEXUS-51593 – Content selector privileges now display the correct repository and format values in the UI regardless of whether they were created through the UI or REST API.

NEXUS-51521 – Docker pushes to S3-backed hosted repositories now complete successfully without stream closure errors.

NEXUS-41851 – Logger override configurations stored in the database are now included in support zip exports for High Availability deployments.

NEXUS-27554 – The NuGet API Token section is now hidden from user profiles when the NuGet API-Key realm is disabled.

NEXUS-52659 – Anonymous Docker pulls through group repositories now succeed when Allow Anonymous Docker Pulls is enabled on the group, regardless of member repository settings.

NEXUS-52475 – Pre-signed URL generation and multipart uploads for S3 blob stores now consistently use the configured blob store credentials instead of environment credentials.

NEXUS-52320 – Terraform repositories hosted under non-root context paths now authenticate correctly with User Tokens during terraform init.

NEXUS-52117 – Uploading components and artifacts through the Upload sidebar tab to hosted repositories now completes successfully without errors.

NEXUS-52107 – Startup failures caused by missing or stale HTTP client secrets now identify the affected repository and httpclient.authentication.password configuration in the error logs.

NEXUS-51920 – Terraform hosted repositories now support upload and download of modules that use SemVer pre-release versions containing hyphens.

NEXUS-51835 – Azure blob store initialization failures now log the root cause exception and full stack trace at the default ERROR level.

NEXUS-52635 – Concurrent npm and PyPI proxy requests under PCCS now coalesce across cluster nodes, preventing uncoordinated IQ Server evaluation calls that could exhaust heap memory and cause a full Firewall outage. (This fix requires Nexus Repository 3.92.3+ and IQ 204+.)

NEXUS-52434 – PCCS evaluation results for npm and PyPI proxy repositories are now reused within the configured metadata cache window, improving performance for packages with large version counts

NEXUS-52781 – Search indexing for NuGet V2 proxy repositories now completes successfully when cached components contain an empty package name derived from a blank <d:ID> OData feed element. (Fixed for self-hosted in 3.92.3)

NEXUS-52631 – UI Branding headers and footers now correctly apply CSS rules defined in <style> blocks, though configurations embedding <style> elements inside <head> tags must move them into the <body> to preserve existing layouts.

NEXUS-52384 – Swift proxy repositories now retrieve the correct version-specific manifest file when a ?swift-version query parameter is provided and return a 303 See Other redirect to Package.swift when no matching upstream manifest exists.

NEXUS-52353 – CocoaPods proxy repositories now perform full recursive git clones for pods declaring "submodules": true, ensuring archives include all required submodule content.

NEXUS-52266 – The Compact blob store task now rebuilds the deleted blob index for S3 blob stores when the rebuildDeletedBlobIndex flag is enabled and removes the flag from metadata.properties after completion.

NEXUS-51975 – Cleanup policy asset name regex patterns containing the + quantifier are now preserved correctly during preview and policy creation, returning accurate results without workaround patterns.

NEXUS-50997 – Routing rule updates and deletions now propagate immediately across all High Availability nodes, keeping repository routing behavior consistent throughout the cluster.

NEXUS-50972 – PyPI simple index pages now update correctly after cleanup policies remove packages, preventing stale links that return 404 errors.

NEXUS-50725 – During startup in High Availability environments, Nexus Repository no longer logs misleading timeout warnings when long-running tasks are active on other cluster nodes.

NEXUS-52584 – npm group repositories now reflect newly published versions in the `latest` tag immediately, without waiting for the 24-hour metadata cache to expire.

NEXUS-52536 - Docker GC tasks now evaluate all unreferenced blob assets across every page, ensuring unused layers beyond the first 100 are correctly identified and reclaimed during cleanup runs.

NEXUS-52434 – PCCS evaluation results for PyPI and npm proxy repositories are now cached and reused within the configured metadata maximum age window, so a single request to IQ Server serves all subsequent lookups until the cache expires. (Fixed for self-hosted deployments in 3.92.3)

NEXUS-52412 – Swift proxy repositories now successfully resolve and fetch packages through authenticated corporate HTTP proxies, replacing the previous JGit-based transport with Nexus's native HTTP client infrastructure.

NEXUS-51672 – Heap memory warnings now require sustained elevated usage across multiple consecutive samples before logging, preventing false alarms from normal sawtooth GC patterns on busy instances.

