Skip to main content

Older Nexus Repository 2 Release Notes

Nexus Repository 2

Repository Manager 2.14.2

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.14.2.

New and Noteworthy

Nexus 3 Upgrade Improvements

Nexus Repository Manager 2.14.2 is forward upgrade compatible with the forthcoming 3.2.0 release. Upgrading 2.14.2 into Nexus Repository Manager 3.1.0 will be blocked - releases going forward will include a compatibility check as a reminder.

Nexus Repository Manager3 adoption is growing rapidly and we identified a few edge case problems with the upgrade process. We've worked hard to get some more fixes out there for you in this release.

General Improvements


  • [NEXUS-11732] Bug Prevent ClassCastException when handling StorageLinkItem during upgrade to Nexus 3

  • [NEXUS-11921] Improvement Explicitly prevent quarantine enabled Nexus 2 repositories from upgrade into Nexus 3

  • [NEXUS-11301] Bug Upgrade to Nexus 3 fails if Nexus 2 has no anonymous user defined

  • [NEXUS-11923] Improvement perform version compatibility check when upgrading from Nexus 2.x to Nexus 3.x

  • [NEXUS-11925] Bug Nexus 2 to Nexus 3 upgrade may fail with NullPointerException Cannot invoke method extract while processing RepositoryChangelogResource

  • [NEXUS-11874] Bug npm packages cannot be migrated due to IllegalStateException PackageVersion expected when contained in a rebuilt hosted repository


  • [NEXUS-11219] Bug Drop Inactive Staging Repositories task aborts if a repository is not found


  • [NEXUS-10987] Bug NoClassDefFoundError for SSLSocketImpl on non-Oracle JVM prevents proxying HTTPS remote

Repository Manager 2.14.1

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.14.1.

New and Noteworthy

3.1 Future Upgrade Capability Included

This is the first release that can support upgrade to the future 3.1 final version. We are releasing 2.14.1 in advance of the 3.1 release so that Nexus Repository Manager administrators can begin preparing and planning for their eventual 3.1 upgrade.

Repository Manager 2.14

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.14.

New and Noteworthy

This is a bug fix release to address some critical issues affecting certain customers.

Attention Maven Snapshot Remover Task Users

A regression in the Snapshot Removal scheduled task introduced in 2.11.4 that causes certain files to not be deleted has been fixed in this release. Upgrading will prevent old snapshot releases from consuming unnecessary disk space.

General Improvements


  • [NEXUS-10154] Bug OrientDb allocates massive disk cache on large systems performance

LDAP,RUT Auth,User Token

  • [NEXUS-10794] Bug user tokens do not work in combination with RUT Auth and LDAP realms


  • [NEXUS-10881] Improvement upgrade OrientDB to version 2.1.14 to properly handle nexus-work UNC paths


  • [NEXUS-9307] Bug temporary nx-tmp-content-locator files may not be reliably cleaned up


  • [NEXUS-10233] Bug Central automatic routing results discarded because Prefix file size exceeds maximum allowed

Scheduled Tasks

  • [NEXUS-10460] Bug Regression: Maven snapshot remover does not remove asc, md5, and sha1 files performance


  • [NEXUS-10225] Bug non-admin users may be unable to see or edit IQ Server Application in staging profile edit screen

  • [NEXUS-10882] Improvement upgrade Apache Shiro dependency to 1.3.1 to pick up recent security fixes

Repository Manager 2.13

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.13.

New and Noteworthy

The Nexus Firewall solution now has the ability to release a component from quarantine. Also, you can now override a vulnerability of a repository component. For more details, see IQ for Repository Manager. Upgrading IQ Server to 1.20 or greater is required.

General Improvements


  • [NEXUS-9843] Improvement improve logging when a retry is made in response to remote socket exceptions


  • [NEXUS-10017] Bug Unable to delete npmjs proxy repo


  • [NEXUS-9865] Bug InvalidPathException prevents installing gems when Nexus is running on Windows


  • [NEXUS-9897] New Feature rc-open goal for nexus-staging-maven-plugin

Repository Manager 2.12.1

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.12.1.

New and Noteworthy

Repository Health Check (RHC) analysis support for npm repositories

Sonatype is pleased to expand support for health analysis of your proxy repository npm packages sourced from the official npm registry. Data available at this time includes identity and vulnerability information. We will continue to expand our support to include more data and other repository formats. (NEXUS-9854)

RubyGems Improvements

We fixed some important issues affecting RubyGems repositories users and encourage everyone using Rubygems with Nexus Repository Manager to upgrade.

Nexus UI XSS Vulnerabilities Squashed

A recent security audit discovered some Cross Site Scripting vulnerabilities in versions of Nexus Repository Manager from 2.8.1 to 2.12.0. While there are no known exploits of these vulnerabilities, Sonatype recommends upgrading to Nexus Repository Manager2.12.1 to minimize the risk to your Nexus Repository Manager instance. (NEXUS-9893)

General Improvements

Build Tooling,UI

  • [NEXUS-9774] Bug UI javascript files are not compressed/minimized


  • [NEXUS-9541] New Feature allow setting java.naming.referral for LDAP connections performance


  • [NEXUS-9730] Improvement licensing UI should show distinction between recent connections and total licensed users


  • [NEXUS-9785] Bug Nexus startup no longer logs the edition


  • [NEXUS-9573] Bug all proxied repository items should have "remoteUrl" attribute set

  • [NEXUS-9786] Bug IllegalArgumentException Tar does not contains /package.json rebuilding metadata for some npm packages

NPM,Scheduled Tasks

  • [NEXUS-9856] Bug running rebuild npm hosted metadata scheduled task can change repository value


  • [NEXUS-9612] Bug better protect against conflicting simultaneous deploys of the exact same file performance


  • [NEXUS-9790] Bug REST client JerseyArtifactMaven does not properly handle packaging parameter

Repository Health Check

  • [NEXUS-9854] New Feature Repository Health Check (RHC) analysis support for npm repositories


  • [NEXUS-9618] Bug rubygems proxy repository not found cache not consulted performance

  • [NEXUS-9705] Bug expire cache task on rubygems repositories may lead to /api/v1/dependecies api performance degradation performance

  • [NEXUS-9637] Bug rubygems proxy repository does not respect Artifact Max Age for gem files performance

  • [NEXUS-9551] Bug installing gems with long dependency chains can trigger IOException File name too long


  • [NEXUS-9636] Bug revert Basic auth realm name change introduced in 2.12.0


  • [NEXUS-9634] Bug /service/local/staging/bulk/promote resource does not check drop privilege


  • [NEXUS-9439] Bug deadlock between mergeropo and staging promotion


  • [NEXUS-9652] Bug xml:base URL in proxied yum metadata files is not rewritten

Repository Manager 2.12

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.12.

Sonatype Branding Updates

Our Sonatype products have aligned under the Nexus portfolio brand. You may notice some product related wording changes. We have an article to help make sense of it all.

Nexus Firewall Support Added

This is the first version of Nexus to support Nexus Firewall, which allows you to block undesirable components from getting into your repositories when integrated with Nexus IQ Server.

General Improvements


  • [NEXUS-9026] Bug orientdb may not fully recover from a restore process due to OCommandExecutionException: Class 'OUSER' was not found in current database

  • [NEXUS-7936] Bug orientdb recovery on startup performs slowly

NPM,Scheduled Tasks

  • [NEXUS-8970] Bug Aborted walking on repository ID='npmjs' from path='/.nexus/trash/'.


  • [NEXUS-9046] Improvement remove codehaus snapshots from default configuration


  • [NEXUS-9158] Bug help text in routing rules is wrong


  • [NEXUS-9545] Bug concurrent requests to ruby proxy at /api/v1/dependencies resource using the same url can hang performance


  • [NEXUS-8974] Bug Yum updates to build promotion repositories are not propagated to their parent group repositories

Repository Manager 2.11.4

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.11.4.

New and Noteworthy

Upgrade to Prevent Possible SSL Socket Timeouts

Users proxying https repositories should upgrade. We've fixed a critical issue that caused SSL sockets to never timeout if the remote server started to misbehave. NEXUS-8856

Performance Improvements

We continue our efforts to reduce performance bottlenecks. For example:

  • snapshot removal task speed has been increased by an order of magnitude NEXUS-8724

  • disk space required for the npm metadata database is reduced NEXUS-8737

  • the repository list rendering speed and CPU activity has been reduced significantly for non-admin users. NEXUS-8834

Request Log Now Even More Useful

We have made improvements to the Nexus Repository Manager request log to allow better auditing of request activity.

  • in certain cases, the authenticated user making the request was not logged - this has been fixed NEXUS-7860

  • elapsed time is now recorded as the last field of the log pattern format - this can help identify particularly slow requests NEXUS-8913

  • the request.log is archived with a more compatible name: request-YYYY-MM-DD.log.gz, instead of request.log.YYYY-MM-DD.gz NEXUS-8737

Outbound Storage Requests From Nexus Can Be Easily Monitored

A special logger named has been available for a while at DEBUG level to help identify the requests Nexus Repository Manager makes to other proxy repositories. Now this logger logs before and after the request, includes the response status, elapsed time, and any redirect information. NEXUS-8855, NEXUS-8837

General Improvements


  • [NEXUS-8850] Improvement add uptime log message on shutdown


  • [NEXUS-8894] Bug If CLM server is configured, but CLM server isn't running, capabilities UI will not render


  • [NEXUS-8849] Bug improve robustness to orientdb shutdown after stopping the store


  • [NEXUS-8746] Bug gradle simple-project-staging sample project uses an obsolete version of the nexus-staging-ant-tasks


  • [NEXUS-8737] Bug npm database grows unexpectedly large on cache expired requests performance


  • [NEXUS-8829] Bug outreach does not detect http global configuration changes

Proxy Repository,Transport

  • [NEXUS-8837] Improvement logger should include http response status and have consistent format


  • [NEXUS-8676] Bug mime detection may not cache properly for specific request paths

  • [NEXUS-8930] Bug outbound http connections may be immediately closed on 304 response with ETAG instead of pooled performance


  • [NEXUS-8834] Bug service/local/repository_statuses can have performance implications with large numbers of repositories performance

Scheduled Tasks

  • [NEXUS-8724] Improvement improve snapshot remover tasks performance by reducing potential i/o performance


  • [NEXUS-8821] Improvement add useful logging for siesta/wonderland/authenticate resource username mismatch


  • [NEXUS-8911] Bug releasing a yum enabled staging repository overwrites yum metadata in release repository

Support Tools

  • [NEXUS-8920] Improvement archived request.log name format should be more easily recognized as a log file compatibility

  • [NEXUS-7860] Bug request.log does not include authenticated userid for certain requests

  • [NEXUS-8913] Improvement add elapsed request time to request.log


  • [NEXUS-8855] Bug logging reports protocol downgrade when there isn't one

  • [NEXUS-8856] Bug outbound ssl sockets do not timeout if the remote does not respond


  • [NEXUS-8656] Bug non proxy hosts tooltip suggests a misleading syntax

User Token

  • [NEXUS-8036] Improvement User Token Protect Content feature should return 401 with message

Repository Manager 2.11.3

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.11.3.

New and Noteworthy

Notable NPM Repository Improvements

A host of important NPM repository issues and features have been resolved - users of NPM repositories are strongly encouraged to upgrade to this release.

Nexus Lifecycle (formerly CLM) Plugin Updates

Several enhancements have been made, including the ability to test the server connection and verify application access from the user interface. Log messages are improved when problems are encountered.

NuGet Download Feeds Task Now Disabled

As mentioned first in Nexus Repository Manager 2.10 release notes, the Download NuGet Feed Task is no longer needed. A reminder was published May 11, 2015. In Nexus Repository Manager 2.11.3, any existing scheduled tasks are non-operable and should be explicitly removed.

Forgot Password feature removed

Due to identified performance issues that could lead to stability problems if abused (NEXUS-8070) and limited use, the forgot password feature has been removed.

General Improvements

Browse Remote,Transport

  • [NEXUS-8083] Bug Connection leak in Browse Remote when content encoding is gzip performance


  • [NEXUS-8343] Improvement make it easier to find the nexus software license


  • [NEXUS-8147] Bug Cannot initially view CLM Component Info in first record searched


  • [NEXUS-8224] Task Update OrientDB from 2.0.2 to 2.0.4


  • [NEXUS-8425] Bug nexus pro log may report nexus as unlicensed on startup even when it is

Maven Repository

  • [NEXUS-8221] Bug Rebuild Metadata creates incorrect md5 and sha1 for maven-metadata.xml

  • [NEXUS-8178] Bug artifact attributes files can contain wrong checksum values


  • [NEXUS-8043] Bug rebuild hosted npm metadata task metadata parsing errors

  • [NEXUS-8062] Bug impossible to delete stale hosted npm repository metadata

  • [NEXUS-8389] Bug npm plugin does not work with UNC paths

  • [NEXUS-8568] Bug prevent OConcurrentModificationException when expiring not found cache and updating package metadata at the same time for a npm repository

  • [NEXUS-8290] Bug npm proxy attempts network access when in blocked state, results in 500 response

  • [NEXUS-8555] Bug not found cache should be expired for packages with implied references from updated package metadata

  • [NEXUS-8567] Bug expire cache task on npm group repositories should not abort when there is a problem processing member repositories

  • [NEXUS-8039] Improvement performance advice in logs when querying npm all resource

  • [NEXUS-8625] Bug Allow fetching of tarballs from incomplete NPM packages

  • [NEXUS-7806] Improvement npm groups should merge versions of the same package in different members compatibility

  • [NEXUS-8624] Bug Replace NPM package root when proxying (instead of merging the content)

  • [NEXUS-8570] Improvement improve the experience when npm package files are requested before npm metadata


  • [NEXUS-8523] Improvement deprecate and disable the "download nuget feed" scheduled task

Proxy Repository

  • [NEXUS-8080] Bug concurrent request paths cause ItemNotFoundException during population of not found cache


  • [NEXUS-8226] Improvement Create a task to find and fix bad checksums affected by the extra link detection check

  • [NEXUS-7654] Bug Invalid/missing checksums in proxy repositories are cached forever

  • [NEXUS-8004] Bug "failed content integrity validation" message when remote returns 404

  • [NEXUS-8700] Bug specially crafted proxy repository GET requests can delete already cached storage paths security

  • [NEXUS-8608] Improvement avoid extraneous file system access checking File.lastModified in local repository storage


  • [NEXUS-5904] Improvement Remove the mirrors tab from hosted repositories


  • [NEXUS-8186] Bug RubyGems repository - error fetching gem from internal gem server

  • [NEXUS-8144] Bug expire proxy cache does not force fetching a new specs file from the remote

  • [NEXUS-8114] Bug Rubygems index fails on Windows share

Scheduled Tasks

  • [NEXUS-6048] Improvement improve Remove Releases from Repository task performance performance

  • [NEXUS-8261] Improvement Add support to set base-url-holder value for scheduled tasks


  • [NEXUS-8070] Bug forgot password feature performs badly with external realms compatibility performance


  • [NEXUS-8556] Bug staging.xml validation can orphan nexus.xml repositories during startup


  • [NEXUS-8130] Bug Regression: Yum enabled staging repositories can't be released if target release repository contains yum metadata

Support Tools

  • [NEXUS-8076] Bug support zip generation fails if system has mounted clearcase volumes

  • [NEXUS-8077] Bug OFF log level for Loggers visible as TRACE in the UI


  • [NEXUS-8195] Bug Deadlock between yum merge metadata task and yum generate metadata task performance

Repository Manager 2.11.2

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.11.2.

