Sonatype Nexus Repository 3.91.0 - 3.91.1 Release Notes

NEXUS-51537

PyPI group repositories now cache merged package index pages across requests instead of regenerating them each time.

NEXUS-51222

Quarantine logs for npm and PyPI repositories now display the specific policy violation that caused versions to be filtered when Policy Compliant Component Selection retrieves results from Firewall.

NEXUS-50764

npm group repositories now maintain accurate package metadata when Policy-Compliant Component Selection filters versions, preventing empty version lists during concurrent version-specific and full metadata requests.

NEXUS-50623

npm group repositories return valid JSON metadata without duplicate _id fields when serving package information.

NEXUS-50574

npm audit requests for projects without dependencies now complete successfully instead of generating error logs.

NEXUS-50437

Debug logging now captures the specific IQ policy names, IDs, and threat levels that caused PCCS to filter component versions from npm metadata responses.

NEXUS-50428

The "Repair – Rebuild npm metadata" task preserves original package version publish timestamps instead of overwriting them with the rebuild execution time.

NEXUS-40915

PyPI group repositories now display all package files from member repositories, including variants that differ only in letter casing, with consistent alphabetical ordering regardless of member repository sequence.

NEXUS-39228

Group repositories for npm and PyPI now invalidate cached metadata when member proxy repositories apply policy-based version filtering, which may impact systems relying on the previous stale cache behavior.

NEXUS-49457

APT proxy repositories now serve cached packages even after their removal from upstream by merging locally cached content into repository metadata.

NEXUS-29440

PyPI proxy repositories support an empty Remote Index Path setting to connect with registries like GemFury and NVIDIA PyPI that serve packages directly from their root URL instead of the standard /simple endpoint.

NEXUS-51199

Deleting a Docker manifest now removes all associated tags automatically, maintaining repository integrity for security scanning.

NEXUS-51155

Docker garbage collection now correctly processes all manifests regardless of the continuation browse limit setting, preventing data loss when the limit exceeds 1000.

NEXUS-50861

Docker repositories now accept image names containing consecutive underscores, aligning with OCI Distribution Specification standards.

NEXUS-50808

Docker tag list requests now return a maximum of 10,000 tags (100 pages) per image to prevent system failures, completing in 2-3 minutes instead of timing out or crashing when upstream registries contain extremely large numbers of tags (20,000+).

NEXUS-50532

Docker group repositories now return a 504 Gateway Timeout error when firewall cooperative wait timeouts occur, instead of continuing to query other members and returning 404 Not Found.

NEXUS-50499

Path-based Docker repositories now evaluate anonymous pull permissions individually, allowing anonymous pulls to succeed on repositories with "Allow Anonymous Docker Pulls" enabled regardless of the settings configured on other path-based Docker repositories.

NEXUS-50471

Docker container startup scripts now prevent duplicate JVM memory parameters from appearing in the command line when custom memory settings are specified via INSTALL4J_ADD_VM_PARAMS, eliminating confusion about which values are active.

NEXUS-50384

Docker repositories now recognize and process zstd-compressed layers without triggering unnecessary validation, eliminating performance delays during push, pull, and copy operations for modern OCI images.

NEXUS-45172

When attempting to redeploy an asset with the "Allow Redeploy" setting disabled, error messages now explicitly state that redeployment is not permitted for the repository, replacing the previous generic "blob upload invalid" message across all repository formats.

NEXUS-39080

Docker proxy repositories now return HTTP 404 (Not Found) instead of HTTP 400 (Bad Request) when remote content fails digest validation, correctly indicating that the requested content is unavailable rather than suggesting the client's request was malformed.

NEXUS-51407

Maven proxy repositories with strict content type validation now accept macOS Mach-O executable files (such as protoc binaries) with .exe extensions.