NEXUS-52199 – Yum hosted repository metadata rebuilds now use direct key lookups when checking RPM registration status, preventing rebuild tasks from stalling on large repositories.

NEXUS-51931 – npm group repositories now return valid JSON with a single deduplicated sonatype_filtered_versions field when multiple proxy members contribute filtered version lists.

NEXUS-51700 – Optimized NuGet v2 Search() requests for group repositories by moving filtering, sorting, and pagination to the database layer, significantly improving performance under concurrent load.

NEXUS-50780 – PyPI proxy and hosted repositories now correctly resolve package links regardless of trailing slash usage in simple index URLs, including when Firewall quarantine filtering is enabled.

NEXUS-50731 – OAuth2/OIDC configuration is now available through a public REST API, enabling administrators to manage OAuth2 settings programmatically. (Self-hosted deployments only)

NEXUS-52382 – Large Azure Blob Storage downloads now use bounded, backpressure-aware streaming to prevent heap exhaustion and OutOfMemoryError conditions during concurrent or slow-consumer downloads.

NEXUS-52362 – Maven group repositories now honor the lowest metadataMaxAge value from proxy members so merged maven-metadata.xml content refreshes correctly from upstream sources.

NEXUS-52333 – Helm proxy repository parsing failures for index.yaml now include full exception details and filenames in the error log, improving troubleshooting without requiring DEBUG logging.

NEXUS-52224 – Startup logging no longer writes the full nexus.properties configuration map, preventing sensitive values such as database credentials and JDBC URLs from appearing in plaintext logs.

NEXUS-52218 – The Malware Components CSV now reconciles findings against current Sonatype threat intelligence so reclassified or cleared components no longer appear as unresolved malware findings.

NEXUS-52197 – Verbose PortEx PE binary parsing output is now suppressed to WARN level in nexus.log during Firewall Audit and Quarantine scans of Docker proxy layers containing Windows executables.

NEXUS-51884 – npm proxy repository metadata ETags now refresh correctly after quarantined components are released through firewall report waivers, preventing stale package metadata responses.

NEXUS-51647 – The repository.blob.mismatch.task upgrade task now runs concurrently with other upgrade tasks, allowing critical post-upgrade processing to complete sooner.

NEXUS-51450 – The Automatic Malware Management task log now reports accurate quarantine states for malicious components detected in Firewall-enabled repositories.

NEXUS-50778 – APT snapshots now include i18n/Translation metadata files so Debian and Ubuntu clients can run apt update successfully against snapshot repositories.

NEXUS-47909 – Maven group repositories now return the correct hash file content for archetype-catalog.xml requests instead of returning a 500 error.

NEXUS-39223 – RubyGems group repositories now merge duplicate gem entries across hosted and proxy members into a single /versions entry so Bundler can correctly resolve shared gems.

NEXUS-22160 – Yum hosted repositories now support modules.yaml, enabling offline mirroring for RHEL 8+ and CentOS 8+ modular repositories.

NEXUS-51882 – PyPI hosted repositories now maintain consistent metadata during concurrent uploads by marking indexes as stale instead of deleting them, ensuring newly uploaded packages are accurately reflected.

NEXUS-51795 – User-configured SAML Entity ID URIs now take precedence over the browser URL when generating SP metadata and authentication requests.

NEXUS-51699 – The BlobRepositoryMismatch task now persists per-repository progress, resumes after restarts, logs progress periodically, and uses a CPU-scaled thread count instead of a fixed value.

NEXUS-51514 – The compact blob store task now continues processing when individual S3 deletions fail, logging failures at WARN level instead of stopping the task.

NEXUS-52054 - Terraform hosted repository signing key material and passphrase are now redacted in support zip configuration exports.

NEXUS-51930 - Conditional GET requests against proxy repositories now undergo Firewall policy evaluation, returning 403 Forbidden when a component is quarantined rather than incorrectly signaling 304 Not Modified.

NEXUS-51633 - PyPI repositories now automatically invalidate and rebuild stale indexes after Verify and Repair blob restore tasks complete, eliminating the need to manually trigger index regeneration via API calls.

NEXUS-51864 - Version-specific npm requests (such as /lodash/latest) no longer invalidate or corrupt the PCCS cache. Subsequent metadata requests now return the complete and correct set of package versions.

