Sonatype Nexus Repository 3.90.0 - 3.90.5 Release Notes

Sonatype Nexus Repository now supports the Terraform group repositories, allowing you to aggregate multiple Terraform hosted and proxy repositories into a single endpoint. This capability simplifies configuration for developers by providing one consistent URL for Terraform modules and providers, while centralizing control and visibility for repository administrators.

Terraform group repositories include intelligent caching with configurable TTL values for modules and provider versions, along with request deduplication to reduce redundant upstream queries. When the same version exists in multiple member repositories, you can apply configurable conflict resolution strategies to determine which artifact is served. The implementation also tracks member health and automatically handles unhealthy members, while exposing comprehensive metrics to help you monitor cache performance and overall repository health.

For full details, see the Terraform Repositories help documentation.

Sonatype Nexus Repository now supports Swift hosted repositories, enabling you to publish and manage Swift packages as .zip files with MIME type validation. This capability allows teams to securely store and distribute internal Swift artifacts and approved third-party components through Nexus Repository, providing a centralized and reliable source for Swift dependencies.

Swift hosted repositories support enterprise controls such as access management and auditing, along with optional anonymous access where appropriate. For full details, see the Swift Repositories help documentation.

In Sonatype Nexus Repository 3.90.0, the Repair - Execute Data Repair Plan task is re-enabled by default. We previously disabled this task in 3.88.0 to prevent potential data loss while we addressed issues affecting the Verify and Repair and Data Repair Plan tasks.

You can now safely use the Repair - Execute Data Repair Plan task to correct data inconsistencies between the database and blob store. This update restores the intended maintenance workflow and allows you to run data repair operations with confidence.

This re-enablement aligns with the introduction of Recovery Mode, which provides a controlled operational state to help protect data integrity during repair and reconciliation activities.

Sonatype Nexus Repository now includes Recovery Mode, a controlled operational state designed to support safe reconciliation between the database and blob storage after outages or data inconsistencies. When enabled, Recovery Mode helps protect data integrity by preventing specific background tasks from interfering with repair operations. This feature is available only for self-hosted deployments and requires administrative privileges. Before enabling Recovery Mode, consult Sonatype Support to confirm it is appropriate for your situation.

For full details, see the Recovery Mode help documentation.

A new User Token API allows administrators to create, view, and delete user tokens. With the appropriate privileges, administrators can generate tokens for specific users and realms, retrieve token summaries (excluding sensitive fields), and manage tokens across individual or all realms, including options to include expired tokens in responses.

For full details, see the User Token API help documentation.

Sonatype Nexus Repository now enhances policy-compliant component selection (PCCS) by exposing filtered npm package versions directly in the package metadata. When PCCS filters versions that violate your Repository Firewall policies, those versions appear in the sonatype_filtered_versions field in the component's metadata. This update provides clearer visibility into which versions were excluded, helping teams quickly understand why a version is unavailable and identify an acceptable alternative.

Sonatype Nexus Repository Cloud now supports more granular access control for the Log Management API. Previously, access to the Log Management API required the broad nexus:* permission, which is granted only to the nx-admin role. You can now grant access to this API using the built-in nexus:logging:read permission and the associated nx-logging-read privilege. This update enables teams to follow the principle of least privilege by allowing service accounts to download logs without granting administrative access across the entire tenant.

These fixes address behavior specific to individual repository formats such as Docker, Maven, NuGet, Yum, APT, Helm, npm, Terraform, and RubyGems. The updates improve metadata accuracy, caching behavior, authentication handling, concurrency, and client compatibility to ensure predictable and standards-compliant interactions across all supported ecosystems.

This set of fixes improves the accuracy, consistency, and performance of search operations. Enhancements address filtering logic, wildcard and token handling, database-specific behavior, and request optimization so that users and automation tools receive correct and complete results across deployment types.

These updates strengthen reliability in clustered and high availability deployments. They resolve state consistency issues, improve concurrency handling, clarify clustering diagnostics, and reduce the likelihood of race conditions or configuration mismatches across nodes.

These fixes focus on blob store validation, lifecycle management, and cleanup behavior. They improve correctness and resilience for both file- and S3-based storage, ensuring safe configuration, reliable deletion, and consistent data handling across UI and API operations.

This group enhances upgrade, migration, import, and export workflows. The improvements ensure schema completeness, preserve metadata integrity, increase resilience to interruptions, and optimize performance when working with large or complex repositories.

These changes improve system security posture and authentication reliability. They address third-party library vulnerabilities, permission model consistency, credential handling edge cases, and secure communication behavior across integrations and identity providers.

These fixes align user interface behavior with documented expectations and API behavior. They improve visibility, ordering, task reporting accuracy, and permission handling to create a more predictable and consistent administrative experience.

These updates enhance observability and troubleshooting. They improve log accuracy and persistence, align UI and API metrics, remove unused telemetry, and provide better diagnostic data to support operational monitoring and issue resolution.

This category includes fixes that improve installation, configuration validation, and deployment workflows. The changes clarify documentation, prevent common misconfigurations, and ensure operator- and platform-based installations behave as expected.

These improvements reduce startup time and operational overhead. They streamline scheduler initialization and capability loading to help instances become fully operational more quickly after restart or configuration changes.

As of 3.91.0, the base nexus3 image will be built off of alpine instead of ubi. This should be an invisible change for anyone using our image from dockerhub. If you are building an image off of our image, you will need to update your build process. Effective with 3.94.0, we will no longer publish new versions of the nexus3 image with the -ubi and -alpine suffix.

Sonatype Nexus Repository will soon block private networks by default. Customers are encouraged to review their configurations for any internal IP addresses or private network ranges and update them as needed to prevent service disruptions.

Note that this is a change to the default behavior only; you will still be able to configure this setting to allow private network access if your deployment requires it.

This update is designed to improve security by preventing unauthorized or unintended access from Nexus Repository to internal services. It helps protect production environments where repository administrators should not be able to connect to arbitrary internal endpoints.

Note that this was previously planned to become the default behavior in the 3.90.0 release; however, we have delayed its implementation to a future release.