Release History

2.11.2-06 - Mar. 16, 2015

Nexus Repository Manager 2.11.2-03 users should upgrade - see our article for more information.

  • includes scheduled task Reconcile Repository Checksums that fixes bad checksums created by NEXUS-8221

2.11.2-04 - Mar. 6, 2015

  • includes critical preventative fix for NEXUS-8221 - Bug metadata generation creates incorrect md5 / sha1

2.11.2-03 - Feb. 23, 2015

  • initial 2.11.2 public release

New and Noteworthy

Session Cookie Name Change

To help avoid conflicts with other web applications, the session cookie name required by the Nexus Repository Manager user interface has changed from JSESSIONID to NXSESSIONID. The cookie name is now configurable in case you need to revert this change.

Session Cookie Secure Attribute Set Dynamically

If Nexus detects that the inbound request originates over HTTPS, then Nexus Repository Manager now sets the Secure flag on the session cookie. If you have problems with web browser sessions when a server other than Nexus Repository Manager handles the secure connection, then make sure your fronting server is sending Nexus the X-Forwarded-Proto: https header value. See our book for reverse proxy configuration advice.

Attribute File Access Is Now Blocked By Default

Nexus Repository Manager now blocks HTTP access to paths which include the special storage directory .nexus/attributes. Customers should avoid relying on direct access of attributes files. Some customers may have relied on accessing these files over HTTP to work around rare problems. In cases where access to these files are still required, we have an article which explains how to restore access.

npm Repository Scheduled Tasks Added

Two new scheduled tasks have been added for npm repositories - Backup npm metadata database and Rebuild hosted npm metadata. We advise that users of Hosted npm Repositories consider scheduling the backup task.

Java 8 Official Support

Nexus Repository Manager has worked well with Java 8 since version 2.10. In preparation for the end of Oracle public updates for Java 7, we have updated our complete build and testing infrastructure to ensure Java 8 remains a solid platform on which to run Nexus Repository Manager. [NEXUS-7330]

General Improvements

Maven Repository

  • [NEXUS-7808] Bug non-snapshot versions containing SNAPSHOT can bypass a release repository Deployment Policy


  • [NEXUS-7974] Task Update NPM plugin to use OrientDB 2.0

  • [NEXUS-7835] Improvement provide a scheduled task to rebuild the npm metadata from storage data for hosted repositories

  • [NEXUS-8072] Improvement provide a scheduled task to backup npm metadata


  • [NEXUS-7873] Bug produces OBR metadata which cannot be parsed by felix 4.4.1


  • [NEXUS-7881] Improvement allow nexus 2.x to load outreach content by version,edition and user

Proxy Repository


  • [NEXUS-7933] Bug Delete repository does not work if trash and repository directories are on different file systems

  • [NEXUS-7850] Improvement Ban content which could be interpreted as a "link" to be uploaded or downloaded

  • [NEXUS-7834] Bug Nexus allows direct access to trash directory through content URL's. security

  • [NEXUS-7903] Bug resuming downloads for unsatisfiable Range should respond with 416 or 200 instead of 206

  • [NEXUS-7650] Technical Debt Upgrade to Apache Tika 1.7 for better mime detection

  • [NEXUS-8058] Improvement block access to .nexus/attributes files by default

  • [NEXUS-7929] Bug maven site deployments with .. in paths fail


  • [NEXUS-7927] Bug Deletion of ruby gems via REST fails on Windows


  • [NEXUS-6246] Bug Checksum search fails after repair index task is run


  • [NEXUS-7889] Bug RUT Auth does not work for /content URL's

  • [NEXUS-7882] Bug /service/local/authentication/logout should ask the user-agent to delete the session cookie


  • [NEXUS-5830] Bug /service/local/status resource creates http sessions

  • [NEXUS-7880] Improvement change the default Nexus session cookie name

  • [NEXUS-7879] Improvement generate dynamic Secure parameterized cookies based on HttpServletRequest.isSecure()


  • [NEXUS-7877] Improvement prevent nexus from sending rememberMe=deleteme cookie

  • [NEXUS-7878] Improvement prevent restlet resources from sending duplicate Date and Server headers


  • [NEXUS-3540] Bug Copyright date in "Help/About" needs to be updated

Repository Manager 2.11.1

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.11.1.

Security Advisory: Directory Traversal

This release fixes a critical security issue. All Nexus Repository Manager instances should upgrade.

Details about this vulnerability can be found here.

General Improvements


  • [NEXUS-7731] Bug limit size of analytics event zip files at creation and submission performance

  • [NEXUS-7739] Improvement capture generation time in analytics event-zip header.json as reference


  • [NEXUS-7837] Bug ODirectMemoryViolationException: Negative offset was provided 500 error requesting npm metadata


  • [NEXUS-7732] Bug Expiring item cache in Nuget proxy repositories causes them to auto-block frequently

  • [NEXUS-7693] Bug Inconsistency in handling of repository targets for NuGet security

  • [NEXUS-7699] Bug downloading specific versions of NuGet packages via Visual Studio package manager console fails


  • [NEXUS-7774] Bug deadlock trying to read .meta/obr.xml after running task to merge metadata performance


  • [NEXUS-7696] Bug "Logs (read)" privilege doesn't give access to /service/siesta/logging/log

  • [NEXUS-7839] Bug Security Vulnerability: Directory Traversal security


  • [NEXUS-7779] Bug NullPointerException in pom validator staging rule

Support Tools

  • [NEXUS-7785] Improvement request.log should be able to print the Nexus authenticated userid

  • [NEXUS-7646] Bug CLM server password is not removed from support tool zip configuration security


  • [NEXUS-7800] Bug add configuration to set Secure flag on cookies security

Repository Manager 2.11

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.11.

New and Noteworthy

Nexus OSS and Pro Distributions Now Include RubyGems Support

Native RubyGems support has been added for hosted, proxy and groups repositories. More information in the documentation (NEXUS-7754)

System Feeds Performance Improvement

We've fixed a bug that could have allowed the files under the timeline directory to grow very large and impact Nexus performance. See our article for more information on how you could be impacted and the steps to take. (NEXUS-7671)

Default Security Improved for HTTPS connections

Given the recent exploits discovered surrounding certain SSL protocols, Nexus Repository Manager now ships with defaults that prevent the accidental use of older SSL protocols. Further, the outbound protocols and ciphersuites used by Nexus Repository Manager are now configurable should you wish to lock this down further. (NEXUS-7594, NEXUS-7659 ). We have an article covering the various options for configuring Nexus Repository Manager HTTPS protocols and cipher suites.

YUM Repository Format Improvements

YUM users are encouraged to upgrade to this release. Nexus Repository Manager has performance improvements of our YUM repository format support. The changes include:

  • createrepo version 0.9.9 and greater / mergerepo 0.1 and greater is now required

  • optional sqlite database files are no longer generated for YUM metadata

  • better reporting and validation of YUM configuration changes

  • critical bug fixes for YUM proxy repositories

Known Issues

There has been a regression in the "pom validation" staging rule: NEXUS-7779

The "pom validation" staging rule is used to make sure pom files meet the standards required to be published to Maven Central. If you are using this rule you should avoid upgrading to 2.11.0. We will be releasing a new 2.11.x version soon which fixes this problem.

General Improvements


  • [NEXUS-7563] Improvement h2 database locking mechanism changed to FS from SOCKET


  • [NEXUS-7625] Bug nexus pro trial installer dmg identity cannot be confirmed on OSX Yosemite


  • [NEXUS-6881] Bug comma in group membership attribute value breaks static LDAP group mapping

  • [NEXUS-5840] Bug DN values containing "," (comma) can result in improperly escaped LDAP filters


  • [NEXUS-7614] Bug npm install cmd can trigger nexus NPE and 500 status when remote returns non-standard fields and stub attachments

  • [NEXUS-7616] Bug requesting metadata for uncached npm package metadata sends two requests to the remote

  • [NEXUS-7609] Bug npm attribute storage corruption can lead to http 500 responses

  • [NEXUS-7486] Bug configuring staging profile to release to npm hosted repo should not be allowed

  • [NEXUS-6898] Bug npm hosted repository should maintain "time" field on deploys


  • [NEXUS-6762] Bug Deadlock while retrieving artifact from p2 repository

  • [NEXUS-7598] Bug P2 related requests waiting for locks never return from Browse Storage

Proxy Repository

  • [NEXUS-7628] Bug deleting empty paths under storage does not expire NFC for child paths


  • [NEXUS-7603] Bug file content validation fails for application/x-msdownload jar files

  • [NEXUS-6310] Technical Debt Upgrade to Tika 1.6

  • [NEXUS-7760] Bug recursive trash directories such as ./nexus/trash/.nexus/trash can consume large amounts of disk


  • [NEXUS-7561] Bug Show "Browse Storage", "Browse Remote", "Mirrors", <dependencyManagement/> in "Summary" tab based on repository type


  • [NEXUS-7627] Bug Nexus BUG in "rubygems-proxy" ItemNotFoundException during cache

  • [NEXUS-7754] New Feature include official rubygems repositories support with Nexus bundles


  • [NEXUS-7652] Bug SSL certificates added using load from server option only use direct socket connection


  • [NEXUS-7595] Improvement disable insecure SSL protocols by default in jetty HTTPS sample configuration

Support Tools

  • [NEXUS-6900] Bug Nexus OSS support bundle does not include ldap.xml file

System Feeds

  • [NEXUS-7671] Bug Purge Nexus Timeline task calculates wrong purge "window" days performance


  • [NEXUS-7575] Bug User-Agent header not sent for CONNECT to httpS remotes

  • [NEXUS-7594] Improvement allow configuring https.protocols and https.cipherSuites on Nexus outbound HTTP client connections

  • [NEXUS-7659] Improvement disable SSLv3 for outbound requests by default

User Token

  • [NEXUS-6887] Bug If all user tokens are cleared this should be logged at INFO


  • [NEXUS-6680] Improvement Add "full rebuild" option to generate yum scheduled task

  • [NEXUS-6899] Bug The yum versions REST resource is only updated at startup

  • [NEXUS-6790] Task Child group repository with only one yum enabled member breaks yum metadata merge

  • [NEXUS-6801] Improvement prevent createrepo/mergerepo from creating sqlite rpm metadata performance

  • [NEXUS-6251] Improvement If yum metadata generation fails the output of the createrepo/mergerepo command should always be logged

  • [NEXUS-6702] Bug Yum metadata for proxy repositories should refer to the URL of the source Nexus instance

  • [NEXUS-7596] Improvement programatically enforce minimum requirements for yum configuration including debug messages

Repository Manager 2.10

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.10.

New and Noteworthy

NPM Registry Support

Nexus Repository Manager Professional and Nexus Repository Manager OSS now include official support for hosted, proxy and group repositories compatible with npm. See the npm section for more information.

Note: Nexus Repository Manager npm support requires an npm client version of 1.4 or above.

General Improvements

Build Tooling

  • [NEXUS-6841] Improvement Improvements to spice-zapper

Build Tooling,Staging

  • [NEXUS-6845] Improvement log full content url at INFO for created staging repositories

  • [NEXUS-6757] Bug nexus-staging:deploy-staged fails with NullPointerException: BUG: finalizeDeploy invoked before deployPerModule?

  • [NEXUS-6728] Bug staging build tools zapper client does not use pre-emptive auth ( unlike Jersey based client )

  • [NEXUS-6836] Bug maven staging plugin ArrayIndexOutOfBoundsException: -1 on release using Java 8

Maven Repository

  • [NEXUS-6731] Bug Artifact Upload with classifier-only artifacts doesn't create maven-metadata.xml at GA level


  • [NEXUS-5852] New Feature Add Common JS Package Registry / node.js / NPM support

Proxy Repository

  • [NEXUS-6838] Bug HTTP client Server Name Indication support broken


  • [NEXUS-6818] Bug build promotion staging repository members view does not display members

  • [NEXUS-6673] Improvement Staging repository listing log spam when repository is not found

System Feeds

  • [NEXUS-6763] Bug broken files feed spam - prefixes.txt has no remote checksum in repository central


  • [NEXUS-6786] Improvement provide method to exclude specific User-Agent values from browser detection

Repository Manager 2.9.2

These notes are a compilation of new features and significant bug fixes for Sonatype Nexus Repository Manager 2.9.2.