NEXUS-51814 - Docker tag pagination responses now correctly preserve connector-based paths when accessed via dedicated connector hosts or ports, ensuring Link headers remain compliant with the Docker Registry HTTP API V2 specification.

NEXUS-51659 - The Search API now returns an HTTP 400 response with a clear validation message when unsupported wildcard patterns (such as leading wildcards or short trailing wildcards) are used in the Repository Name field, replacing previous silent empty responses.

NEXUS-51540 - Maven group repository metadata now stays up to date when new component versions are uploaded to hosted repositories nested within sub-groups, ensuring accurate version resolution across group hierarchies.

NEXUS-51537 - PyPI group repository simple index pages are now served from cache on repeated access, eliminating unnecessary blob creation and improving performance.

NEXUS-51523 - The Data Repair Plan task now report "created plan entries" instead of "created plans," accurately reflecting the number of individual repair items identified rather than the number of executable repair plans.

NEXUS-51509 - Concurrent Policy Compliant Component Selection requests for the same PyPI or npm package are now deduplicated. Only a single evaluation request is sent to Firewall (IQ Server), with concurrent requests reusing the result.

NEXUS-51485 - Docker clients now receive a standards-compliant error response when Repository Firewall blocks a quarantined image. The response includes quarantine details and a link to the Firewall report directly in the JSON payload.

NEXUS-51389 - Repositories that fail to initialize during startup are now skipped and marked offline, allowing Nexus Repository to start successfully without being blocked by individual repository failures.

NEXUS-51334 - Improved logging for npm group repository fallback behavior. Messages are now logged at DEBUG level with clearer wording and no longer reference PCCS policy when Firewall is not configured.

NEXUS-51319 - npm proxy repositories now include valid ETag headers in conditional requests, allowing cached tarballs to return HTTP 304 responses and preventing unnecessary re-downloads and blob duplication.

NEXUS-51283 - RubyGems hosted repositories now perform incremental metadata updates when a single gem is uploaded, rather than rebuilding metadata for the entire repository. This improves performance but may affect environments with customized upload workflows.

NEXUS-51282 - Download URLs generated from UI search results now correctly reference the group repository path instead of underlying member repositories, allowing users with group-only permissions to access assets without encountering authorization errors.

NEXUS-51279 - Search API requests using unsupported wildcard patterns now return HTTP 400 responses with descriptive validation messages, ensuring consistent behavior across all search fields.

NEXUS-51266 - Improved PostgreSQL query performance for prefix-based component searches by enabling index scans on key search_components columns, reducing reliance on sequential table scans.

NEXUS-51247 - Concurrent requests for the same component no longer generate ERROR-level log entries when multiple threads update blob property files simultaneously

NEXUS-51112 - Increased timeout for Policy Compliant Component Selection when evaluating large PyPI packages (such as tensorflow and duckdb), allowing installations to complete successfully.

NEXUS-50782 - NuGet v2 proxy repositories now correctly follow OData pagination links for FindPackagesById queries, ensuring all package versions and dependencies are cached and installable in a single operation.

NEXUS-49855 - Prefix-based component name searches in High Availability deployments now return only components whose names begin with the specified term, ensuring accurate and predictable results.

NEXUS-48607 - The UI telemetry service now avoids repeated attempts to reach unavailable remote endpoints, eliminating long page load delays in air-gapped and network-restricted environments.

NEXUS-51488 - Terraform service discovery now requires repository-level endpoint access at /repository/{repository-name}/.well-known/terraform.json instead of root-level access. Terraform CLI can successfully discover hosted registry services through this endpoint, enabling module and provider resolution.

NEXUS-51407 - Maven proxy repositories now accept macOS Mach-O executables (such as ARM64 protoc binaries) when strict content type validation is enabled.

NEXUS-51397 - Blob repository mismatch tasks now process blobs concurrently across available threads, significantly improving completion time during post-upgrade validation.

NEXUS-51301 – Disabling IQ Server integration in Nexus Repository Cloud instances completes immediately without blocking or causing node unresponsiveness.

NEXUS-51267 - Failed login attempts are now recorded in the audit.log file with detailed authentication failure information, including failure reasons.

NEXUS-51248 - The secrets migration upgrade task now trims whitespace from proxy repository URLs, allowing successful migration of repositories created prior to version 3.89.0.

