Sonatype Nexus Repository 3.95.0 – 3.95.4 Release Notes

NEXUS-54915

The Retain N versions cleanup policy now uses correctly normalized component versions when ranking pre-release components, preventing newer versions from being selected for deletion while older versions are retained.

NEXUS-54717

Sonatype Nexus Repository now updates the lastDownloaded timestamp for Docker manifest HEAD requests, preventing actively used images from being incorrectly targeted by cleanup policies.

NEXUS-54576

NuGet hosted repositories with Disable Redeploy now correctly allow new packages to be published even when those packages share common third-party PDB files with previously uploaded packages. Regular packages containing embedded PDBs are no longer misfiled as symbol packages.

NEXUS-54572

NuGet symbol assets (.snupkg and .pdb) now store the required id, version, and is_prerelease attributes, preventing HTTP 500 errors and NullPointerExceptions during search and package registration.

NEXUS-54550

Docker proxy repositories backed by Amazon ECR now accept pre-generated ECR authorization tokens (obtained via aws ecr get-login-password) as HTTP Basic authentication credentials without triggering AWS credential validation errors.

NEXUS-54440

Nexus Repository now falls back to the cached PyPI JSON index when the HTML index does not contain a requested package file.

NEXUS-54371

Nexus Repository now re-queries the upstream source for NuGet V2 FindPackagesById requests, ensuring newly published or restored package versions appear while preserving warm-cache behavior for other operations such as Search.

NEXUS-54336

Nexus Repository now limits manifest scanning during Docker proxy tag requests, preventing download delays in repositories with large numbers of SHA-256 manifests.

NEXUS-54250

Fixed malware risk banner display behavior in the Nexus One user interface.

NEXUS-54143

Nexus Repository now completes blob store group member removal without repeatedly reprocessing blobs with missing .bytes files and logs remaining skipped blobs for follow-up.

NEXUS-54092

Terraform module downloads from hosted repositories now succeed for all valid archive formats (.tgz, .tbz2, and .txz), including modules with standard semantic version numbers such as 4.1.1.

NEXUS-54089

Cosign signing and attestation against Docker hosted repositories with large numbers of manifests now complete in seconds, thanks to a database path index and a scan cap that prevents exhaustive manifest searches during metadata propagation.

NEXUS-54023

Users with the nx-usertoken-current privilege can now access their user tokens in the Sonatype Nexus Repository Nexus One UI as expected.

NEXUS-53975

Terraform proxy repositories now support a "Use pre-emptive authentication" option, enabling credentials to be sent on the first request to an upstream Nexus instance rather than waiting for a challenge header that never arrives.

NEXUS-53923

During upgrades, the asset blob reference migration check runs as a lightweight background task after startup rather than as a blocking scan on the main startup thread.

NEXUS-53898

The copy button in the classic UI Browse › Repositories URL column now opens the copy dialog correctly, allowing repository URLs to be copied to the clipboard.

NEXUS-53883

Components moved via staging operations retain their normalized version data, allowing Docker cleanup retain-n policies to evaluate and remove eligible components correctly.

NEXUS-53874

Dart/Pub hosted repositories now accept package names beginning with an underscore (for example, _my_private_package), aligning with the official pub.dev specification.

NEXUS-53833

Browsing the /simple/<package>/ index on PyPI hosted repositories no longer writes blob files to the blob store on each request, eliminating spurious updated-uploaded audit events and uncontrolled disk growth between Compact Blob Store task runs.

NEXUS-53830

Docker layer uploads to Azure blob store repositories now use Azure server-side copy for single-chunk transfers, eliminating the redundant download-and-re-upload cycle that previously caused large layers to take roughly twice as long to push.

NEXUS-53828

Transient GCS 503 backend errors encountered during blob attribute writes in doDelete() are now retried with exponential backoff, allowing Docker uploads and similar operations to complete successfully instead of failing immediately.

NEXUS-53826

Terraform, Ansible Galaxy, and Swift hosted repositories no longer cache "not found" responses, so post-upload verification requests correctly return the uploaded asset instead of a stale 404.

