Sonatype Nexus Repository 3.79.0 - 3.79.1 Release Notes

Sonatype Nexus Repository's Usage Center now offers enhanced visibility into monthly request patterns, empowering users to better understand their Nexus Repository usage.

The Usage Center now includes a Requests Per Month panel that displays both the highest and average monthly request counts for the current calendar month. These statistics update once per day.

This feature provides a clear, data-driven understanding of repository activity, allowing administrators to identify usage trends, anticipate potential bottlenecks, and ensure efficient resource allocation. By tracking these key metrics, users can make informed decisions to maintain optimal performance and responsiveness within their Nexus Repository environment.

For full details, see the Usage Center and Usage Metrics help documentation.

Sonatype Nexus Repository Pro now supports pre-signed URL downloads for AWS S3. If you are using AWS S3 blob storage, enabling pre-signed URL downloads is highly recommended to significantly enhance performance. This feature allows binary downloads to occur directly from S3, bypassing the Nexus Repository server and reducing server load.

By configuring this option per blob store, you ensure that large binary artifacts are served with optimal efficiency, resulting in faster download times and a more responsive repository. For details on enabling this feature, see the AWS S3 help documentation.

In this release, we’ve made updates to the licensing page that is available through the Sonatype Nexus Repository user interface to further clarify our license terms. For more details, see the licensing help documentation.

Sonatype's new Malware Defense Evaluation API enables on-demand malware checks for software artifacts, providing rapid and automated threat detection across development pipelines. This API leverages Sonatype's comprehensive threat intelligence to accurately pinpoint malicious components, including those deeply embedded within dependencies.

The API's response includes detailed information about identified threats, such as the attackVector and threatTypes. For example, a malicious component might be flagged with attackVector: "trojan" and threatTypes: "secrets_exfiltration, backdoor", offering a clear understanding of the specific risks involved.

For detailed information, refer to the Malware Defense Evaluation REST API documentation.

Sonatype Repository Firewall now provides a dedicated REST API to mitigate Namespace Confusion attacks, a common vulnerability in dependency management.

This new API allows users to define and manage protected namespaces, preventing the installation of malicious packages that exploit naming conflicts. Using the new endpoint, administrators can add namespaces, including wildcard support, to a dedicated repository that is automatically created if it does not exist. Additionally, the API offers a DELETE method to remove all protected namespaces for a given format, providing comprehensive control over your namespace security.

This functionality empowers users to proactively defend against Namespace Confusion attacks and maintain the integrity of their software supply chain. For full details, see the Namespace Confusion REST API help documentation.

Earlier this month, Sonatype released version 2.5.0 of the Firewall for Artifactory plug-in to support JFrog Artifactory versions 7.104.5 and later. While the previous version, 2.4.13, remains available for download, it is only compatible with Artifactory versions up to 7.98.15.

Users on newer Artifactory versions must upgrade to 2.5.0 for continued functionality and security. Find the latest plugin on the Download and Compatibility page. Also, see the Firewall for Artifactory compatibility information and our Sonatype Repository Firewall for JFrog Artifactory help documentation for full details about our plugin.

Please note that Firewall Classic has been sunset and is considered fully replaced by Sonatype Repository Firewall. For full details, see the Firewall Classic Sunsetting documentation.

Make global deployments resilient with multi-region disaster recovery. Bounce back from disaster with enhanced recovery time and self-repair capabilities.

Experience a more intuitive, modernized Nexus Repository with an enhanced user interface. Navigate effortlessly through a sleek, streamlined design built for efficiency.