NEXUS-51152 - Swift proxy repositories now route Git operations through the HTTP proxy configured in the Nexus UI, removing the need for manual JVM configuration and restarts.

NEXUS-50878 – Task creation and update now prevent property-based overrides of the internal typeId field, ensuring the nexus.scripts.allowCreation security control cannot be bypassed through crafted task properties. This fix strengthens our resolution of CVE-2020-11753.

NEXUS-47471 – Database migration completes successfully when Maven components contain null attribute values, allowing the process to continue rather than fail with an error.

NEXUS-46360 – The Helm chart for External Secrets Operator configurations accepts an optional property field to extract specific keys from HashiCorp Vault KV v2 secrets stored in JSON format.

NEXUS-40929 - Repository Health Check columns and status requests are now hidden when IQ Server Firewall is enabled, preventing unnecessary API calls and timeout errors on large instances.

NEXUS-51311 - Capability state changes now complete without causing thread deadlocks that could block UI loading and API responses.

NEXUS-51210 - Maven group metadata remains available during blob store migration tasks, preventing temporary inconsistencies.

NEXUS-51191 - The Remove a member from a blob store group task now completes successfully when multiple instances run concurrently.

NEXUS-51164 - Log messages for invalid Maven metadata files now include the repository name, improving troubleshooting.

NEXUS-51040 – Docker proxy repositories handle bearer token authentication requests without encountering null pointer exceptions during HTTP context operations.

NEXUS-51030 - Proxy repository creation via the REST API no longer requires the blocked field, which now defaults to false when omitted.

NEXUS-50808 - Docker tag listing now handles large tag sets without causing a StackOverflowError during pagination.

NEXUS-50764 & NEXUS-39228 – Group repositories now properly detect policy-filtered version changes in member proxy repositories, ensuring metadata remains current and complete across npm and PyPI formats.

NEXUS-50585 - Upgrade tasks now skip and log deprecated task types, such as OrientDB backup tasks, instead of failing during processing.

NEXUS-50510 - DEBUG-level logging now records when SSRF protection blocks outbound proxy requests to private or local network addresses.

NEXUS-50471 - Docker container startup now detects existing memory settings in INSTALL4J_ADD_VM_PARAMS and avoids adding duplicate JVM parameters.

NEXUS-50384 - Docker content validation now correctly recognizes application/zstd layers, improving performance during image staging, push, and pull operations.

NEXUS-50322 - Staging delete operations now log additional request details, enabling troubleshooting without requiring TRACE-level logging.

NEXUS-47043 - Default reconcile thread usage has been reduced to better balance CPU consumption and minimize impact on smaller deployments.

NEXUS-37039 - Cleanup tasks now remove stale asset blob records for deleted blob stores, preventing repeated warnings and unnecessary data growth.

NEXUS-20520 - REST API endpoints now return HTTP 401 (Unauthorized) when authentication credentials are missing, ensuring proper authentication challenges.

NEXUS-50951 – From Nexus Repository version 3.89.0+, newly created Docker repositories must use lowercase names. This fix allows users to edit, via the UI, the configuration of upgraded Docker repositories that have mixed/upper case naming.

NEXUS-50929 – Terraform token authentication no longer applies to non-Terraform repository formats. Anonymous access to raw hosted repositories works correctly for paths matching /v1/providers/** patterns.

NEXUS-50761 – Repository browse displays all content for users with administrative permissions, regardless of any additional content selector privileges assigned through other roles.

NEXUS-50623 – npm group repositories now return valid JSON metadata with a single _id field instead of duplicating it at the top level.

NEXUS-50616 – Hugging Face proxy repositories correctly process filenames containing spaces and special characters by properly encoding URI segments in outbound requests.

NEXUS-50251 – Search indexing completes successfully for components with tens of thousands of associated file paths by implementing PostgreSQL parameter limits.

NEXUS-48954 – Session timeout values configured in the UI Settings capability now apply correctly in High Availability deployments, ensuring users remain logged in for the specified duration.

NEXUS-45172 – When attempting to redeploy an asset with the "Allow Redeploy" setting disabled, error messages now explicitly state that redeployment is not permitted for the repository, replacing the previous generic "blob upload invalid" message across all repository formats.

NEXUS-44209 – The Compact blob store task now successfully removes soft-deleted blobs after they've been relocated by the Remove a member from a blob store group task.

NEXUS-42338 – Yum repositories now correctly identify the architecture of signed RPM packages by reading metadata from the RPM header tags instead of the lead header.