NEXUS-53816

Concurrent repository deletions now complete successfully without leaving repositories in an unrecoverable STOPPED state that previously required a full restart to resolve.

NEXUS-53778

Requests carrying a structurally invalid Authorization: Basic header—such as an unexpanded ${NPM_TOKEN} placeholder in an npm .npmrc or CI config—now receive an HTTP 400 Bad Request response instead of 401.

NEXUS-53755

The top-level search More Criteria menu now includes Name and Version fields at the generic level, allowing users to filter search results by version across all package formats without navigating into format-specific sections like Composer Repositories.

NEXUS-53733

PyPI proxy repositories now send the correct upstream ETag in outbound If-None-Match headers, allowing PyPI to return 304 Not Modified responses instead of forcing full re-downloads, and no longer write a new blob to the blob store on every simple index request.

NEXUS-53719

Permission checks for users authenticated through external realms (SAML, LDAP, Crowd, OAuth2) now resolve role-to-permission mappings a single time per login rather than once per privilege checked, eliminating the ~20-second UI load delay experienced by users with large role sets.

NEXUS-53697

NuGet hosted repositories now return 206 Partial Content with correct Content-Range headers when clients request byte ranges, eliminating full-package downloads for partial-content requests against local blob stores.

NEXUS-53670

R proxy repositories now correctly handle CDN-prefixed content-addressable archive names from r-universe and R-multiverse, and the R-multiverse pollinator resolves package details dynamically from the live index rather than relying on hardcoded versions.

NEXUS-53606

Improved JAX-RS client error logging to reduce noise in server logs.

NEXUS-53599

Blob store metrics—including BLOB COUNT and USED SIZE—are preserved correctly when a blob store is promoted to a group, eliminating the need to manually run the Recalculate Blob Store Storage task.

NEXUS-53586

The Source dropdown selection in Settings > Security > Users is now preserved after deleting a user, keeping the filtered list on the selected realm instead of reverting to Local.

NEXUS-53571

Requests carrying a malformed Base64 Authorization header now receive a 401 Unauthorized response instead of an HTTP 500 error.

NEXUS-53496

Ansible Galaxy hosted repositories now return HTTP 409 Conflict (instead of 400) with a Galaxy-compatible duplicate-version error body when a duplicate collection version is published to a write-once (ALLOW_ONCE) repository; clients that explicitly expected HTTP 400 for this case should be updated.

NEXUS-53492

PyPI group repositories now serve a single authoritative index entry per filename, giving hosted members precedence over proxy members so pip 26's hash verification receives consistent checksums and installs patched components successfully.

NEXUS-53476

Existing cached .whl.metadata assets are automatically migrated to application/octet-stream on upgrade, and PyPI proxy repositories now serve .whl.metadata files with the correct content type to prevent WAF rejections and checksum mismatches.

NEXUS-53468

Terraform proxy repositories now correctly resolve components from providers with long alphanumeric namespaces without misidentifying the namespace as an authentication token.

NEXUS-53463

PyPI group repositories automatically invalidate their cached index when Sonatype Repository Firewall (PCCS) filtering is toggled for any member proxy, ensuring all available package versions are served immediately.

NEXUS-53458

The Settings → Repositories page loads in normal time during post-upgrade blob-size copy task execution because task completion checks now cache negative results for 30 seconds.

NEXUS-53457

The "Secrets - Migrate secrets" upgrade task now completes successfully for repositories that reference non-existent cleanup policies, automatically removing stale policy names during upgrade.

NEXUS-53394

Transient GCS 503 backend errors during Compact Blob Store operations are now retried with exponential backoff, and compaction tasks that fail to hard-delete blobs correctly report as failed.

NEXUS-53383

Pub package uploads now consistently identify the root pubspec.yaml as the authoritative metadata source regardless of archive entry order.

NEXUS-53373

Telemetry script fetches in air-gapped environments now time out within a configurable window (default 5 seconds) instead of blocking the UI for up to 80 seconds, with stale cached content served as a fallback.

NEXUS-53343

Repository search indexes remain queryable throughout the "Repair - Rebuild repository search" task, with orphaned records cleaned up only after re-indexing completes.