New and Noteworthy

NuGet Support Performance Improvements

  • [NEXUS-6852 , NEXUS-6853] All users of Nexus Repository Manager Nuget plugin are encouraged to upgrade in order to take advantage of several performance improvements.

Default max heap size increased for Nexus Repository Manager OSS

  • [NEXUS-6824] Due to new features entering Nexus Repository Manager OSS, we have increased the default JVM max heap size for the bundle distribution to match Nexus Repository Manager Professional (768MB)

General Improvements


  • [NEXUS-6824] Improvement Increase default heap size for oss, keep in sync with pro performance


  • [NEXUS-6873] Bug trial bundle config includes procurement.xml

  • [NEXUS-6872] Bug trial bundle does not have central repo in public group

  • [NEXUS-6874] Bug trial bundle uses wrong default temp dir


  • [NEXUS-6852] Bug Querying NuGet proxy with no $top parameter causes excessive caching performance

  • [NEXUS-6822] Bug Improve sorting of NuGet results when no order is specified

  • [NEXUS-6853] Bug NuGet $count queries can lead to excessive caching performance

Secure Central

  • [NEXUS-6865] Bug do not add enabled secure central capability by default on installations without legacy secure central url

User Token

  • [NEXUS-6848] Bug Exception deleting user when User-token feature is not enabled

Repository Manager 2.9.1

These notes are a compilation of new features and significant bug fixes for Sonatype Nexus Repository Manager 2.9.1.

New and Noteworthy

Security Update

This release includes an important security update in the HTTP client library used by Nexus Repository Manager and the Maven and Ant tasks used with Nexus Repository Manager. We recommend all Nexus Repository Manager instances upgrade.

Maven users should upgrade nexus-staging-maven-plugin to version 1.6.3 and nexus-m2settings-maven-plugin to version 1.6.3.

Ant users should upgrade nexus-staging-ant-tasks to version 1.6.2.

General Improvements

Maven Repository

  • [NEXUS-6731] Bug Artifact Upload with classifier-only artifacts doesn't create maven-metadata.xml at GA level


  • [NEXUS-6818] Bug build promotion staging repository members view does not display members


  • [NEXUS-6780] Bug Upgrade http client to 4.3.5 security

Repository Manager 2.9

These notes are a compilation of new features and significant bug fixes for Repository Manager 2.9.

New and Noteworthy

Default Repository URLs Have Changed

Sonatype has made the much publicized change of making SSL access to the Central Repository free for everyone. Additionally, we have changed the default URLs for the Apache Snapshots and Codehaus Snapshots repositories to be https.

There is no automatic upgrade step which changes these URLs for you, but we encourage you to change your existing repository URLs manually as described in the support article. [NEXUS-6737>]

Nexus Repository Manager OSS Includes Support For NuGet Repositories

Sonatype now includes NuGet repository support in Nexus Repository Manager OSS. Nuget support is covered in the documentation. [NEXUS-6738]

Additional Upgrade Steps

During upgrade from previous Nexus Repository Manager Professional versions, Nexus Repository Manager will migrate the NuGet feed database to a new format. Therefore as standard practice, it is recommended that users back up this database under $NEXUS_WORK/nuget before upgrading. This should be done while the server is not running. [NEXUS-6700]

Note: This one time database migration may take considerable time for large NuGet databases.

If you have any "Download NuGet Feed" tasks scheduled to run in your Nexus Repository Manager instance Sonatype recommends you remove them, this task isn't needed in 2.9.

General Improvements


  • [NEXUS-6669] Bug analytics does not record staging operations

  • [NEXUS-6687] Bug Analytics EventData.timestamp field not really timestamp


  • [NEXUS-6682] Bug Wrong exit status in Java Service Wrapper sh script

Capabilities,Secure Central

  • [NEXUS-6689] Bug Exception thrown during secure central capabily construction can put it into an invalid state


  • [NEXUS-6645] Bug Problem with authentication in Nexus with RutAuthentication plugin and LDAP combination

Configuration,Proxy Repository

  • [NEXUS-6692] Bug add more robust proxy repository URL validation


  • [NEXUS-6646] Bug Crowd plugin that is not configured logs IllegalStateException when viewing security roles


  • [NEXUS-6652] Bug LDAP OSS to Pro upgrade bug, multiple configuration fields are not migrated

  • [NEXUS-6664] Bug upgrade from previously upgraded 2.8 OSS to Pro ldap configuration can fail subsequent upgrades


  • [NEXUS-6479] Bug align discrepancies between "user manager" and "realm" names


  • [NEXUS-6500] Bug Unable to install a license after a non-trial license expires

Maven Repository,Secure Central


  • [NEXUS-6651] Improvement allow direct request for NuGet artifact through proxy repository if artifact is not already cached in the local feed performance

  • [NEXUS-6650] Improvement Nuget: return 403 with reason instead of 404 when redirection fails through a proxy server

  • [NEXUS-6700] Improvement NuGet Database Migration

  • [NEXUS-6738] Improvement Include support for NuGet repositories in Nexus OSS

Proxy Repository

  • [NEXUS-6622] Bug Nexus should handle Content-Type which includes charset=binary better

  • [NEXUS-6701] Bug Archiva repos are auto-blocked due to Last-Modified header

Proxy Repository,REST

  • [NEXUS-6647] Improvement ?describe should include estimate when cache will expire for not found artifacts


  • [NEXUS-6653] Improvement imrpove expire metadata cache performance performance

  • [NEXUS-6537] Task File deletion does a copy/delete to trash rather than a move performance


  • [NEXUS-6666] Bug Download indexes task should not process out of service repositories performance


  • [NEXUS-6677] Bug Artifacts from removed member are never removed from group repository published indexes

Smart Proxy

  • [NEXUS-6071] Improvement Smart Proxy secure connector capability should validate fields


  • [NEXUS-6448] Bug Releasing a staging repository doesn't take target repository deployment policy into account

  • [NEXUS-6658] Improvement Add a mode to staging which allows explicit profile selection, and also enforces repository targets

Support Tools

  • [NEXUS-6668] Improvement include all referenced jetty configuration files in support zip

  • [NEXUS-6621] Improvement include request.log in support bundle

  • [NEXUS-6617] Bug Support Bundle can include unprotected HTTP proxy server password security


  • [NEXUS-6626] Task upgrade to HTTP client 4.3.4

Repository Manager 2.8.1

These notes are a compilation of new features and significant bug fixes for Sonatype Nexus Repository Manager 2.8.1.

New and Noteworthy

Temporary Directory Handled Consistently

It was possible that the temporary directory used by Nexus Repository Manager was indeterminate for some operations. The preferred default temporary directory was ${NEXUS_WORK}/tmp, but since that value cannot be reliably set by default before boot, Nexus Repository Manager now defaults the temporary directory used as ${NEXUS_HOME}/tmp. This may impact the disk space requirements for some installations. See the article discussing the temporary directory for more information. NEXUS-6595

Smart Proxy Performance Improvements

Working closely with our customers, we have identified some Smart Proxy performance issues in certain circumstances. Smart Proxy users should consider upgrading to benefit from these changes. NEXUS-6570, NEXUS-6600

Notable: Turn on strict URI matching in restlet

Nexus Repository Manager restlet now uses sctrict URI matching as the default. This may impact the functionality of some third party plugins. If you are using plugins not supplied by Sonatype you should test these against 2.8.1 before upgrading, it is possible (although unlikely) that REST endpoints in these plugins may not work correctly in 2.8.1. NEXUS-6630

General Improvements


  • [NEXUS-6555] Bug SystemProperty not working in war-Deployment

  • [NEXUS-6352] Bug explicitly set not always respected and tmp dir not under nexus work

  • [NEXUS-6595] Bug Revert tmp dir handling, only use to set this value in wrapper.conf compatibility

Build Tooling, Staging

  • [NEXUS-6538] Bug nexus-staging-maven-plugin: proxying to https host fails with ProxyInfo and BaseUrl protocols does not align!

CLM, Transport

  • [NEXUS-6607] Bug CLM component details fails when going through authenticated http proxy


  • [NEXUS-6545] Bug request.log is rotated to NEXUS_HOME instead of NEXUS_WORK/logs compatibility

  • [NEXUS-6553] Improvement limit nexus.log time based log rolling to max history of 90 days instead of infinite compatibility


  • [NEXUS-6514] Improvement Add commercial license fingerprint value to the System Information report

Maven Repository

  • [NEXUS-6510] Bug ERROR log message from M2Repository - LocalStorageException FileAlreadyExistsException does not include root cause throwable

  • [NEXUS-6560] Bug uncompressed archives with HTML file as an entry can be rejected by file content validation

Maven Repository, Smart Proxy

  • [NEXUS-6600] Bug Expire cache walker blocks subsequent NFC expirations performance


  • [NEXUS-6530] Improvement Archive browser doesn't work for NuGet .nupkg packages

OBR, Smart Proxy

  • [NEXUS-6564] Bug OBR virtual repository metadata update fails when triggered by smart proxy download immediately


  • [NEXUS-6562] Bug Regression: File content validation still enabled for procurement, no way to disable

  • [NEXUS-6520] Improvement Remove procurement from trial eval guide


  • [NEXUS-6542] Bug Maven model classes are missing from xstream whiltelist configuration compatibility


  • [NEXUS-6539] Bug Forced Base URL value different from the incoming request URL can break UI / RESTLET based resources


  • [NEXUS-6630] Improvement Turn on strict URI matching in restlet

  • [NEXUS-6549] Bug Browse Storage/Index can block access to folders or files that start with "content"

  • [NEXUS-6554] Bug XSS vulnerability in outreach plugin

  • [NEXUS-6569] Improvement Add X-Frame-Options header to avoid clickjacking

Smart Proxy

  • [NEXUS-6570] Bug Smart Proxy download immediately option for checksum updates sends duplicate download requests for main artifact performance

Support Tools

  • [NEXUS-6241] Improvement Add end-user instructions for support ticket creation in Support Tools UI


  • [NEXUS-6526] Improvement add request context to to aid determining the root cause

  • [NEXUS-6501] Bug inbound request URL syntax validity should be checked and fail fast


  • [NEXUS-6582] Bug Yum Generate Metadata does not detect new rpms added on filesystem

  • [NEXUS-6583] Bug Yum Generate Metadata only allows a single RPM per Directory

Repository Manager 2.8.0

These release notes are a compilation of new features and significant bug fixes for Repository Manager 2.8.

New and Noteworthy

Influence Nexus Repository Manager Product Development Using Analytics

As part of the process to help us make Nexus Repository Manager better, Administrators can optionally choose to send anonymous REST API usage data to Sonatype. This data will help us decide what features are most important to you and will influence product development for Nexus 3.0 and beyond. The data can be inspected and even exported for your own use as well.

To enable analytics on your instance go to "Administration/Analytics" in the Nexus Repository Manager UI.

Enhanced Sonatype CLM Integration

Nexus Repository Manager Professional now supports deep integration with Sonatype CLM (IQ Server). Sonatype CLM users can see full component information containing popularity, license data, security vulnerabilities, and policy violations. This information can be compared against all other available versions of a give component.

Detailed information about particular component versions can now be viewed directly in Nexus Repository Manager.

Note: You'll need to upgrade your CLM server to version 1.10.2 or higher to use this new functionality.

Repository Health Check Improvements

  • Simplified configuration of Repository Health Check

  • Health check can now be enabled for all types of proxy repositories supported by Nexus (Maven, P2, NuGet, OBR, Yum, etc.)

  • Improved UI in search results

Bundled Jetty Configuration is Simpler and Extensible

Previously, Nexus only supported loading a single Jetty configuration file, typically at ${NEXUS_HOME}/conf/jetty.xml, to configure the builtin Jetty instance. Now Nexus Repository Manager can be launched with multiple Jetty configuration files as launcher parameters. This resembles the default configuration merging behaviour that Jetty users are used to. All files at ${NEXUS_HOME}/conf/jetty-*.xml can be used as is or customized with properties specified in NEXUS_HOME/conf/ More Information. NEXUS-6153

Request Access Logging Enabled by Default

Nexus Repository Manager now ships with inbound request logging enabled by default, logging to a separate log file than the main Nexus Repository Manager log. Access logs have proved very useful for our customers to diagnose problems and understand load characteristics. While these logs will consume additional disk space, log rotation can help ensure a reasonable retention policy. More information. NEXUS-6472

Note: Upgrades From Nexus Repository Manager 1.x to Nexus 2.8 Require Additional Upgrade Step

Sonatype Nexus is undergoing some major enhancements this year. As a preparatory step, automatic configuration upgrades from Nexus Repository Manager 1.x series to Nexus Repository Manager 2.8 and newer is no longer supported. Direct upgrade of Nexus Repository Manager versions 2.0 to 2.7.x continue to be supported. Upgrades of 1.x versions must first upgrade to the latest 2.7.x version, then upgrade to Nexus Repository Manager 2.8 or newer. NEXUS-6099

Internet Explorer 8 Support is Deprecated

IE 8 works with Nexus Repository Manager 2.8 with only a few minor issues. However Nexus Repository Manager 3.0 will be using a new version of our UI toolkit which does not support IE8. Consequentially support for IE8 will be ending after the 2.8.x Nexus Repository Manager series is complete. More information. NEXUS-6330

General Fixes and Improvements


  • [NEXUS-6147] Improvement application properties source should print at DEBUG only


  • [NEXUS-6112] Task Upgrade to Sonatype/Sisu 2.5.0 (legacy runtime wrapper around Eclipse/Sisu 0.1.0) compatibility

Build Tooling, Staging

  • [NEXUS-6182] Improvement Add parallel build support to nexus-maven-staging-plugin

  • [NEXUS-6164] Improvement Add ability to disable SSL certificate checks to nexus maven plugins

Capabilities, Security

  • [NEXUS-6269] Bug UI: Capabilities Admin gets 403 response trying to read Capability Types


  • [NEXUS-6154] Improvement add consistent log timestamps including timezone offset and ms resolution

  • [NEXUS-6102] Bug Replace dead MimeUtil2 with Apache Tika

  • [NEXUS-6153] Improvement allow inlining jetty.xml config files as nexus app parameters

  • [NEXUS-6319] Bug Typo in error message: "instantianate"

Crowd, Security

  • [NEXUS-6132] Bug nexus security diagnostic queries crowd realm even when it is not configured

  • [NEXUS-6243] Bug cache already exists "enterprise-ldap" when searching for crowd user

Maven Repository

  • [NEXUS-6298] Bug maven-metadata.xml file merged incorrectly


  • [NEXUS-6503] Improvement optimizations for large nuget repository databases with slow queries for latest version


  • [NEXUS-6311] Task Upgrade tycho dependencies in p2 for CLM compliance compatibility

Procurement, Routing

  • [NEXUS-6485] Improvement Prefix file update of procurement repository can cause nexus startup to take an extremely long time performance


  • [NEXUS-6358] Bug ?describe outout no longer has "contained in repositories"


  • [NEXUS-6307] Improvement Print message in log if high-strength JCE is installed


  • [NEXUS-6277] Bug Requests to hosted repositories slow down linearly as group repository membership increases


  • [NEXUS-6306] Bug strip out invalid addressees out of staging emails before send attempt

  • [NEXUS-6242] Bug nexus-staging-maven-plugin fails with IllegalArgumentException: XPP3 pull parser library not present. Specify another driver.