NEXUS-39798 – Database connection failures during authentication now return HTTP 503 Service Unavailable instead of HTTP 401 Unauthorized, clearly indicating a server-side infrastructure issue rather than incorrect credentials.

NEXUS-39080 – Docker proxy repositories now return HTTP 404 (Not Found) instead of HTTP 400 (Bad Request) when remote content fails digest validation.

NEXUS-29440 – PyPI proxy repositories support remote URLs without the /simple endpoint by allowing an empty index path configuration for services like GemFury and NVIDIA PyPI.

NEXUS-50621 – APT hosted repositories now correctly include all package versions in generated Packages files for each architecture. (Also fixed in self-hosted 3.89.1.)

NEXUS-50612 – Upgraded installations now successfully migrate the asset_blob_size column when upgrading directly from versions prior to 3.67.0 to 3.87.0 or later, ensuring artifact uploads complete without database errors.

NEXUS-50592 – Content selectors now appear in alphabetical order within the Repository Content Selector Privilege dropdown, making it easier to locate specific selectors when working with large lists.

NEXUS-50362 – Maven repositories now correctly return HTTP 404 responses when requesting non-existent hash signature files with compound extensions like `.md5.asc`.

NEXUS-50277 – Improved repository synchronization in high availability deployments to maintain consistent state across all nodes during concurrent deletion operations.

NEXUS-50273 – Improved Quartz scheduler initialization to prevent extended startup delays, reducing the time required for Sonatype Nexus Repository to become fully operational after restart.

NEXUS-50243 – Improved Maven group metadata accuracy to consistently reflect the latest artifact versions across nested group configurations.

NEXUS-50153 – Yum group repositories now serve cached metadata to clients while regenerating merged metadata in the background, preventing incomplete repodata responses during the merge process.

NEXUS-48604 – Enhanced LDAP credential rotation to maintain consistent cache synchronization across all nodes in high availability clusters. (Also fixed in self-hosted release 3.89.1.)

NEXUS-47776 – Improved URL encoding handling in proxy repositories to preserve special characters in redirect URLs, ensuring successful retrieval of artifacts from remote sources.

NEXUS-47618 – Cleaned up Prometheus metrics by removing unused S3 blob store timers that always displayed zero values.

NEXUS-46841 – Improved Docker token request handling to reliably process concurrent authentication attempts from the same client.

NEXUS-46805 – Non-administrator users can now configure Content Replication with repository-specific privileges without encountering permission errors.

NEXUS-46315 – Added JVM memory and garbage collection monitoring logs to help diagnose system resource issues across all deployment configurations.

NEXUS-44226 – Added a new paginated REST API endpoint for retrieving SAML users, with the existing endpoint now limiting results to 100 users to improve performance and scalability for large user bases.

NEXUS-43881 – Improved browse tree cleanup in YUM repositories to properly remove directory nodes when deleting duplicate RPM files uploaded to multiple paths.

NEXUS-42251 – Optimized repository export performance by caching delta file data in memory, significantly reducing prerequisite checking time when exporting large repositories to network file systems.

NEXUS-40204 – Optimized HEAD request handling for proxy repositories to return header information immediately without downloading full content from remote sources, improving response times and preventing timeout errors.

NEXUS-50435 – Improved the search API to properly handle the prerelease parameter when using H2 databases.

NEXUS-50105 – Docker images imported into hosted repositories now retain their correct content-type metadata, ensuring manifests and tags can be pulled successfully.

NEXUS-49708 – IQ Server connection verification now properly validates that the configured user has the required permissions before allowing the configuration to be saved.

NEXUS-49531 – Enhanced security by upgrading the CycloneDX core library to address an XML External Entity (XXE) injection vulnerability.

NEXUS-47362 – ROOT logger level changes now persist correctly after restarting Nexus Repository.

NEXUS-47010 – Proxy repository authentication passwords containing special characters save as expected even when pre-emptive pull is enabled.

NEXUS-44467 – Maven POM files can now be uploaded through the UI when the version number contains hyphens or other suffixes.

NEXUS-13303 – Email server connections now properly support plaintext communication when the Use the Nexus Trust Store option is enabled without SSL/TLS encryption options selected.

NEXUS-50419 – Updated the image scanning process to ensure temporary resources are properly cleaned up, improving system stability and preventing potential memory issues.

