Sonatype Nexus Repository 3.78.0 Release Notes

This release marks a significant shift in Nexus Repository's architecture, migrating from Apache Karaf and OSGi to the Spring Framework. This transition modernizes the underlying technology stack, aligning with industry best practices and enabling future innovation.

Sonatype Nexus Repository is now packaged as a single "uber-jar," simplifying deployment and dependency management. Nexus Repository installers now include ARM-compatible JREs for Unix and macOS platforms in addition to the x86-64 versions. Windows installers will continue to be x86-64 only.

With this release, JReleaser replaces Install4J as our tool for building our macOS, Windows, and Unix installers. Initially, JReleaser focuses on bundling a JRE with the application, maintaining the existing recommendation to use the bundled JRE for all deployments. Future iterations will leverage JReleaser's capabilities to further refine the installer experience and integrate more tightly with our uber-jar packaging.

Please note that our Unix archive now comes bundled with a platform-specific JDK and can no longer be used in a Mac environment.

This release completes the conversion of all Groovy source code to Java within Nexus Repository, both in the core and proprietary components. This migration simplifies maintenance and removes a barrier to upgrading to newer JDK versions. Note that you can still execute Groovy scripts via Task. See our Script API help documentation for more information.

This release broadens Sonatype Nexus Repository’s architecture compatibility by introducing ARM Docker images alongside the existing x86_64 versions in Docker Hub. This enhancement aligns with our commitment to providing flexible deployment options and supporting a wider range of infrastructure.

You can find ARM images for Nexus Repository version 3.78.0 and later on Docker Hub under sonatype/nexus3.

This release enhances npm audit command security (for npm version 7 and later) by ensuring full integration with Sonatype Repository Firewall. For deployments using Repository Firewall, all components retrieved during an npm audit using npm version 7 or later are now subject to Firewall checks, providing an added layer of protection.

The Log4j Visualizer feature has been removed in this release. This early experiment in adding Software Composition Analysis (SCA) capabilities to Nexus Repository is now superseded by more comprehensive features, such as our malware warning banner.

We have also officially sunset Bower format, which was last available in our 3.70.x release line and only supported for OrientDB instances.

For full details on our feature sunsetting process, see our feature sunsetting documentation.

This release updates core dependencies, starting with a move from SLF4J 1.7 to SLF4J 2.0 and from Logback 1.2 to Logback 1.5. This upgrade removes a key blocker, paving the way for future updates to other core technologies like Jetty and Keycloak. These upcoming upgrades will unlock new capabilities and performance improvements.