Support Tools

  • [NEXUS-6276] Bug NullPointerException when switching to Log tab

  • [NEXUS-6472] Improvement Enable inbound request access logging by default

System Feeds

  • [NEXUS-6294] Bug timeline can leave index files in deleted state performance


  • [NEXUS-6236] Improvement Upgrade HttpClient to 4.3.x

  • [NEXUS-6221] Bug add context to log message "The target server failed to respond"

User Token

  • [NEXUS-6155] Bug Print error in nexus-m2settings-maven-plugin 1.5.x if it is used with Nexus 2.6 or earlier


  • [NEXUS-6271] Bug File content validation fails with empty zip file

  • [NEXUS-6491] Bug Nexus should not dump stack traces to end users

  • [NEXUS-5694] Improvement Add support to detect/register metrics healthcheck components

  • [NEXUS-6571] Bug LinkPersister#isLinkContent is invoked for attributes performance

  • [NEXUS-6572] Bug Add new "breadth first" walker traversal type to improve walker performance performance

  • [NEXUS-6320] Bug repository content index page links can reference incoming request host, port and path instead of forced base URL

Repository Manager 2.7.2


This release of Nexus Repository Manager fixes a critical security issue (NEXUS-6315). Details about this vulnerability can be found here.

Bug Fixes

  • NEXUS-6139 - Evict unused proxied items task moves items to trash

  • NEXUS-6155 - Print error in nexus-m2settings-maven-plugin 1.5.x if it is used with Nexus 2.6 or earlier

  • NEXUS-6182 - parallel build support in nexus-staging-maven-plugin

  • NEXUS-6164 - allow disabling ssl certificate checks in nexus-staging-maven-plugin

  • NEXUS-6213 - Add file content validation for site.xml

  • NEXUS-6219 - rebuild metadata task rebuilds metadata on the same repository more than once during a single task run

  • NEXUS-6220 - Repository health check fails when using an HTTP proxy server with NTLM authentication.

  • NEXUS-6230 - Remove all unused snapshots fails with NPE in logs

  • NEXUS-6232 - prevent concurrent execution of createrepo against the same data

  • NEXUS-6234 - File content validation is enabled for procurement repositories, there is no way to disable it

  • NEXUS-6244 - Regression: Crowd plugin does not support nested group role mapping user privileges

  • NEXUS-6248 - Last-modified header wrong for archetype-catalog.xml of group repo

  • NEXUS-6249 - Wrong checksums cached for maven unique snapshots (sha1 and md5)

  • NEXUS-6250 - Not able to view remote internal (proxy) repository

  • NEXUS-6253 - LDAP timeout is logged at DEBUG

  • NEXUS-6258 - Path cache appears broken in customer configuration

  • NEXUS-6259 - Staging yum metadata capability can prevent loading of staging repositories

  • NEXUS-6315 - Security Vulnerability: REST API

Repository Manager 2.7.1

A critical security vulnerability (CVE-2014-0792) has been discovered by Sonatype in Nexus Repository Manager requiring immediate action. This vulnerability has been fixed in the 2.7.1 release.

A patch is also available which fixes this issue for all 2.x versions of Nexus Repository Manager. Information about this can be found in the Nexus Security Vulnerably article.

Bug Fixes

  • NEXUS-6172 Indexing tasks can leave files present in (deleted) state until the next index read operation

  • NEXUS-6176 New describe page lost the group's not found reasoning.

  • NEXUS-6185 Timestamped M2 Snapshots should be consumable over M1 shadow

  • NEXUS-6189 Need a way to set session timeout duration in Nexus

  • NEXUS-6205 Update XStream

  • NEXUS-6206 Set userId in MDC on login, and unset on logout

Repository Manager 2.7.0-06

Bug Fixes

  • NEXUS-6168 Nexus 2.7 breaks nexus-ruby-plugin

  • NEXUS-6169 Nexus 2.7 now returns 501 instead of 405 for MKCOL, possibly breaking some wagons

  • NEXUS-6179 Requesting a folder which does not exist in a proxy repository's local storage causes a file to be created in storage.

  • NEXUS-6183 logger does not include timing information

Repository Manager 2.7.0-05

Bug Fixes

  • NEXUS-6150 Misleading message printed when IOException is thrown trying to lock nexus.lock file

  • NEXUS-6151 Nexus war edition will not start if work directory does not exist

Repository Manager 2.7.0-04

Bug Fixes

NEXUS-6149 ContentServlet depends on the presence of client certificates when accessed via https

Repository Manager 2.7.0

These release notes are a compilation of new features and significant bug fixes for Sonatype Nexus Repository Manager 2.7.0.

New and Noteworthy

All Shipping Plugins are Installed by Default

Previous versions of Nexus Repository Manager Professional shipped with some plugins which were not installed by default. These were located in "$NEXUS_HOME/nexus/WEB-INF/optional-plugins", and installation required manually copying these over to the main plugin repository and restarting the server. In Nexus Repository Manager 2.7, all plugins are installed by default. The following plugins are affected:

  • Branding Plugin - Installed by default, can now be enabled and configured via capability

  • Crowd Plugin - Installed by default

  • Custom Metadata Plugin - Installed by default, can now be enabled via capability

  • User Account Plugin - No longer ships with Nexus Repository Manager

  • Unpack Plugin* - Installed by default


The Unpack Plugin creates a special "content-compressed" REST endpoint which can be used to deploy zip files to a repository. The URL looks like this: http://localhost:8081/nexus/service/local/repositories/releases/content-compressed . The files in the zip will be unpacked and deployed individually to the repository.

New Atlassian Crowd Plugin

We have completely rewritten the Atlassian Crowd Nexus Repository Manager plugin. It performs better, is more reliable and depends on current Crowd REST APIs under the hood. Upgrades of your previous crowd configuration should be handled seamlessly.

The plugin is already installed by default and configuration can be accessed via Security -> Crowd in the sidebar. Refer to the Crowd documentation for more information.

The plugin has been primarily tested with Crowd 2.5.5 and 2.6.5 at shipping time. Although the Crowd REST API used should work with Crowd versions as old as 2.1, users are encouraged to use this plugin with at least the tested versions of Crowd or newer. In particular, Atlassian Crowd releases earlier than 2.5.5 are known to have severe security vulnerabilities.

If you use a https URL to access your crowd server, you can now configure an SSL: Crowd Capability to explicitly manage the trust of the SSL certificate

New Support Tools

The old automatic problem reporting feature under "help/report problem" has been replaced with a new set of support tools.

Nexus now has a System Information report to show detailed information about the configuration and runtime environment of the Nexus instance.

A new option to generate a Support ZIP which can be sent to Sonatype support has been added. This ZIP file is not encrypted so users can inspect the contents before providing it to Sonatype via a secure support site ticket at

New Logging UI

The logging UI has been completely rewritten, and now allows for setting log levels for individual java packages and classes through the UI. It also has a new "mark" facility which can be used to add markers in the log. These markers help delineate where a problem was reproduced.

Note: The previous System Files feature has been removed and replaced by the new log viewer and Support Zip feature.

Authentication via Remote User HTTP Header

Nexus now supports external pre-authentication of users. An HTTP header can be configured (such as REMOTE_USER) which contains a user ID which has already been authenticated by the external system. See the documentation for more information.

Legacy Startup Scripts Removed

The old startup scripts (located under $NEXUS_HOME/bin/jsw/$ARCH in the installation directory) have finally been removed. These have been deprecated since Nexus Repository Manager 2.0. Users should use the new startup scripts introduced in Nexus Repository Manager 2.0, located in $NEXUS_HOME/bin (NEXUS-5781). The 'clickable' Windows batch files (*-nexus.bat) have remained, but the only use case for these are to be 'clicked' to perform a specific named action.

Work Directory is now Locked to Prevent Concurrent Access

The work directory is now locked to prevent simultaneous access by multiple Nexus Repository Manager instances. A sonatype-work/nexus/nexus.lock file is created containing the process id when Nexus Repository Manager is started, and deleted when Nexus Repository Manager is stopped (NEXUS-5306).

No Longer Possible to Disable Security

Previous versions of Nexus Repository Manager had a setting which completely disabled security. This added unnecessary complexity to the system, and this has been removed. If someone really wants to run Nexus Repository Manager without security this can be done by giving the anonymous user the Administrator role.

Custom Metadata is now Enabled/Disabled via Capability

In previous versions of Nexus Repository Manager the Custom Metadata Plugin shipped in "$NEXUS_HOME/nexus/WEB-INF/optional-plugins" because it can add additional overhead to large instances. It is now shipped in the main plugin repository. To enable it, go to "administration/capabilities" and add a new capability of type "Custom Metadata". If you were using it previously, you need to explicitly enable it after upgrade to keep using it. Note that this is a one time requirement, the setting will persist through future upgrades.

Plexus Components Deprecated

Components in Nexus Repository Manager have been converted to JSR-330 and use of Plexus components have been deprecated. Warnings will be logged on startup when Plexus components are detected. Custom plugins should be updated as support for use of Plexus components will be removed in future version of Nexus Repository Manager (NEXUS-5755).

Deprecated Legacy API

Many legacy, unused, or soon to be removed API have been marked as deprecated. These will be removed in future versions of Nexus Repository Manager. Custom plugins should be updated to avoid usage of deprecated API.

Nexus Staging Maven Plugin Automatic Release

A new parameter has been added to the nexus-staging-maven-plugin, "releaseAfterClose". When this is set the plugin will automatically release a staging repository after closing it provided that all staging rules (including CLM scans) have passed (NEXUS-5906).

Automatic Cleanup of old Build Promotion Repositories

The "Drop Inactive Staging Repositories" task has been enhanced to allow cleanup of build promotion repositories (NXCM-5226).

Enhanced UI for Tables

Most UI tables in Nexus Repository Manager can now support filtering of contents via UI search (NXCM-4490).

Improved Capabilities UI

Numerous improvements have been made to the capabilities UI, including the ability to group capabilities by any column (particularly useful is grouping by "category"). Also, there is a new tabbed interface which cleanly separates Summary, Settings, Status, and About (NEXUS-5940).

Nexus Repository Manager Branding Plugin Improvement

The Nexus Repository Manager Branding Plugin (which allows setting a custom banner in the UI) can now be configured via capabilities UI (NEXUS-5891). To set a custom banner in Nexus 2.7 go to "Administration/Capabilities" and add in a "Branding" capability. Previous custom banners should be detected automatically on upgrade.

Mirrors Tab Removed from Proxy Repositories

The old "mirrors" feature has been removed from proxy repositories and previous settings will be ignored (NEXUS-5789). Proxy repositories that had this configured will now fetch all artifacts, poms, metadata and checksums from the remote proxy directly.

Groovy Integration

Groovy support has been moved into the nexus-groovy-plugin and can now be used to write Nexus plugins in Groovy (NEXUS-5892). An example Nexus Repository Manager plugin written in groovy is our new Support plugin.

Performance Improvements

We've measured significant performance improvements processing staging repositories and checking permissions in some configurations. (NXCM-5448)

Significant Bug Fixes


  • [NEXUS-4697] - Add password text field

  • [NEXUS-5406] - [capabilities] Dynamic source for selections for combos

  • [NEXUS-5940] - Rewrite Capabilities UI

  • [NEXUS-5941] - Add support for tagging to capabilities

  • [NEXUS-6072] - Failure during capability load prevents the rest of capabilities to be loaded

CLM Integration

  • [NEXUS-6060] - CLM App Management link of profile editor leads to wrong URL

  • [NEXUS-6041] - Impossible to disable CLM from UI

  • [NEXUS-5942] - Make CLM Application ID a droplist which is populated from the CLM server

  • [NEXUS-5946] - Remove CLM config in favor of a capability

  • [NXCM-5402] - Nexus to CLM server https connections should be able to use Nexus SSL truststore

Crowd Integration

  • [NXCM-5432] - modernize Nexus Atlassian Crowd Plugin

  • [NXCM-5443] - Allow crowd plugin to use nexus private truststore for SSL certs

  • [NXCM-5499] - improve crowd configuration contextual help messages

  • [NXCM-5501] - if crowd realm is configured and active, but login does not need it, crowd server is still contacted


  • [NEXUS-5998] - Extremely inefficient mechanism used to retrieve LDAP users for notification

  • [NEXUS-6068] - Nexus problem reporting can reset ldap server bind passwords in memory to ***

  • [NEXUS-6081] - LDAP password are sent in clear text

  • [NEXUS-5870] - Provide a mechanism to allow additional LDAP environment variables to be set.