NEXUS-50338 – LDAP configuration updates via REST API now reliably preserve all required fields during credential rotation and server configuration changes. (Fixed in self-hosted 3.89.1)

NEXUS-50313 – The log management API now works as expected to retrieve audit or request type events in Nexus Repository Cloud environments. Documentation will also be available soon.

NEXUS-50240 – Anonymous access to Terraform proxy repositories now correctly allows unauthenticated users to retrieve provider versions without receiving a 401 response.

NEXUS-50163 – The user interface handles rapid navigation during page loading without encountering null reference errors.

NEXUS-50133 – Support zip log files now truncate from the bottom up, preserving the most recent log entries needed for effective troubleshooting.

NEXUS-50116 & NEXUS-50151 – Resolved an issue with the Repair - Execute Data Repair Plan task that previously led to some unexpected assets being removed. Note that this task remains disabled by default in release 3.89.0.

NEXUS-50112 – Importing Docker images no longer removes the /library/ namespace prefix.

NEXUS-50056 – Docker tag list responses now include the correct Link header path when requests are made using repository or path-based URLs.

NEXUS-50040 – The REST APIs for Hosted Repository Analysis now evaluate artifacts without returning an HTTP 500 error, preventing a NullPointerException when determining repository scan support.

NEXUS-49769 – Uploading RPMs to a Yum hosted repository no longer leaves behind empty repodata folders in the Browse UI.

NEXUS-49722 – Search results for pre-upgrade components with underscores in the group name now return correctly after upgrading without requiring a manual search index rebuild.

NEXUS-49164 – Wildcard searches in HA environments now correctly return results when the search term includes a hyphen-prefixed token.

NEXUS-48701 – The nexus_cluster.log file is no longer created when using H2 or PostgreSQL, eliminating confusion caused by an unused log file in non-OrientDB environments.

NEXUS-48281 – Task execution durations now reflect the actual start time of each task, ensuring the Last Result column shows accurate elapsed time when tasks run concurrently or are queued.

NEXUS-47819 – The REST API now allows all roles to be removed from a SAML user, matching the behavior available in the UI and enabling consistent role management through automation.

NEXUS-47716 – UI metrics for total components and peak request rates now match the values returned by the /service/metrics/data API.

NEXUS-47433 – The npm v1 search now returns accurate and complete results even in large repositories with many assets.

NEXUS-46398 – npm login and logout actions are now captured in the audit log.

NEXUS-45352 – NuGet group repository queries no longer return a 500 error when a proxy member is manually blocked; cached metadata is now served correctly without requiring remote access.

NEXUS-44432 – After a UI session timeout, the Go Back button on the unsaved changes popup now behaves as expected or no longer appears unnecessarily.

NEXUS-44177 – NuGet V3 proxy repositories now return accurate search results after replication, even when the remote source is blocked or the original component has been deleted.

NEXUS-40099 – Warning messages about invalid active nodes in clustered deployments are now clearer and include actionable context.

NEXUS-30682 – The cURL example for the tasks/{id}/run endpoint in the Swagger UI now includes the correct headers and formatting.

NEXUS-23799 – The distribution field is no longer required when configuring an Apt proxy repository.

NEXUS-11917 – Nexus Repository now better handles misconfigured or unreachable IQ Server connections by providing clearer error messages and reducing unnecessary log noise.

NEXUS-50183 – Uploads to Azure blob stores now apply backpressure to limit in-memory chunk accumulation, preventing OutOfMemoryError during large file proxying and improving stability for high-concurrency environments.

NEXUS-49485 – Requests to APT hosted repositories now block until metadata is available during rebuilds, preventing transient 404 responses and ensuring more reliable package retrieval in high-traffic environments.

NEXUS-49265 – Searches in the Namespace, Name, and Version columns in HA environments now return only exact matches unless a wildcard is explicitly included, restoring the expected strict matching behavior.

NEXUS-48975 – Creating new Docker repositories with mixed case names is now blocked to ensure compatibility with path-based routing and align with Docker's lowercase naming requirements.

NEXUS-48956 – Added logging to the browse node migration upgrade step to provide visibility into potentially long-running schema changes on large browse_node tables.

NEXUS-46771 – NuGet v2 proxy repositories now proactively prefetch package dependencies.

