Sonatype Nexus Repository 3.97.0 Release Notes

Download Available Shortly

We have published these release notes ahead of the release for informational purposes. The 3.97.0 download will be available shortly!

What’s New and Noteworthy in This Release?

Introducing Nexus Repository Pro+

Sonatype Nexus Repository now offers Pro+, a new edition that builds on Nexus Repository Pro by adding malware protection and policy controls to help organizations govern the open-source components entering their development environments.

Pro+ evaluates components requested by developers, build systems, and AI agents against Sonatype’s open source intelligence and your organization’s policies. It identifies and blocks malicious components, including emerging threats, before they enter your environment. Teams can also apply customized security, legal, architectural, and age-based policies at component intake, helping prevent unwanted components from reaching builds and reducing the need to address risks later in the development lifecycle.

For details about Nexus Repository editions, Pro+ capabilities, and configuration, see Nexus Repository Tiers and Feature Availability.

Improved Search and Component Details in the Nexus One UI

Sonatype Nexus Repository now provides a more efficient search and component investigation experience in the Nexus One UI. Search results include accurate result counts, sorting by Last Updated, Name, or Repository, and URL-based search criteria that make searches easy to bookmark and share. Component details also provide clearer repository and component information, consistent timestamps, accurate file and repository counts, and Repository Health Check intelligence such as popularity, age, and license data. Together, these improvements make it faster to find components, understand their context, and share reproducible search results with other users.

Required Base Telemetry with Improved Administrator Guidance

Sonatype Nexus Repository now includes required base telemetry to provide consistent usage reporting. Administrators receive clear guidance for completing the required acknowledgement and verifying connectivity to the Sonatype telemetry service, along with a grace period before any repository restrictions apply.

A new Baseline Telemetry health check provides visibility into acknowledgement status, while actionable upload error messages help identify configuration, licensing, or connectivity problems. For full details, see the Nexus Repository Telemetry help documentation.

Improved Chained Proxy Reliability Across Repository Formats

Sonatype Nexus Repository now provides more reliable chained proxy support for Ansible Galaxy, Hugging Face, Terraform, and Conda repositories. These improvements help organizations that route dependency traffic through multiple Nexus Repository instances, such as tiered, restricted, or air-gapped environments, keep package and model requests flowing through the expected repository path without exposing inaccessible upstream locations or interrupting authentication.

Ansible Galaxy proxy repositories now rewrite upstream artifact URLs for downstream clients, Hugging Face repositories preserve working pagination across proxy chains, and Terraform repositories provide the authentication challenge required for downstream Nexus Repository instances to complete credential negotiation. Conda proxy repositories also support preemptive authentication, allowing credentials to be sent with the initial upstream request and reducing unnecessary authentication round trips on cache misses. Together, these changes improve dependency availability and reduce failures caused by routing, pagination, and authentication differences between repository formats.

Conda Pre-emptive Authentication

Conda proxy repositories now persist and apply the httpClient.authentication.preemptive setting. If you configured this value through the REST API in an earlier release, review the repository configuration after upgrading and confirm that the setting reflects the authentication behavior you want.

Service Account Tokens Across All Repository Formats

Sonatype Nexus Repository now supports service account tokens across all supported repository formats, making it easier to use dedicated machine identities for CI/CD pipelines, build systems, and other automated workflows. Clients can authenticate with the same sat.* credential using either HTTP Basic or Bearer authentication, depending on the authentication method supported by the repository format and its native tooling.

This expanded support helps organizations reduce their reliance on human user credentials in automation and simplifies credential management across diverse development ecosystems. A service account can be assigned an appropriate role and used consistently across repository formats, giving teams a centralized way to manage, rotate, and revoke access for automated systems. For Basic authentication, use the service account name as the username and the service account token as the password; clients that support Bearer authentication can continue sending the token in the Authorization header.

For full details, see Service Account Tokens help documentation.