NEXUS-51152

Swift and Terraform proxy repositories now require HTTP proxy configuration through the Nexus UI (Administration → System → HTTP) instead of JVM system properties in nexus.vmoptions. Git operations for Swift and Terraform proxy repositories automatically route through the HTTP proxy configured in Nexus Repository Manager, eliminating the need for manual JVM property configuration and application restarts.

NEXUS-51145

Terraform proxy repositories now automatically repackage module archives downloaded from Git hosting providers, removing the wrapper directory structure to enable successful installation of submodules.

NEXUS-50616

Hugging Face proxy repositories correctly handle filenames containing spaces and special characters by properly encoding URI segments in requests to upstream repositories.

NEXUS-48863

Terraform CLI can now discover and download modules through standard Terraform Registry API endpoints, including service discovery, version listing, and download redirect functionality.

NEXUS-48742

Conan repositories accept metadata files from the Conan 2.0 client, including SBOM files stored in the package metadata folder.

NEXUS-44583

Maven SNAPSHOT artifacts uploaded directly through the GUI without timestamped versions now display their assets correctly when selected from search results, instead of returning a 404 error.

NEXUS-43667

Maven repository cleanup policies based on last downloaded time now correctly evaluate imported components after checksum files inherit download timestamps from their parent assets.

NEXUS-43238

Deleting a folder from the Browse view of a Go repository now removes all associated components and browse nodes completely, not just the assets.

NEXUS-42338

Yum repositories correctly identify the architecture of signed RPM packages by reading header tags instead of the lead header type field.

NEXUS-37132

Conan proxy repositories now return valid JSON responses ({}) when searching for non-existent packages, allowing the Conan client to continue searching through additional configured repositories.

NEXUS-51311

Toggling IQ Server capability state completes without causing system deadlocks or UI timeouts.

NEXUS-51301

Disabling IQ Server integration in Nexus Repository Cloud instances completes immediately without blocking or causing node unresponsiveness.

NEXUS-51191

The "Admin - Remove a member from a blob store group" task processes blobs safely when multiple instances run concurrently, eliminating thread-safety errors in progress logging.

NEXUS-50430

Concurrent asset requests across High Availability nodes retrieve blobs successfully through automatic retry logic with exponential backoff.

NEXUS-50504

Container image scanning processes large Go binaries (500MB+) through a streaming parser that maintains constant memory usage, preventing heap exhaustion during Firewall evaluation of Docker images.

NEXUS-50167

Added support for configuring pod-level securityContext in the Sonatype Nexus Repository HA helm chart StatefulSet, enabling fsGroup and fsGroupChangePolicy to reduce volume permission overhead and improve pod startup times on large storage deployments.

NEXUS-48954

Session timeout settings configured in the UI now apply correctly in High Availability deployments, ensuring users remain logged in for the specified duration.

NEXUS-46360

The Helm chart for External Secrets Operator configurations accepts an optional property field to extract specific keys from HashiCorp Vault KV v2 secrets stored in JSON format.

NEXUS-51248

The secrets migration upgrade task successfully processes proxy repositories that contain trailing whitespace in their remote URL configuration.

NEXUS-51210

Blob store migration tasks for Maven group repositories preserve metadata availability throughout the operation, preventing intermittent access failures during active client requests.

NEXUS-50905

S3 blob stores on different endpoints now validate buckets against their own configured endpoint, preventing initialization failures when multiple S3 configurations exist on the same instance.

NEXUS-47471

Database migration completes successfully when Maven components contain null attribute values, allowing the process to continue rather than fail with an error.

NEXUS-44136

Database migrations between H2 and PostgreSQL now preserve blob store metrics, ensuring accurate counts and sizes appear immediately after migration without requiring manual recalculation tasks.

NEXUS-42298

Blob store group member removal operations now complete successfully when temporary files are deleted by concurrent cleanup tasks.

NEXUS-39077

Reconcile tasks now preserve the original blob creation timestamp when restoring raw repository assets from imported data.