NEXUS-44560 – Made adjustments to safely handle a race condition during repository recreation to prevent failures when uploading content or starting facets after rapidly deleting and recreating a repository with the same name.

NEXUS-28286 – Browsing behavior now respects content selectors as expected.

NEXUS-49996 – Improved repository deletion performance and reliability by optimizing role privilege cleanup and addressing race conditions across HA nodes.

NEXUS-49970 – Improved performance of delta APT metadata rebuilds for large hosted repositories by optimizing how metadata updates are written to the database.

NEXUS-49845 – Corrected a race condition that caused npm group metadata updates to fail when handling non–URL-safe package names.

NEXUS-49758 – Group repositories now correctly honor the offline status of member proxy repositories.

NEXUS-49414 – Updated permission checks in the Browse interface.

NEXUS-47679 – Improved synchronization of password changes across HA nodes to ensure updated credentials are recognized immediately.

NEXUS-45388 – Improved the Admin - Cleanup Tags task to gracefully handle missing components by skipping over them.

NEXUS-42793 – Improved PyPI index page handling in Repository Firewall by filtering out invalid component versions during processing.

NEXUS-38502 – Corrected YUM group metadata handling so repositories with invalid or missing member metadata no longer return an empty repomd.xml, instead rebuilding metadata or returning a 404 to reflect the invalid state accurately.

NEXUS-50063 – Improved documentation around Firewall fail-open mode.

NEXUS-49991 – Updating an S3 blob store's Access Key no longer triggers an invalid state error when the blob store is already running, preventing it from entering a failed state and avoiding unnecessary instance restarts.

NEXUS-49940 – SAML SSO in the UI now correctly redirects to the identity provider when using a custom context path.

NEXUS-49924 – Reduced overhead during permission checks, resulting in faster performance for environments with frequent authorization lookups. As part of this fix, we created a new cache to manage each user's permissions. This cache is enabled by default, but administrators can disable it with nexus.security.principal.permissions.cache.enabled=false.

NEXUS-49902 – The Verify and Repair Data Consistency tasks now correctly handle group blob stores.

NEXUS-49901 – Group blob stores in a high-availability deployment now start correctly after an upgrade.

NEXUS-49893 – Cargo group repositories now correctly generate and serve package metadata, allowing cargo build commands to succeed when resolving dependencies through a group instead of requiring direct access to individual proxy repositories.

NEXUS-49883 – Regenerated .properties files during data repair now correctly restore the original @BlobStore.blob-name value instead of using the internal blob path.

NEXUS-49792 – The user interface now automatically trims leading and trailing spaces from proxy repository URLs.

NEXUS-49791 – Trailing spaces in proxy repository remote URLs no longer cause errors in startup tasks.

NEXUS-49777 – NuGet V3 search queries now return the correct totalHits value and properly exclude pre-release packages when specified.

NEXUS-49744 – NuGet metadata now preserves dot separators in target framework monikers.

NEXUS-49729 – The Repair - Rebuild repository search task now processes assets in batches, preventing PostgreSQL parameter limits from being exceeded.

NEXUS-49651 – Resolved a deadlock condition that was sometimes occurring during remote event processing in high-availability deployments.

NEXUS-49606 & NEXUS-49502 – Component search and the /v1/search/assets API now return results correctly for group IDs containing uppercase letters in non-HA environments.

NEXUS-49573 – The Upload Component button has been restored in the Browse view for hosted repositories.

NEXUS-49489 – npm tarballs are now correctly served from group repositories even when member proxies have differing PCCS waiver configurations.

NEXUS-49371 – NuGet V2 status checks no longer show a misleading warning on HA node startup when no NuGet V2 repositories exist.

NEXUS-49127 – The Repair - Rebuild npm metadata task now fully regenerates metadata from existing package versions, removing references to deleted packages.

NEXUS-49069 – Uptime log entries once again include the running Sonatype Nexus Repository version during startup and shutdown, making it easier to identify the source version when investigating upgrade-related support cases.

NEXUS-49035 – The Nexus Repository Operator no longer includes the chart version in StatefulSet names, ensuring PersistentVolumeClaims retain consistent names across upgrades and allowing reuse of existing storage.

NEXUS-48992 – Search results from the /rest/v1/search/assets API are no longer silently truncated at 10,000 items, as the removal of Elasticsearch eliminates the underlying limitation that caused incomplete responses without indication.