Improved Remote Storage URL Validation for OCI Proxy Repositories

Sonatype Nexus Repository now validates Remote Storage URL values for OCI proxy repositories consistently with other proxy repository formats. When creating or updating an OCI proxy repository through the UI or REST API, the remote storage URL must begin with http:// or https://.

Nexus Repository also preserves the submitted URL in the stored repository configuration, providing consistent URL validation and configuration behavior across proxy repository formats.

Automatic Repository Health Check for Proxy Repositories

Sonatype Nexus Repository Health Check now operates automatically across proxy repositories, providing repository health insights without requiring administrators to use the Configure for all proxy repositories option.

This simplifies Repository Health Check configuration by automatically applying coverage across proxy repositories

Repository Firewall Support for Swift Proxy Repositories

Sonatype Repository Firewall now supports Swift proxy repositories in Sonatype Nexus Repository, extending policy evaluation and quarantine protection to Swift dependencies. When developers request Swift packages through a protected proxy repository, Repository Firewall evaluates the package against configured Proxy-stage policies and can block packages that introduce unacceptable open source risk before they enter development workflows.

Swift proxy repositories also integrate with Repository Health Check and Firewall reporting, giving teams visibility into policy violations and repository risk alongside other supported package ecosystems. This helps organizations apply more consistent software supply chain controls to Swift development while continuing to manage dependencies through Nexus Repository.