  • [NEXUS-4062] - Automatically add the LDAP security realm when user saves LDAP settings


  • [NEXUS-6085] - duplicate Nuget Api key buttons possible

  • [NXCM-5423] - Download NuGet Feed task reports success even if it receives an invalid response from remote server

  • [NXCM-5324] - Can't synchronize Nuget feed from if "fetch all versions" is checked.


  • [NEXUS-5930] - Nexus OBR shadow makes Nexus deadlock prone, while reading/writing obr.xml

  • [NEXUS-5995] - P2 repository plugin generates incorrect content.xml data for features

  • [NEXUS-5831] - [p2] serve jarred repository metadata

  • [NXCM-5431] - investigate httpclient 3.1 use in nexus-p2-bridge-plugin


  • [NEXUS-4945] - Concurrent modification exception in procurement

  • [NXCM-4752] - Artifact Procurement allows you to create repository cycles, results in stack overflow.

  • [NXCM-5409] - Newly deployed artifacts can be blocked from procurement by automatic routing

  • [NXCM-5515] - Procurment repository download fails if user does not have read privileges to source repo


  • [NEXUS-4997] - SMTP config panel uses "SSL" and "TLS" incorrectly

  • [NEXUS-2911] - Authentication error shows up as "400 bad request" during smtp validation.

  • [NEXUS-5808] - no indication at default log levels that email server configuration is broken


  • [NEXUS-5772] - File content validation broken on newer versions of Linux

  • [NEXUS-5789] - Remove proxy repository Mirrors feature

  • [NEXUS-5790] - Download speeds reduced in recent Nexus versions

  • [NEXUS-5811] - Browse remote storage incorrectly handles forced remote base url , preventing remote browse UI tree from expanding

  • [NEXUS-5838] - Repositories -> Browse Remote uses wrong URL on remote and gets HTTP/404

  • [NEXUS-5877] - Repository pop up in list has duplicate entries

  • [NEXUS-5944] - Repository is auto-blocked if "allow file browsing" is disabled on remote

  • [NEXUS-4207] - make default value of Publish URL "True" when creating a group repository

  • [NEXUS-4292] - Download button's URL should be copy-able (into mails, jira comments, ...)

  • [NEXUS-4737] - Add extra columns to the repository targets view

  • [NEXUS-5898] - Make connection request retry attempts work for connection reset exceptions

  • [NXCM-5422] - Nexus Archive Browser Plugin does not work with .bar files

  • [NXCM-4490] - Make repositories grid view filterable/searchable


  • [NEXUS-5807] - Automatic routing fails for grails repo

  • [NEXUS-6050] - Automatic routing warnings should include repository ID

Scheduled Tasks

  • [NEXUS-4580] - Empty trash task should allow specifying repositories

  • [NEXUS-5871] - Scheduled task drop down is not sorted

  • [NEXUS-5797] - Scheduled task to remove old unreleased snapshots

  • [NXCM-5226] - Add "include promoted repositories" option to staging repo cleanup task


  • [NEXUS-5798] - Out of service repositories should not be included in search results

  • [NEXUS-5814] - Nexus should not stop indexing if it encounters a jar file it cannot parse, but should report the jar location

  • [NEXUS-5817] - indexing operations which require remote repo access do not always respect blocked repo status

  • [NEXUS-5821] - Repositories view right-click menu Repair Index / Update Index items duplicated

  • [NEXUS-5799] - IndexCreators aren't ordered according to dependencies

  • [NEXUS-5909] - Move nexus-custom-metadata-plugin out of _optional-plugins_ to default installed plugins


  • [NEXUS-4219] - nexus is silent when it does not have permissions to update security.xml

  • [NEXUS-5826] - Sort the repository drop down list in "add/repository target privilege" alphabetically (without separating group repos)

  • [NEXUS-3119] - Show status (active/disbaled) of user in the list of users (in the Users panel)

  • [NEXUS-5490] - Add support for REMOTE_USER header

  • [NEXUS-5899] - Remove ability to disable security

  • [NXCM-4543] - Usertoken nameCode is leaking out into the UI

  • [NXCM-5233] - Introduce property to enable/disable session timeout from UI

Smart Proxy

  • [NEXUS-6069] - Smart Proxy: Connector capability cannot be created/updated if "Advertise" is not checked

  • [NXCM-4759] - Remove groovy, replace with javascript optional broker configuration


  • [NXCM-5448] - Extremely poor performance viewing staging repositories and checking permissions

  • [NEXUS-5974] - Staging operation on multiple repositories does not abort properly on failure

  • [NEXUS-6078] - race: DefaultFSLocalRepositoryStorage.getBaseDir Could not create baseDir during staging repository creation

  • [NEXUS-5906] - Add "releaseAfterClose" option to the nexus-staging-maven-plugin

  • [NXCM-3969] - Closing a staging repo fails when its repo group is missing with Server ERROR 500

  • [NEXUS-6051] - Poor error handling in staging.xml validation

  • [NXCM-5065] - vague user message on NullPointerException when nexus-staging-maven-plugin missing required parameters

  • [NXCM-5306] - Staging repository dropped from build promotion profile still shows "promoted" as last activity

  • [NXCM-5403] - nexus-staging-maven-plugin does not interact well with maven-site-plugin:attach-descriptor goal

  • [NXCM-5412] - Add an rc-list goal to the nexus-staging-maven-plugin

  • [NXCM-5415] - If staging UI upload fails because a matching profile cannot be found error message is confusing/misleading

  • [NXCM-5427] - add "Demote" activity to staging repository that was demoted from a promotion group repository

  • [NXCM-5516] - Expose timeout configuration on nexus-staging-maven-plugin (and ant tasks)

  • [NXCM-5451] - staging/bundle_upload transitioning conflict during concurrent processing can cause 500 status Staging repository is already transitioning


  • [NEXUS-5405] - Group Yum metadata not regenerated when a member proxy repository metadata changes

  • [NEXUS-5806] - Group level yum metadata is incorrect

  • [NEXUS-5842] - Yum Generate Metadata Task does not expose newly deployed RPMs after first metadata generation

  • [NEXUS-5795] - Cannot browse YUM repodata directory

  • [NEXUS-5820] - If base URL is set, but not forced, yum xml:base picks up URL of incoming deploy requests, not the base URL of server

  • [NEXUS-5829] - inconsistency on what type of repository you can run Yum: Generate Metadata against

  • [NEXUS-5955] - Automatic routing interferes with yum repo metadata

  • [NEXUS-5956] - Old yum metadata is never cleaned up from yum proxy repository.

  • [NEXUS-5957] - Yum proxy repository metadata is not refetched if request for it comes through a group repo

  • [NEXUS-6057] - Yum merge metadata capability cause Stack Overflow when repository is put Out of Service

  • [NEXUS-5507] - Yum metadata support for staging repositories.

  • [NEXUS-5794] - Add support for specifying yum groups file


  • [NEXUS-5348] - Purge timeline task should delete old files from 'persist'

  • [NEXUS-5822] - StackOverflowError when launching Nexus 2.6.0-05 on Java 8 b100+

  • [NEXUS-5828] - Nexus 2.6 breaks upgrade from Nexus 1.9.0 and 1.9.1

  • [NEXUS-5963] - System property http.proxyHost incompatible regular expressions, server wide

  • [NEXUS-5999] - PGP key server information configuration on settings page click links to configured URL

  • [NEXUS-5306] - Nexus should lock the work directory to prevent multiple processes using it

  • [NEXUS-5584] - Implement atomic writes for all files in the conf directory.

  • [NEXUS-5755] - Remove use of Plexus components in Nexus

  • [NEXUS-5891] - Make branding plugin configurable via capabilities, remove from "optional" plugins

  • [NEXUS-5781] - remove deprecated platform specific wrapper 'nexus' scripts

  • [NEXUS-5883] - Add order column so that sorting can be restored to default order

  • [NEXUS-5907] - Remove nexus-user-account-plugin (ie. user sign up plugin)

  • [NEXUS-5908] - Move nexus-unpack-plugin out of _optional-plugins_ to default installed plugins

  • [NEXUS-5981] - Remove from list of uses SKS Keyservers

  • [NEXUS-5993] - review File.mkdirs() usage, replace with Files.createDirectory(file.toPath()); to not hide IOExceptions

  • [NEXUS-6014] - Nexus should respect X-Forwarded headers by default

  • [NEXUS-6063] - update Nexus and components to use httpclient 4.2.6 to pick up SSL and NTLM related fixes

  • [NEXUS-5892] - Add groovy provider plugin

  • [NEXUS-5989] - If "application server settings (optional) is not checked than administration/server page can't be saved.

  • [NXCM-5292] - IE9 binary license file upload fails

  • [NXCM-5404] - outreach bundle content outdated, links don't work, and/or provide duplicate material

  • [NXCM-5439] - installing valid license with later license validity dates than currently installed license does not update Nexus status

  • [NXCM-5518] - PGP server configuration UI is missing

Repository Manager 2.6.4

Bug Fixes

  • NEXUS-5996 Staging operation on multiple repositories does not abort properly on failure

  • NEXUS-5969 Improve logging for signature validation failures

  • NXCM-5451 Staging/bundle_upload transitioning conflict during concurrent processing can cause 500 status Staging repository is already transitioning

  • NXCM-5518 PGP server configuration UI is missing

Repository Manager 2.6.3

Bug Fixes

  • [NEXUS-5790] - Download speeds reduced in recent Nexus versions

  • [NEXUS-5828] - Nexus 2.6 breaks upgrade from Nexus 1.9.0 and 1.9.1

  • [NEXUS-5849] - Central prefix file is served through Artifactory, which results in non-central artifacts being blocked

Repository Manager 2.6.2

Bug Fixes

  • [NEXUS-5836] - Browse index tree does not work (this affects the procurement tree also)

  • [NXCM-5481] - nexus-healthcheck-oss-plugin 2.6.0/2.6.1 UI quality column does not load on repositories tab

Repository Manager 2.6.1

Bug Fixes

  • [NEXUS-5772] - File content validation broken on newer versions of Linux

  • [NEXUS-5799] - IndexCreators aren't ordered according to dependencies

  • [NEXUS-5806] - Group level yum metadata is incorrect

  • [NEXUS-5807] - Automatic routing fails for grails repository

  • [NEXUS-5814] - Nexus should not stop indexing if it encounters a jar file it cannot parse, but should report the jar location

  • [NXCM-5406] - nexus-maven-staging-plugin does not work with Maven 3.1.0

  • [NXCM-5418] - old official URL not handled by Nexus due to 301 redirect, causing Download NuGet Feed to fail

  • [NXCM-5424] - nexus-staging-maven-plugin fails with encrypted password

  • [NXCM-5429] - Regression: staging repository owner privileges don't work

  • [NXCM-5430] - age and popularity icons are missing for health check plugin

  • [NXCM-5436] - regression: User-Agent Nexus-Client/unknown on staging repository summary tab using nexus-staging-maven-plugin 1.4.5-1.4.6


  • [NXCM-5305] - Add staging rules which can prevent a release or promotion action from completing

  • [NXCM-5409] - Newly deployed artifacts can be blocked from procurement by automatic routing

Repository Manager 2.6.0

These release notes are a compilation of new features and significant bug fixes for Sonatype Nexus Repository Manager 2.6.0.

New and Noteworthy

Support for Composite P2 Repositories

Nexus Repository Manager now supports composite style p2 group repositories. Using these will greatly increase performance and decrease heap space requirements. The old style group repositories have been deprecated, p2 users are encouraged to migrate.

Note that if you are using Eclipse 3.4 you will not be able to use the new group repositories, since that version of Eclipse does not support composite p2 repositories.

Support for Separate HTTPS and HTTP Proxy Servers

Support has been added for separate proxy servers for HTTP and HTTPS URL's.

Compatibility Notes

Java 6 Support EOL

Oracle's support for Java 6 ended in February 2013. Consequentially as of version 2.6 Nexus Repository Manager now requires a Java 7 JRE to run.

Per-Repository HTTP Proxy Settings Removed

The HTTP Proxy settings under repository configuration have been removed. Users should use the global HTTP Proxy settings under "administration/server" instead.

Old Startup Scripts are Deprecated

The old startup scripts under <nexus_root>/bin/jsw/<os>/<architecture> are deprecated, they will be removed in an upcoming release. Users should use the new startup scripts under <nexus_root>/bin/nexus instead.

Significant Bug Fixes


  • NXCM-5314 - CLM proxy configuration needs to take into account http VS https

  • NXCM-5349 - Upgrade to latest CLM plugin


  • NXCM-5291 - rare license validation race condition can trigger random 403, 404 errors accessing /content or 402 payment required accessing UI/REST

  • NXCM-5309 - Bad message from Nexus staging when the product is not licensed


  • NXCM-5329 - /service/local/nuget/repo does not return 401 for group repos when user lacks privileges

  • NXCM-5419- responds with 301, needs to be replaced with


  • NEXUS-5741 - content validation does not work on P2 repositories

  • NXCM-5392 - Old style p2 group which contains composite p2 group repo does not work

  • NXCM-5327 - Allow p2 group repository implementation to use composite repositories


  • NEXUS-2834 - Maven metadata is not rebuilt when deleting items from the UI

  • NEXUS-4766 - Building wrong Maven metadata for a classifier with dots

  • NEXUS-5526 - Proxy-Repository: client certificate authentication does not work anymore

  • NEXUS-5690 - Remove per repository http proxy configuration

  • NEXUS-5704 - 500 Internal Server Error when "If-None-Match" in header

  • NEXUS-5744 - S3 detection misses to find out remote type in some cases

  • NXCM-5202 - secure central: persistent AuthTokenFetcherImpl - failed to fetch authtoken SSLPeerUnverifiedException: peer not authenticated even after explicitly trusting certificate


  • NEXUS-5661 - Proxy repo prefix file does not include paths only available from local storage

  • NEXUS-5711 - Auto routing periodic update is chatty about unsupported repositories

  • NEXUS-5734 - Correct routing prefix file not generated for custom index

Scheduled Tasks

  • NEXUS-4546 - Snapshot remover does not remove deleted snapshot versions from g:a-level metadata files

  • NEXUS-5749 - Scheduled Tasks still disappears

  • NEXUS-5765- NEXUS 2.5-04, strange error, probably durin removing old snapshots

  • NEXUS-5766 - Snapshot remover stops processing on ItemNotFoundException

  • NEXUS-5773 - Heavy spam and possible slowdown in batch processing of item deletions

  • NEXUS-5778 - Very long time of remove snapshots in Nexus 2.5

  • NXCM-5401 - Purge Timeline Task Config corrupted on load/save


  • NEXUS-5747 - Support packaging "bundle" by default for search

  • NEXUS-5764- The is only used for the Repair Index Job and not for regular indexing.