NEXUS-48945 – The Repair - Rebuild npm metadata task now preserves the existing latest tag based on publish order.

NEXUS-48893 – Yum repositories now recognize architecture as part of a component’s identity, allowing multiple RPMs with the same name and version but different architectures to coexist when using a deploy-once policy.

NEXUS-48881 – Outbound request logs now consolidate all relevant details into a single line, including the HTTP method and response time.

NEXUS-48839 & NEXUS-48905 – Docker Bearer Token authentication now uses the correct token URL when anonymous pull is enabled.

NEXUS-48531 – PyPI group repositories now serve previously cached metadata when PCCS evaluations time out.

NEXUS-48147 – The Nexus HA Helm chart now uses a centralized and consistent naming mechanism for StatefulSets, removing the nonfunctional statefulset.name parameter to avoid confusion and ensure predictable resource naming.

NEXUS-47784 – Database migration errors now include full query parameters in the logs.ons.

NEXUS-47774 – Migrations from Nexus Repository 2 now correctly preserve the fileTypeValidation setting by mapping it to strictContentTypeValidation in Nexus Repository 3.

NEXUS-47646 – The Repair - Rebuild Maven repository metadata task is properly triggered when necessary, even if the initial move operation encounters errors.

NEXUS-47285 – The malware evaluation task now skips components with missing or empty hashes instead of failing.

NEXUS-47092 – Maven metadata at the group-artifact level is now correctly maintained when artifact and group IDs overlap.

NEXUS-46700 – Removed inapplicable API endpoints from Nexus Repository Community Edition Swagger.

NEXUS-46696 –The Search API now correctly filters results by maven.extension and maven.classifier.

NEXUS-46565 – Log messages about duplicate browse nodes are now recorded at the DEBUG level instead of WARN.

NEXUS-46095 – Large PostgreSQL migrations no longer fail due to heap exhaustion, as the database migrator now cleans up accumulated component and asset data during and after processing to significantly reduce memory usage.

NEXUS-45786 – The Search Assets API now returns a 400 Bad Request with a clear error message when an invalid sort field is used.

NEXUS-45636 – Conan 2 search in HA deployments now returns up to 10,000 results by default.

NEXUS-45425 – Removed the Version Policy, Layout Policy, and Content Disposition fields from the UI for creating Maven group repositories.

NEXUS-45400 – Improved performance of the internal group member cache to reduce delays and failures during search operations.

NEXUS-45399 – Modifying a Docker cleanup policy using the REST API no longer causes the UI to hang when editing the policy.

NEXUS-45299 – Optimized how large XML files are merged to improve Yum group metadata rebuilds.

NEXUS-45291 – Warning logs for group repository metadata generation now include the names of member repositories missing ETag headers, making it easier to identify the source of repeated and expensive metadata rebuilds.

NEXUS-44810 – Updating a proxy repository with an invalid remote URL works as expected.

NEXUS-44434 – Session timeouts in one browser tab no longer log out other active tabs.

NEXUS-43699 – Nexus Repository now preserves the scripts section from package.json when npm packages are uploaded to a hosted repository via the UI, REST API, or import task.

NEXUS-43451 – The /rest/v1/search/assets API consistently returns results based solely on asset-level content selector permissions.

NEXUS-41276 –The Component Upload API documentation no longer lists unsupported Docker parameters.

NEXUS-41229 – Repository content selector privileges can now be created and updated via the REST API using format-specific wildcards like *-maven2.

NEXUS-40005 – Improved npm search index handling to prevent creation of excessive and redundant assets.

NEXUS-39789 – The Docker garbage collection task now logs detailed reasons when a V2 manifest is invalid.

NEXUS-39514 – Pagination using the from parameter in the npm /v1/search endpoint works correctly.

NEXUS-39468 – npm audit requests made to group repositories now correctly track and associate the responding proxy repository.

NEXUS-39374 – Cached Docker blob layers can now be deleted from Docker proxy repositories using the same HTTP DELETE requests supported by hosted repositories.

NEXUS-37810 – Strict Content Type Validation now correctly recognizes the MIME type application/x-sharedlib.

NEXUS-35782 – The Roles REST API now returns all directly contained roles and privileges for SAML-based roles.

NEXUS-35758 – Nexus Repository now checks whether an H2 database exists before attempting a restore.

NEXUS-34513 – Asset paths in the Browse and Search views now display with a leading slash.