NEXUS-53338

Pull replication now bypasses the proxy staleness check for modified assets, ensuring updated content is fetched immediately from the source.

NEXUS-53317

Stale repodata entries in the browse tree of YUM group and proxy repositories are automatically removed when merged metadata is regenerated.

NEXUS-53306

The Preview UI Firewall column now accurately displays each proxy repository’s protection state and violation counts, matching the configured Quarantine, Audit, or Unprotected status.

NEXUS-53300

NuGet v3 hosted repository query results are now correctly returned for users whose Content Selector privilege includes a path condition on PostgreSQL deployments.

NEXUS-53265

Mixed unparenthesized AND and OR expressions in content selectors now use the correct operator precedence, preventing HTTP 500 responses during NuGet tag association.

NEXUS-53263

Components remain visible in search results for users with Repository Content Selector privileges after tag association, allowing repeated tag associations to succeed without requiring broader repository privileges.

Repositories where components were updated via incremental indexing (for example, tag association) while running an earlier Nexus Repository version may require a search index rebuild after upgrade to 3.95.0 in order to restore visibility for users who rely only on Repository Content Selector privileges.

NEXUS-52995

When PCCS age-based policy filtering quarantines npm package versions, diagnostic logging now captures the catalog date and policy condition details for each affected version.

NEXUS-52942

Pagination Link headers for Docker group repositories accessed via repository URL path now correctly reference the group repository path rather than the internal member proxy path.

NEXUS-52934

Assets in group repositories remain accessible throughout a Change Repository Blob Store migration because source blobs are retained until database references are fully updated.

NEXUS-52826

Group repositories now display an aggregated Firewall Report status based on their proxy members, and the Firewall Report column header is correctly marked as non-sortable.

NEXUS-52283

The Hugging Face proxy now implements the /tree/{revision} endpoint, enabling snapshot_download() and hf download to work with huggingface_hub 1.22.0+ even for repositories with more than 1,000 files.

NEXUS-52176

IQ Server connection failures now return actionable error messages instead of the previous generic compatibility message.

NEXUS-51938

All nodes in an HA cluster now immediately evict their shared HTTP connection pool when proxy or other HTTP client settings change.

NEXUS-51661

Trailing wildcard searches with fewer than three characters before the wildcard now return HTTP 400 with a clear error message instead of silently returning empty results.

NEXUS-51526

The Repair - Data Repair Plan task now removes orphaned database records for assets whose .bytes file is missing when "Keep db records" is unchecked.

NEXUS-51524

The Repair - Execute Data Repair Plan task now displays the complete plan count by retrieving aggregated statistics from a new server-side summary endpoint.

NEXUS-51451

Conan proxy repository search now returns cached results successfully when the remote is manually blocked instead of returning a 500 error.

NEXUS-51368

Raw repository searches by filename now return correct results when the filename contains a period character.

NEXUS-50783

Removing a member from a Maven group repository now completes quickly, with orphaned asset cleanup running in the background.

NEXUS-37620

The Repair - Rebuild Maven repository metadata task now regenerates missing checksum files for maven-metadata.xml when checksum rebuilding is enabled.

NEXUS-33892

Group repository caches are automatically invalidated when routing rules are assigned, removed, or modified on any member proxy repository.

NEXUS-29245

npm dist-tag add and npm dist-tag rm commands now work against group repositories by delegating tag operations to the configured writable member repository.

NEXUS-29099

Task log file handles are now released immediately upon task completion, preventing accumulation of open file descriptors.

NEXUS-28581

When thread cooperation limits are exceeded during high-concurrency NuGet proxy requests, logs now emit a detailed warning message identifying the limit and the configuration property to adjust.

FIRE-601

Sonatype Repository Firewall enforcement remains active on all High Availability cluster nodes after a Zero Downtime Upgrade, with repository configuration automatically refreshed following the deferred database migration.

FIRE-519

The Automatic Malware Management task now completes successfully against IQ Server versions earlier than 204 by gating the quarantineEnabled field on the connected IQ Server version before sending ad-hoc evaluation requests.