  • NEXUS-5784 - NPE while fetching archetype catalog

  • NEXUS-5752 - Make NIO lucene indexes the default in Nexus


  • NEXUS-5728 - Wrong use of EHCache for EnterpriseCacheSessionDAO

  • NEXUS-5736 - Unable to programmatically set Privilege ID


  • NXCM-4792 - nexus-staging-maven-plugin should warn if it detects it is run against a non-clean target folder

  • NXCM-5308 - Wrong staging rules run during build promotion

  • NXCM-5331 - Regression: Staging profile GAV selection does not work in multi-module build.

  • NXCM-5297 - nexus-staging:promote should print the build promotion repository id that gets created

  • NXCM-5338 - Improve logging in staging, log high level actions in REST/Jetty thread


  • >NEXUS-5705 - deleting a rpm artifact does not trigger Yum: Generated Metadata capability execution

  • NEXUS-5721 - Files with RPM extension (upper case) are not processed

  • NEXUS-5740 - rpm artifacts in .nexus/trash can be processed by createrepo tool


  • NEXUS-5742 - Problem reporting through authenticated http proxy does not work

  • NEXUS-5757 - Add tags to nexus-example-plugins for 2.4.0 and 2.5.0 releases

  • NEXUS-5763 - Rename the restlet plugin

  • NEXUS-5767 - metrics-logback-2.2.0.jar should be added to WEB-INF/lib in war file, like other logback jars

  • NEXUS-5780 - deprecate usage of platform specific wrapper scripts, remove in next release

  • NEXUS-5729 - Expose EHCache over JMX

  • NEXUS-5731 - Remove support for Java 6 - require Java 7 to run Nexus

  • NEXUS-5732 - Remove httpclient 3

  • NEXUS-5768 - is replaced by

  • NEXUS-5214 - I want to be able to specify separate default HTTP proxies for http and https

  • NEXUS-5714 - Split /status resource, make it as originally intended

  • NXCM-5346 - nexus-m2settings:download fails if password contains "!" character

  • NXCM-5325 - Allow RHC to use SSL certificates from the Nexus private keystore

Repository Manager 2.5.1

The 2.5.1 release of Nexus Repository Manager Professional contains an updated version of the CLM integration plugin. There are no other changes/fixes in this release.

Repository Manager 2.5.0

These release notes are a compilation of new features and significant bug fixes for Sonatype Nexus Repository Manager 2.5.0.

New and Noteworthy

Grace Period for "Remove if Released" in Snapshot Cleanup Task

You can now specify a period of days to for Nexus Repository Manager to wait before it removes all snapshots from a released GAV.

New Scheduled Task to Remove Old Releases

A new scheduled task has been added which allows cleanup of old releases. Please see our blog post about removing old releases for the intended use cases.

Removal of Per-Profile Staging Repository Limit

In prior releases of Nexus Repository Manager you could only have 1000 repositories associated with a given staging profile. This limit has been removed.

Override Local Storage Location of Staging Repositories

It is now possible to override the disk storage location used for staging repositories. See NXCM-1221 for details.

Compatibility Notes

Java 6 Support is Deprecated

Java 6 reached Official EOL on February 2013. Since it is no longer receiving updates we are deprecating support for running Nexus Repository Manager with Java 6 in the 2.5 release, and will be removing it in the upcoming 2.6 release.

Ping and Startup Timeouts Disabled in Java Service Wrapper

The Java Service Wrapper ping and start up timeouts have been disabled. These timeouts are used to automatically restart the server if it appears to be hung. Over time we've found that use of these timeouts have two significant flaws:

  1. They often restart the server when it is not necessary

  2. When they restart the server it results in the loss of valuable diagnostic information

If you want to re-enable these you can do so by editing <nexus_root>/bin/jsw/conf/wrapper.conf and setting the "" and "wrapper.startup.timeout" to 390 and 300 seconds respectively.

Significant Bug Fixes


  • NXCM-5236 The nexus-clm plugin should respect insight scanner 'timeToReport' value


  • NXCM-5176 When nexus not running, and user submits license key, no message indicating what went wrong

  • NXCM-5181 Can't install new license into expired trial.

  • NXCM-5183 Nexus instance with expired non-trial license shows "to get started log in with admin/admin123"

  • NXCM-5184 Sub-Optimal license installation experience for new nexus pro installs

  • NXCM-5185 header license expiry message missing space


  • NXCM-5067 Enterprise LDAP may not be pooling LDAPS connections by default

  • NXCM-5165 LDAP Refresh button freezes Nexus UI


  • NXCM-5131 NuGet: expiration settings related to max age are editable but reset to zero when saved, item max age blanked


  • NEXUS-5225 p2-bridge produces loads of temp folders

  • NXCM-4485 P2 bridge should create temporary directories under tmp/p2-bridge directory

  • NXCM-4660 p2-bridge produces loads of temp folders

  • NXCM-5283 OBR Proxy repository broken after core change


  • NEXUS-2450 Maven2 to Maven1 ejb artifacts are served from **/jars/ directory instead of **/ejbs/

  • NEXUS-4306 metadata not updated when a release artifact is deleted

  • NEXUS-5511 Extend Core to improve reasoning when ItemNotFoundEx is thrown

  • NEXUS-5662 Log user ID in deleted artifacts message

  • NXCM-5187 Browse Remote does not work when expired remote ssl certificate is added to Nexus truststore

  • NXCM-5192 NPE when creating a proxy repo

  • NEXUS-5663 INFO - Repository out of service messages need context

  • NEXUS-5673 Shadow ItemNotFoundException when items deleted from master

  • NXCM-5219 Useless 'Repository out of service' log message


  • NEXUS-5621 Blocking routing rule omits "applied mappings"

  • NEXUS-5628 Automatic Routing prefixes.txt file does not contain Yum repository metadata

  • NEXUS-5698 S3 scraper fails to retrieve bucket list if response is truncated

  • NXCM-5188 Strict Checksum enforcement breaks Automatic Routing

  • NXCM-5222 prefix file discovery for secure central logs stack trace when missing auth token

Scheduled Tasks

  • NEXUS-3742 Grace period for remove if released snapshot cleanup

  • NEXUS-5607 Default values in snapshot removal task cause all snapshots to be deleted

  • NEXUS-5612 Undesired interaction between RecreateMavenMetadataWalkerProcessor and DefaultFSPeer

  • NEXUS-5629 Scheduled Tasks disapears

  • NXCM-4665 Scheduled Task to remove releases

  • NXCM-4979 Scheduled tasks disappearing

  • NEXUS-5682 Repeated log spam at DEBUG level attempting to delete checksum files while running Snapshot Removal Task


  • NEXUS-4599 /service/local/lucene/search docs indicate wrong result type

  • NEXUS-5641 nexus ignores lucene.fsdirectory.type in some cases

  • NEXUS-5658 NEXUS-5641 timeline plugin does not honour lucene.fsdirectory.type property

  • NXCM-4867 IndexerManagerEventInspector - Could not maintain index

  • NXCM-5047 Custom metadata not updated for deleted artifacts

Secure Central

  • NXCM-4859 Failed to fetch authtoken should not log stack trace


  • NEXUS-267 Enable sorting by column in the "security/users" table

  • NEXUS-5037 single quote symbol is accepted as user password but then does not work

  • NXCM-4361 Add salting to password hashing

Smart Proxy

  • NXCM-4761 Add error handler to cope with unexpected messages from non-compatible NX

  • NXCM-4958 Smart proxy preemptive fetch causes log spam when files deployed on remote don't match the release/snapshot repo policy


  • NXCM-5150 SSL:LDAP capability screen a bit unclear

  • NXCM-5163 "Load Certificate" buttons should not be enabled unless text field/area has content

  • NXCM-5146 Generic error message when smtp test fails due to untrusted cert

Staging/Build Promotion

  • NXCM-1221 Allow override of local storage for staging repositories.

  • NXCM-5122 NXCM-4906 Summary view is not scrollable

  • NXCM-5138 Canceling staging operation task while rule is walking results in "passed" rule

  • NXCM-5141 staging repository dates can display wrong timezone

  • NXCM-5153 Staging upload UI silently pushes into existing open directory

  • NXCM-5161 Staging upload over UI description is mandatory but unused

  • NXCM-5179 Get rid of arbitrary per profile 999 repository limit for staging profiles

  • NXCM-5189 Add support for plugins to contribute columns to staging repositories view

  • NXCM-5190 Add support for plugins to contribute fields to staging repository summary view

  • NXCM-5191 Add chiclet detail to staging summary and master grid column

  • NXCM-5194 nexus-staging-maven-plugin is not deploying maven-metadata.xml for maven-plugins

  • NXCM-5197 Warnings in log when running the "drop inactive staging repositories" task.

  • NXCM-5198 Cannot list staging repositories while "drop inactive staging repositories" task is running.

  • NXCM-5209 saving a staging profile with a target group that does not exist silently fails

  • NXCM-5210 hang performing staging and security operations

  • NXCM-5239 Addition of properties on staging repository DTO causing maven-plugin to fail (as well as older clients)

  • NXCM-5240 Addition of noSessionTimeout to /status causes staging maven-plugin to fail

  • NXCM-5302 Protect against staging.xml corruption


  • NEXUS-5483 help icons are missing for many form fields

  • NEXUS-5580 Confusing SMTP validation UI

  • NEXUS-5596 IE 10 Compatibility

  • NEXUS-5597 NEXUS-5596 dialog shadow rendering is not transparent

  • NEXUS-5598 NEXUS-5596 element warnings in console

  • NEXUS-5599 Block using IE7 or IE7 compatibility from using nexus UI

  • NEXUS-5613 Capabilities grid should default to sort by type

  • NEXUS-5614 Failed capability icon is same as disabled

  • NEXUS-5615 User profile summary requires "Last Name" but default configuration "admin" last name is blank

  • NEXUS-5672 NEXUS-5389 Extract ExtJS3 UI as a plugin

  • NEXUS-5667 Upgrade to ExtJS

  • NEXUS-5710 CSS does not load on content index pages


  • NEXUS-5702 Yum: Generate Metadata capability does not automatically execute on rpm upload when a Yum: Generate Metadata scheduled task is present


  • NEXUS-5420 Nexus email notifications should include a link back to the server that sent them

  • NEXUS-5468 http connection leak triggered by LocalStorageException

  • NEXUS-5585 Massive request if version check fails

  • NEXUS-5660 should be set by default in case Java 7+ or JMX is used with Nexus

  • NEXUS-5678 Disable ping timeout and startup timeout in wrapper.conf

  • NEXUS-5712 change logging pattern layout to include the full thread name by default

Repository Manager 2.4

These release notes are a compilation of new features and significant bug fixes for Sonatype Nexus Repository Manager 2.4.0.

Important: If you are making use of the Nexus Repository Manager Professional Staging/Build Promotion Suite read the compatibility notes below before upgrading to the 2.4.0 release.

New and Noteworthy

SSL Certificate Management

Previously, a Nexus Repository Manager which accessed remote servers that used SSL self-signed or client certificates required a Nexus Repository Manager administrator to manually install these certificates into a Java keystore/truststore using third-party command line tools. Detecting the cause of a connectivity problem in this case usually involved inspecting log files. This process was tedious and error prone.

Nexus Repository Manager 2.4 now provides a UI to manage SSL certificates for both repositories and LDAP servers. If access to a server is blocked due to an SSL certificate problem the UI will clearly show this. Using the new SSL certificate UI a Nexus Repository Manager administrator can inspect and approve the remote certificate, allowing Nexus Repository Manager to connect.

Automatic Routing

Nexus Professional's new Automatic Routing feature uses several new strategies to automatically detect the contents of remote proxy repositories so that it can avoid making unnecessary calls to their remotes. This results in a significant performance improvement for Nexus instances that contain multiple proxy repositories.

Staging: Improved Support for Long-running Operations

The staging repository UI and corresponding REST endpoints been reworked to provide feedback for close/promote/release operations that invoke long running staging rules.

Full documentation for the UI changes are available in the documentation.

The nexus-staging-maven-plugin has also been updated to properly handle long running staging rules.

Staging: Scheduled Task to Remove Inactive Staging Repositories

A scheduled task has been added which can remove staging repositories which are in open, closed, or promoted states and have been inactive for a specified number of days. See the Scheduled Task documentation for more information.

New Nexus Maven Settings Plugin

The "settings-download" goal of the old nexus-maven-plugin has been replaced by a new Maven plugin, the Nexus M2Settings Maven Plugin. This completes the deprecation of the old "nexus-maven-plugin".

Compatibility Notes

Nexus Plugin for Maven Retired

The Nexus Plugin for Maven has been deprecated for the past few releases. Due to changes in the staging REST API it no longer works with Nexus 2.4.0. Users must use the new nexus-staging-maven-plugin and nexus-m2settings-maven-plugin instead.