NEXUS-37039

The "Cleanup unused asset blobs" task now automatically removes orphaned database records when their associated blob store has been deleted, eliminating previous warning messages and preventing database bloat.

NEXUS-51030

Creating proxy repositories via the REST API no longer requires the blocked field, which now defaults to false when omitted.

NEXUS-50761

Repository browsing works correctly for users who have both administrative privileges and content selector privileges assigned to their roles.

NEXUS-50552

The Browse menu appears for users who have Content Selector privileges with browse permissions, matching the visibility behavior of standard repository-view privileges.

NEXUS-50163

The user interface handles rapid navigation during page loading without encountering null reference errors.

NEXUS-46560

The Usage Center maintains functionality when sessions expire, preventing null reference errors during data processing.

NEXUS-41419

Role editing operations automatically remove references to obsolete privileges rather than returning an error.

NEXUS-51164

Warning messages about invalid maven-metadata.xml files now include the repository name for easier troubleshooting.

NEXUS-50510

DEBUG logs now capture blocked outbound requests when SSRF protection prevents access to private or local network addresses, including the blocked host and specific reason for the block.

NEXUS-50322

Staging delete operations now log detailed error information including query parameters when unexpected exceptions occur, making troubleshooting failures straightforward without requiring TRACE-level logging.

NEXUS-44075

FluentBit log processing in Kubernetes deployments no longer generates tag prefix errors when parsing Nexus application logs.

NEXUS-45518

Tag creation, updates, and deletions are now recorded in the audit.log file with details about the tag name, attributes, and the user who performed the action.

NEXUS-44603

Scheduler health check alerts for auto-recovered task triggers now include instructions directing administrators to review and update task schedules in the Administration console.

NEXUS-50878

Task creation and update now prevent property-based overrides of the internal typeId field, ensuring the nexus.scripts.allowCreation security control cannot be bypassed through crafted task properties. This fix strengthens our resolution of CVE-2020-11753.

NEXUS-50529

Session logout operations complete successfully for OIDC-authenticated users whose sessions have expired, returning the expected response instead of an internal server error.

NEXUS-50324

Logging out of Nexus Repository SaaS now fully terminates authentication sessions, requiring users to re-enter credentials instead of only MFA codes when signing back in.

NEXUS-50196

SAML authentication now removes external role mappings from user accounts when their corresponding groups are removed from the identity provider, ensuring privileges stay synchronized with current group membership.

NEXUS-39798

Database connection failures during authentication now return HTTP 503 Service Unavailable instead of HTTP 401 Unauthorized, clearly indicating infrastructure issues rather than incorrect credentials.

NEXUS-20520

REST API endpoints now return HTTP 401 (Unauthorized) when accessed without credentials, and HTTP 403 (Forbidden) when accessed by authenticated users lacking required permissions.

NEXUS-50813

Tag association operations now complete search index updates before returning success, enabling immediate component promotion in staging workflows.

NEXUS-50690

npm search queries return results successfully when using PostgreSQL databases.

NEXUS-50251

Search indexing successfully processes components with tens of thousands of associated paths by limiting parameter counts to stay within PostgreSQL boundaries.

NEXUS-50246

Wildcard version searches now match only packages where the version starts with the specified pattern, preventing incorrect matches on versions that contain the pattern elsewhere.

NEXUS-50628

Schedule modifications to the "Admin - Cleanup expired user tokens" task persist across Nexus Repository restarts.

NEXUS-50585

The Quartz Job Key Unification upgrade task now skips tasks with deprecated or removed type IDs instead of failing with a NullPointerException, allowing the upgrade process to complete successfully.

NEXUS-47043

The Execute Reconcile Plan task now caps its thread pool at 50% of available CPU cores by default to prevent resource saturation on systems with limited processors.

NEXUS-49003

The "Repair - Rebuild repository browse" task displays overall progress across all repositories with repository name and completion count, starting at 0% and finishing at 100%.