Nexus Maven Staging Plugin and Nexus Staging Ant Tasks

If you are using the nexus-staging-maven-plugin you will need to upgrade the version in your pom files to 1.4.4.

If you are using the nexus-staging-ant-tasks you will need to upgrade to version 1.4.

Staging REST API Changes

Scripts which directly call the staging REST API may require changes.

  • close/promote/release/drop operations are now asynchronous. Drop operations, including nexus-staging:release with auto-drop enabled, are complete when the response code is 404. For other operations, a GET request to "/service/local/staging/repository/<repo-id>" that returns a 'transitioning" field value of false indicates the operation is complete.

  • the staging repository 'closed' field has been renamed and repurposed to an 'updated' field - meaning the last time an operation was recorded against the staging repository.

New Privileges Required to Access Staging Repository UI

The following privileges are now needed for access to the staging repository UI:

  • Staging: Rule Types (read)

  • Staging: Rule Set (read)

These privileges have been added in to the built in 'UI:Staging Repositories" role in the 2.4 release.

Significant Bug Fixes


  • NEXUS-5478 - LDAP Group ID's which contain "&" do not work

  • NEXUS-5679 - LDAP connection leak

  • NXCM-4885 - Enterprise LDAP UI is broken

  • NXCM-4977 - Enterprise LDAP user cache is hard coded to 100, and no override is set in ehcache.xml

  • NXCM-4998 - Use user ID sent to nexus as LDAP cache key, not user ID retreived from LDAP


  • NXCM-4890 - UI does not show when license has expired

Maven Repositories

  • NEXUS-3398 - Repository is blocked for config additions while downloading indexes

  • NEXUS-5418 - Maven repositories handles sha1/md5 files "as one" with main file, but is not locking them

  • NEXUS-5481 - display the reason a remote repository is auto-blocked in the ui

  • NEXUS-5505 - Nexus attribute mechanism causing collisions with platform special files

  • NEXUS-5521 - Repository groups are sorted in reverse order

  • NEXUS-5525 - Custom packaging types do not show up in index after deployment

  • NEXUS-5539 - Refresh of Nexus Managed Repositories list clears list

  • NEXUS-5556 - Bookmarkable URLs no longer work in repository view

  • NEXUS-5606 - Deleting an artifact should delete it's md5 and sha1 too

  • NXCM-4968 - Maven Dependency display broken

  • NXCM-4994 - Nexus managed repo disappears from list after deleting file


  • NXCM-4861 - Could not acquire exclusive lock on repository procured in 60 seconds


  • NEXUS-5517 - Latest fields are filled in only when "collapse" happens of search result

  • NEXUS-5542 - Update index task fails if one of the processed repositories gets a SocketTimeoutException

  • NEXUS-5570 - Unintialized variable in LockingIndexingContext can cause NPE during search

  • NEXUS-5577 - Update to maven indexer 5.1.1


  • NEXUS-5520 - Role management UI gets duplicated

  • NXCM-4941 - Render problem for Access User Token in Chrome

Staging/Build Promotion

  • NXCM-4780 - build promotion that takes long time and has rule failures does not display rule failures to ui

  • NXCM-4786 - staging repositories list does not always show promoted repositories

  • NXCM-4805 - when error on nexus deploy due to bad url, print the url

  • NXCM-4900 - Nexus should not allow a user to delete a staging profile that has repositories associated with it.

  • NXCM-4901 - Misleading "Missing MD5" message when staging checksum validation fails

  • NXCM-5025 - Staging release incorrectly fails with access denied exception

  • NXCM-5205 - Changing the repository target of a staging profile that has promoted repsitories causes them to be dropped.

  • NXCM-5045 - Release fails if requestor e-mail address can't be found

  • NXCM-5175 - If staging fails due to too staging repository limit being hit no message is logged


  • NXCM-4431 - Finalize deprecation of nexus-maven-plugin.

  • NEXUS-5506 - New REST API documentation is extremely difficult to navigate

  • NEXUS-5549 - Wrong NexusApplication log level

  • NEXUS-5480 - Wrong Mount Points in API docs

Known Issues

  • NEXUS-5628 - Automatic Routing prefixes.txt file does not contain Yum repository metadata

Repository Manager 2.3.1

Bug fixes in this release:

  • NEXUS-5491 - Entering username/password for proxy settings in a repository cause clearning of all values on save

  • NEXUS-5517 - Latest fields are filled in only when "collapse" happens of search result

  • NEXUS-5521 - Repository groups are sorted in reverse order

Repository Manager 2.3

These release notes are a compilation of new features and significant bug fixes for Repository Manager 2.3.

New and Noteworthy

Support for Hosted and Group Yum Repositories

  • Any hosted Maven 2 repository in Nexus Repository Manager can be configured to act as a Yum repository

  • Yum repositories are automatically updated if you upload/deploy/delete a new RPM into Nexus Repository Manager.

  • Full group repository support so that you can logically group a set of Yum repositories behind a single URL.

  • Use Yum group repositories as target of staging repositories

Revamped Search/Index

The search/index feature has been been re-architected to address many long standing issue. Nexus Repository Manager search indexes are now faster, more reliable, and scales significantly better

Smart Proxy Enhancements

  • Support for delete events

  • Full support for staging drop/close/release (messages for individually affected artifacts, so preemptive fetch will work)

Improved solution for overriding/adding MIME Types

By default when Nexus Repository Manager downloads files into proxy repositories it validates that the downloaded file's contents match what is expected based on the file's MIME type.

This works well for most normal file types, but occasionally you may find that you need to make Nexus Repository Manager aware of new MIME types, or change one of the built in definitions.

Repository Manager 2.3 contains a new feature which allows you to do this. For information on how to use this feature see here .

Plugin Compatibility Notice

A focus of the 2.3 release was updating the versions of libraries shipped with Nexus Repository Manager to pick up bug fixes, security fixes, and performance improvements. As a result there have been significant changes in versions of libraries shipped with Nexus Repository Manager 2.3, and also a few plugin API changes. If you have developed (or make use of) a Nexus plugin which is not distributed with Nexus Repository Manager you should validate that it works with the 2.3 release.

Miscellaneous Compatibility Notes

  • Due to NEXUS-5218 Nexus sets the "" system property. If you need IPv6 support add "" into the "<nexus_root>/conf/" file.

  • The checksum Java applet has been removed NEXUS-5361.

Significant Bug Fixes

Maven Repositories

  • NEXUS-4864 Nexus makes impossible to proxy Flex SWC artifacts

  • NEXUS-5197 NPE in member change detection

  • NEXUS-5257 Remote Browsing does not respect non-proxy hosts in http proxy settings

  • NEXUS-5258 Newly added proxy repositories has rrs/provider field filled in

  • NEXUS-5382 hostname with _ char in it breaks browse remote tab

  • NEXUS-5400 Rebuild metadata task moves temporary upload files to the trash

  • NEXUS-5414 Snapshot remover can be run against proxy repos, it removes snapshots and rewrites the cached metadata files


  • NXCM-4745 Protect against page cycles when proxying NuGet feeds

  • NXCM-4816 NuGet gallery resource doesn't pick up base URL of server


  • NXCM-4561 Invalid configuration after deleting repo which is procurement source

  • NXCM-4798 Procurement rules are not applied when procurement repository is in a group


  • NXCM-4714 Maven indexer can prevent Nexus from shutting down cleanly ( Nexus836OOSRepoReindexTaskIT )

  • NEXUS-5271 Indexer leaves behind temp directories

Secure Central

  • NXCM-4781 Retrieval of Secure Central authorization token fails through http proxy


  • NXCM-4520 Malicious staging rules can inject bad html

Staging/Build Promotion

  • NEXUS-5396 "411 Length Required" when using nexus-staging:close and other Nexus client operations with nginx

  • NXCM-4557 Thread starvation in indexer/staging

  • NXCM-4570 Exception on sending emails during promote/drop staging stops the flow

  • NXCM-4779 deadlock in org.sonatype.sisu.goodies.eventbus.internal.guava.SynchronizedEventHandler


  • NEXUS-3442 Lots of "An exception occurred writing the response entity: null" in the log

  • NEXUS-3728 Nexus (JSW) shell script improperly uses su command

  • NEXUS-4877 using a "&" symbol in the password filed of nexus corrupts password for the user account

  • NEXUS-5169 Improved solution for adding/overriding MIME type mappings

  • NEXUS-5233 Private Sun system property "" is used in wrapper.conf

  • NEXUS-5294 Add visual clue that a user is read-only

  • NEXUS-5360 Update to ExtJS3

  • NEXUS-5413 RedirectToHttpsRule spams log with thousands of messages

  • NEXUS-5417 capability plugin : RegexpFieldValidator inverse logic

  • NXCM-4530 Fix logging of NoSuchRepositoryException

  • NXCM-4546 Example jetty configurations need updating to match official jetty.xml

Repository Manager 2.2.1

Bug fixes in this release:

  • NXCM-4781 - Retrieval of Secure Central authorization token fails through http proxy

Repository Manager 2.2

These release notes are a compilation of new features and significant bug fixes for Repository Manager 2.2

New and Noteworthy

Secure Access to Maven Central

Sonatype is now offering secured SSL access to Maven Central. Providing SSL support for Central means that your components are no longer susceptible to man-in-the-middle attacks that could compromise the component. SSL also eliminates the potential for a hacker to gain visibility into your organization by tracking the components that you download for your development initiatives.

New installations of Nexus Repository Manager Professional will have secure access to central enabled by default. Upgrades to Nexus Repository Manager Professional 2.2 can be converted to use the new service by simply by changing the central URL to

For information on obtaining this service for Nexus Open source or other repository managers visit the Secure Access to Central site.

Note: This service requires that the JRE running your repository manager has unlimited strength JCE installed.

Note 2: We're seeing evidence that a few HTTP proxy servers may be rejecting the request Nexus Professional makes for the authorization token. If you are experiencing a problem accessing this service please file a ticket at httts:// and we will provide you with a token. We'll be fixing this issue soon.

Deferred Snapshot Deploy in Multi-Module Builds

The nexus-maven-staging-plugin has been enhanced to allow deferred deployment of snapshots from multi-module Maven builds. Deployed snapshots are held in a temporary location until all module builds have been completed successfully, and are deployed together. This enhancement gives transactional behavior to multi-module snapshot builds, either all modules are deployed or none are.

Hosted Site Repositories in Nexus Community Edition

Nexus Community Edition now has support for hosted site repositories.

Significant Bug Fixes

Enterprise LDAP

  • NXCM-4524 Improve handling of intermittent LDAP failures

  • NXCM-4758 LDAP connection timeouts are not being cached


  • NXCM-2795 OBR groups do not work properly if they contain more than on hosted repository

  • NXCM-4715 P2 mirrors does not work for composite repositories with only 1 member repository


  • NXCM-4630 Procurement repository unusable while it is rebuilding rules

Smart Proxy

  • NXCM-4159 Preemptive fetch in smart proxy

  • NXCM-4529 Smart proxy connection doesn't pick up changes to remote URL in proxy repo configuration

  • NXCM-4626 Smart Proxy Issue with Nuget Repos


  • NXCM-4447 nexus-staging-maven-plugin deploy does not explain deploy failure context to Maven user

  • NXCM-4500 Staging rule set description doesn't handle multibyte characters properly

  • NXCM-4508 Wrong case displayed for staging repository name in user interface

  • NXCM-4550 staging promotion should fail with more specific error when a non-existent promotion profile is specified

  • NXCM-4567 NPE in nexus-staging when switching to direct deployUrl

  • NXCM-4580 Staging repository reappeared after promotion.

User Token

  • NXCM-4731 User Token link gives 404 dialog when clicked

  • NXCM-4742 User Token UI won't load due to 404 error


  • NEXUS-3424 Nexus prints stack trace to log when remote repo doesn't have an index.

  • NEXUS-5192 Improve efficiency of Nexus Index tree

  • NEXUS-5249 Update Indexes task stops processing on RemoteItemNotFoundException

  • NEXUS-5280 DefaultIndexerManager make wrong use of ContextMemberProvider when working with groups


  • NEXUS-4692 Make HTTPClient 4.1 the default transport in Nexus

  • NEXUS-5228 Regression: Browse local storage tree gives 404 error message for maven-metadata.xml

  • NEXUS-5291 RemoteRepository implementations performance: HC3x vs HC4x

Miscellaneous Fixes

  • NEXUS-5158 When anonymous access is disabled just bring up the login dialog automatically, don't show a warning.

  • NEXUS-5184 include wrapper-override.conf directive should be removed since it is unreliable

  • NEXUS-5216 Nexus Archetype plugin produces invalid catalog for non-searchable repos

  • NEXUS-5241 Checksum and metadata deploys are being recorded in system feeds, causing them to grow very large

  • NEXUS-5246 Stop using 301 Redirection Permanent and switch to 307 Redirection Temporary instead in REST Resources

  • NEXUS-5265 remove artifactory bridge from nexus bundles


Repository Manager 2.1.2

Significant bug fixes in this release:

  • NEXUS-5205 - Nexus doesn't trim e-mail adresses anymore

  • NEXUS-5219 - Empty trash task fails

  • NXCM-4502 - Latest NuGet package explorer ( ) doesn't work with Nexus.

  • NXCM-4544 - JS error when loading profile tab when auth required

  • NXCM-4547 - POST, GET staging maven plugin operations do not respect Maven configured proxy settings

  • NXCM-4550 - Staging promotion should fail with more specific error when a non-existent promotion profile is specified

  • NXCM-4555 - Usertoken queries status as soon as js loads

  • NXCM-4582 - NPE when proxying internal NuGet repo

Repository Manager 2.1.1

Bug fixes in this release:

  • NEXUS-5193 - LDAP does not allow ldaps:// URLs

Repository Manager 2.1

These release notes are a compilation of new features and significant bug fixes for Sonatype Nexus Repository Manager 2.1.

New and Noteworthy

New Staging Suite

The Nexus Repository Manager Staging Suite has been completely revamped in Nexus Repository Manager 2.1.

Major new features include:

  • Selection of staging profiles by ID from within the build

  • Atomic Deply - All artifacts from multi-module builds are uploaded together as a single entity only after everything has been successfully built

  • Automatic closing of staging repository at the end of a build

  • Tags can be added to staging repositories, these will be preserved on the staged artifacts in Nexus Repository Manager throughout their lifecycle.

  • Local disk staging of artifacts to allow additional testing before they are uploaded to Nexus Repository Manager

  • Support for staging from ANT builds, and a REST API which allows other staging clients to be easily built

  • Automatically drop a staging repository if build fails

  • Automatically promote a staging repository if build succeeds.

User Token Authentication

When using Apache Maven with Nexus Repository Manager, the user credentials for accessing Nexus Repository Manager have to be stored in clear text in the user’s settings.xml file. Maven does have the ability to encrypt passwords in a user's settings.xml, but since the encryption is reversible it isn't truely secure. This lack of security is of particular concern when nexus is configured to use external authentication such as LDAP.

To solve this problem Nexus Repository Manager 2.1 introduces a two part token for the user, which can replace their regular credentials.

Significant Bug Fixes

Maven Repositories

  • NEXUS-4275 - If index download fails due to error then "download index" task should end in "broken" state.

  • NEXUS-4918 - Nexus is generating invalid maven-metadata.xml artifactt GA lavel

  • NEXUS-4970 - Nexus Maven metadata merge operation should not throw errors on corrupt metadata

  • NEXUS-5023 - When downloading .ear or .war file, the browser thinks the extension is zip

  • NEXUS-5043 - the ~ character is not properly decoded when deployed using maven 3

  • NEXUS-5145 - NPE when reusing same repository id for a proxy

NuGet Repositories

  • NXCM-3904 - Usability issue with NuGet: API keys are shown when key security realm has not been added.

  • NXCM-3964 - Add support for the new NuGet "FindPackagesById"FindPackagesById data service

p2 Repositories

  • NXCM-3914 - Newly created P2 proxies eagerly loading of remote repository's repository-metadata.xml files from mirrors can delay proxy metadata creation

  • NXCM-4053 - UID deadlock when accessing p2 metadata

  • NXCM-4391 - OOM is causing a deadlock in P2 Proxy Repository

  • NEXUS-5104 - P2 plugin proxy repository does not obey "local only" flag in requests

Repositories (general)

  • NEXUS-4064 - Turning off "publish url" for a repository causes most context menu items in repository view to disappear.

  • NEXUS-4855 - Repository registry becomes a CPU hog when registrytry contains a lot of repositories, and does too much

  • NEXUS-4871 - Attribute storage should discard empty attribute files

  • NEXUS-4878- When deleting repositories if there are dependencies you get an awful error message giving a bad request

  • NEXUS-4984 - Zero length checksum file causes artifact to be rejected when checksum policy is "Warn"

  • NEXUS-5109 - NFC is inherited by different repositories having same repoID

Scheduled Tasks

  • NEXUS-4465 - Next run is wrong for scheduled tasks usingng advanced cron expression

  • NEXUS-4862 - Snapshot remover shouldn't stop processing if it encounters a zero length file.


  • NXCM-4274 - Credential time outs

  • NEXUS-5040 - Role cannot be edited if it contains a privilege contributed by a plugin which has been removed

  • NEXUS-5048 - Multibyte characters are not handled correctly in user administration screen.

  • NEXUS-5064 - LDAP connection pool doesn't work with SSL

  • NEXUS-5122 - ConcurrentModificationException in security XmlRolePermissionResolver

Security Vulnerabilities

  • NXCM-4061 - Investigate and resolve security vulnerabilities in Nexus 2.0.x branch identified by Insight scan

  • NXCM-4477 - Disable logging capability due to security vulnerability in XML external entity reference

  • NEXUS-5031 - Upgrade to latest Jetty 7.x to solve known denial of service security vulnerabilities

Smart Proxy

  • NXCM-3750 - Changes to group config are not propagated to subscribers

  • NXCM-3747 - Recursive events sent to subscriber for delete events

  • NXCM-3872 - Smart proxy broker database that is not accessible due to file permissions can prevent startup of nexus

  • NXCM-3795 - ConcurrentModificationException after reaching Broker memory limits

  • NXCM-4516 - Smart proxy expire cache isn't working.


  • NXCM-1269 - Can't see all failures in staging rules dialog (it needs a vertical scrollbar).

  • NXCM-2874 - Add a role to Nexus which includes all privileges needed to deploy/release/promote for a staging profile.

  • NXCM-3133 - only the staging bundle deployer or someone w/ a special preventivilege should be able do drop a staging bundle

  • NXCM-3526 - staging repos table - sorting by date sorts literally

  • NXCM-3768 - Staging release replaces metadata then rebuilds it

  • NXCM-4381 - Add deprecation logging message to old nexus-maven-plugin goals

  • NXCM-4476 - Staging descriptions that have multi-byte characters don't show up in e-mails.

Miscellaneous Fixes

  • NXCM-3876 - Maven Settings template ID has poor UI validation resulting in Server http 500 400 errors

  • NXCM-4191 - Custom metadata support for multiple n3 files

  • NXCM-4433 - Can't install binary license file using Chrome 20

  • NXCM-4475 - Runtime Exception starting Nexus 2.0.6

  • NEXUS-4863 - Nexus Plugin Manager matches plugin interdependencies by GA only on loaded plugins

  • NEXUS-4905 - Files not ending in "pom" or "jar" don't show up in "newly cached files" system feed

  • NEXUS-5018 - Project generated from nexus plugin archetype doesn't compile

  • NEXUS-5185 - Add context menu to main tabs so that they can be mass-closed

Repository Manager 2.0.6

Bug fixes in this release:

  • NXCM-4372 - Nexus running in '/' breaks licensing redirection

  • NXCM-4374 - "upload a license file" link doesn't work in IE9

  • NEXUS-5096 - Security should cache created WildcardPermission objects, not recreating them over and over again

  • NEXUS-5099 - Memory leak in attributes upgrader when running against virtual M1 -> M2 repo

Repository Manager 2.0.5

New and Noteworthy

This release has added support to streamline the initial Nexus Repository Manager experience for new users.

Significant Bug Fixes

General Improvements

  • NXCM-4111 - Regression: When metadata expires for p2 proxy repository the metadata is always downloaded and processed again

  • NXCM-4112 - MimeDetector is not picking up NuGet specific

  • NXCM-4164 - Regression: Crowd security realm is picking up global http proxy settings

  • NXCM-4175 - Poor performance for requests coming into procurement repository

  • NXCM-4226 - NuGet FindPackagesById service generates incorrect 'next' query links


  • NEXUS-5049 - Anonymous disabled, but still can log in

Repository Manager 2.0.4-1

Bug fixes in this release:

  • NEXUS-5035 Regression: Performance degradation when sending error responses

Repository Manager 2.0.4

New and Noteworthy

This release has added additional links to documentation and support resources including links to the Sonatype Knowledge Base in an effort to add more paths for users to take advantage of relevant documentation.

Significant Bug Fixes

General Improvements

  • NXCM-4047 - NuGet version column should sort by numeric grouping rather than the default

  • NXCM-4084 - Add Insight security and license information to artifact search results


  • NEXUS-5032 - XSS vulnerability in /artifact/maven/resolve REST endpoint

  • NEXUS-50321 - Upgrade to latest Jetty 7.x to solve known denial of service security vulnerabilities

Repository Manager 2.0.3

Bug fixes in this release:

  • NXCM-3972 - Modify NuGet REST endpoint so it checks read privilege instead of view privilege

  • NXCM-3963 - Deadlock in p2 group repository

  • NXCM-3952 - NuGet database lock-file may stay around after shutdown if the computer's IP address changes while Nexus is running

Repository Manager 2.0.2

Bug fixes in this release:

  • NXCM-3938 - Newly published "p2.index" file is causing proxies of update site to fail.

  • NXCM-3946 - Wrong URL is returned from "/service/local/ldap/servers" REST resource.

  • NXCM-3947 - NuGet plugin does not return expected 401 when anonymous user with no read privileges accesses the gallery

Repository Manager 2.0.1

Bug fixes in this release:

  • NXCM-3917 - NuGet tab does not need to fetch the repository configuration

  • NXCM-3916 - P2 proxy repository fails to connect to remote if HTTP proxy server is configured.

  • NXCM-3910 - window title should match more closely to product title

  • NXCM-3871 - Admin user mapped in through LDAP group mapping cannot log in after license has expired.

  • NXCM-3004 - Mirrors fail to download properly for Indigo update site

Repository Manager 2.0

These release notes are a compilation of new features, system requirements, and significant bug fixes specific to Repository Manager.

See the Sonatype Nexus OSS Release Notes for the corresponding changes in the base product.

Nexus Repository Manager Professional can be downloaded through the Repository Manager Download page.

Important Upgrade Notes

Important: Please read over the release notes carefully and refer to the instructions on Upgrading Nexus. The upgrade process has changed notably.

Memory Requirements

Nexus Repository Manager 2.0 requires more JVM heap memory than previous versions by default. The JVM Perm Gen settings have been increased to 192MB to allow for this. This is primarily due to the newly added Smart Proxy and NuGet features. If you do not plan to use enable these features, Nexus Repository Manager's memory requirements will be reduced.

  • NXCM-3880 - Bump perm gen space in wrapper to 192Mb

New and Noteworthy

NuGet Support

With the recent creation of the NuGet project a package management solution for .NET developers has become available. Similar to Maven dependency management for Java developers, NuGet makes it easy to add, remove and update libraries and tools in Visual Studio projects that use the .NET Framework.

Starting with version 2.0 Repository Manager has full support for NuGet Repositories, including hosted, proxy, virtual, and group repositories.

Related User Stories:

  • NXCM-3482 - Investigate support for NuGet repositories

  • NXCM-3537 - Enhancements to basic NuGet support

Nexus Smart Proxy

Nexus Repository Manager Professional 2.0 includes a distributed eventing mechanism called Smart Proxy.

Smart Proxy is built on a secure and reliable messaging layer that enables Nexus repositories to communicate event information (e.g. a new artifact has been uploaded). This reliable delivery of event information and the resulting awareness by subscribing Nexus instances enables customers to build out deployment topologies that can achieve higher levels of availability and resiliency.

This means a number of geographically distributed Nexus instances are now able to operate as a more cohesive repository network. This cohesion will expand as we continue to add other services that leverage the new awareness the messaging and eventing fabric provide.

For more information how this important new feature can improve your Nexus Repository Manager topology, refer to the documentation.

Related User Story: NXCM-3485 - As a user I need a proxy repository which works properly running against remotes that have frequent updates

Insight Repository Health Check Plugin (Pro)

Repository Health Check is a feature of Nexus that facilitates data used for Sonatype Insight. Sonatype Insight is a separate product that consists of tools to monitor and manage license, quality and security data about artifacts used in your software development life cycle.

Repository Health Check provides access to a subset of the available data in Sonatype Insight right in your Nexus server. This service provides information about artifacts Nexus has downloaded from Maven Central, including license information, security vulnerability data and other statistics.

User Interface Improvements

A fresh look consistent with other Sonatype products.

See Sonatype Nexus OSS 2.0 Release Notes for a summary of additional changes affecting the user interface.

Significant Bug Fixes

This list contains other significant new features and bug fixes in Nexus 2.1.

General Improvements

  • NXCM-2928 - Noise on update sites in Nexus logs

  • NXCM-3616 - nexus-p2-plugin prints a ton of log on nexus startup

  • NXCM-3627 - Procurement repository auto-blocks if "remote" throws an access denied exception

  • NXCM-3643 - Change name of "Maven Central" proxy to "Central"

  • NXCM-3690 - Remove the google code proxy repository from the default configuration

  • NXCM-3737 - Left navigation menu cleanup

  • NXCM-3503 - The way custom metadata indexes are laid out in "indexer-pro" directory can cause collisions.

  • NXCM-3666 - Change log level of org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter to INFO

  • NXCM-3676 - Provide option (via system property) to prevent staging deploy from failing if a user doesn't have access to a profile in the list.


  • NXCM-2974 - Nexus doesn't seem to handle entities in ldap username correctly

  • NXCM-3025 - Authentication caching is not working for crowd security realm.

  • NXCM-3645 - Anonymous user can access unexposed repositories in Nexus

  • NXCM-3647 - Regression: Security Flaw: Reflected XSS on the Resolve Page in Nexus (AVT 27069)

  • NXCM-3600 - Anonymous user can delete artifacts from open staging repositories.

Performance and Robustness

  • NXCM-3514 - Concurrent modification exception in staging.

  • NXCM-2976 - Dropping a staging repository can cause an unrelated deploy to fail due to concurrent modification exception.

  • NXCM-3477 - Corrupt license access database causes server to fail startup

  • NXCM-3011 - Use batch inserts for License report DB to improve performance

  • NXCM-3492 - Proxy Attribute storage is slow and unreliable.

  • NXCM-3732 - License access file causes excessive CPU usage on RSO

P2 and OBR plugins

  • NXCM-3606 - Switch to OSS versions of the OBR and P2 nexus plugins

  • NXCM-3465 - Use the open source version of the OBR plugin in pro

  • NXCM-3516 - Use the open source versions of the P2 plugins in pro

  • NXCM-2947 - P2 proxy repository which goes through ISA http proxy fails

  • NXCM-3339 - Allow p2 repository group still working even if one repo is not available

  • NXCM-3608 - Need a upgrade path from Nexus PRO 1.9.x to Nexus PRO 1.10/2.0 (OBR + P2)