Bug Fixes

Issue ID	Description
NEXUS-49753	Content selector privileges that use `path`-based expressions now evaluate correctly during search, tag association, and staging operations, restoring expected access control behavior for users whose RBAC model relies solely on content selectors without requiring broad `nx-repository-view` permissions.
NEXUS-49653	Authenticated users who navigate to the `/saml` endpoint are now redirected to the application home page instead of receiving a blank white page.
NEXUS-49642	H2 to PostgreSQL (and PostgreSQL to H2) database migrations complete successfully using the DB migrator tool.
NEXUS-49493	Content-Security-Policy sandbox headers are now correctly applied to user-uploaded HTML, SVG, and other script-capable content served from repositories.
NEXUS-49379	Cargo crate dependency manifests now correctly reflect `default_features` as `true` when the field is not explicitly set in the package manifest, ensuring accurate metadata in hosted repository indexes.
NEXUS-49200	Repository creation with blob stores that have special characters or spaces in their names completes successfully when using the blob store API alongside the UI.
NEXUS-49171	APT repository metadata updates correctly in both source and target repositories after staging move operations, ensuring packages remain available for installation.
NEXUS-49154	PostgreSQL HA deployments now start more reliably in high-traffic environments, reducing slow startup times and database connection exhaustion when nodes restart.
NEXUS-49140	Google Cloud Storage blob store operations handle high-traffic conditions more reliably, with automatic retries and exponential backoff reducing the occurrence of rate limit errors during periods of heavy concurrent activity.
NEXUS-49120	The end-of-life `commons-lang` 2.x dependency has been removed from the software bill of materials and replaced with its modern successor, reducing overall dependency risk.
NEXUS-49091	Cleanup policies now correctly delete assets when running against H2 databases, preventing unexpected disk space accumulation.
NEXUS-49043	The Security Users page loads successfully even when instances have large numbers of user-role mappings configured.
NEXUS-49032	Support zip generation completes successfully and includes SAML configuration data when SAML authentication is configured.
NEXUS-49031	Corrupt blob properties files across all blob store types (File, S3, Azure, and Google Cloud) are now automatically detected and removed during the "Verify and Repair Data Consistency" tasks, allowing affected components to be recovered rather than returning errors indefinitely.
NEXUS-48901	PyPI components with large keyword sets are indexed and searchable correctly in PostgreSQL-backed high-availability deployments.
NEXUS-48894	Docker Firewall evaluation for proxy repositories works correctly without requiring the Base URL capability to be configured, as the Base URL is now automatically derived from the incoming request.
NEXUS-48889	Exact-match keyword searches using double quotes now return only precise component name matches in HA (PostgreSQL) deployments, rather than partial matches.
NEXUS-48777	Docker login succeeds reliably when users have access to one or more Docker repositories in an instance, regardless of how many other Docker repositories exist or their configuration order.
NEXUS-48729	Deleting an npm metadata asset from the Browse page now correctly preserves the associated package files, with the directory structure remaining intact after refreshing the page.
NEXUS-48583	RPM package downloads with caret (`^`) characters in the filename complete successfully when proxying Fedora and other YUM repositories.
NEXUS-48561	Proprietary Components namespace synchronization now correctly excludes orphaned components, preventing legitimate OSS downloads from being falsely quarantined by Firewall policies.
NEXUS-48542	The React-based login experience is now enabled by default, with verified support for local authentication, SAML and OAuth2 SSO, anonymous access configurations, session timeout handling, deep-link redirects after authentication, and WCAG 2.1 AA accessibility compliance across all supported browsers.
NEXUS-48540	Unauthenticated users are now redirected to a dedicated login page instead of being prompted via a modal dialog when anonymous access is disabled, with the original destination preserved so users continue seamlessly after signing in.
NEXUS-48505	The Components REST API (`/service/rest/v1/components`) now returns the correct `blobStoreName` value in asset results instead of null.
NEXUS-48463	Routing rules are now correctly enforced for Hugging Face proxy repositories, allowing administrators to block or permit access to specific models as expected.
NEXUS-48410	The Used Size column in the blob store UI metrics now accurately reflects the amount of storage in use, replacing the previous Total Size label that caused confusion with overall blob store capacity.
NEXUS-48330	npm proxy repositories with Policy-Compliant Component Selection (PCCS) enabled now correctly cache and reuse upstream ETags, preventing redundant policy evaluations on repeated metadata requests.
NEXUS-48259	PyPI proxy repositories with Firewall Quarantine and PCCS enabled now return consistent package metadata regardless of whether the request URL includes a trailing slash.
NEXUS-48160	Helm chart task logging now preserves individual per-task-type log files while also generating the combined `allTasks.log` file when `logStorage.combineTaskLogs` is enabled, rather than replacing the default task logs entirely.
NEXUS-48143	Blob store log output during concurrent component requests is now recorded at DEBUG level, eliminating false ERROR and WARN messages that appeared when multiple clients simultaneously accessed the same artifact.
NEXUS-48087	Repository deletion completes successfully even when group repositories cannot be immediately updated to remove the reference, with any cleanup failures logged as warnings rather than blocking the operation.
NEXUS-48000	Hosted APT repository `Packages` files now generate `Filename` fields as relative paths, ensuring compatibility with tools such as `deb-mirror` and Uyuni that require spec-compliant Debian repository metadata.
NEXUS-47926	Repository - Export assets" task completes successfully even when individual blobs are missing or inaccessible in an S3 blobstore, skipping unavailable assets and logging warnings rather than failing the entire export.
NEXUS-47905	Maven archetype catalog (`archetype-catalog.xml`) automatically reflects all deployed snapshot versions without requiring manual deletion of the file.
NEXUS-47826	Rolling upgrades complete successfully even when database index creation on large Maven browse node tables requires extended processing time.
NEXUS-47603	Scoped npm package names now appear in full (including the scope prefix) when searching hosted npm repositories.
NEXUS-47551	Scoped npm package requests through proxy repositories now correctly encode the slash in package names (e.g., `@scope%2Fpackage`) when communicating with remote registries, ensuring successful resolution on strict registries that require encoded URLs.
NEXUS-47545	S3 blob store creation failures now log error-level messages, including exception details, making it easier to diagnose configuration issues such as invalid access keys without requiring changes to log settings.
NEXUS-47148	Composer proxy repositories successfully retrieve package metadata files (such as `p2/` provider JSON files) from http://packagist.org without returning a 500 server error.
NEXUS-47018	Repository searches now return results for users and anonymous accounts with either `browse` or `read` repository permissions, ensuring consistent search access across supported permission configurations.
NEXUS-46707	The Licensing screen now displays context-aware restart messages, indicating a restart is required only when installing a license for the first time or when the new license enables additional features.
NEXUS-46449	Audit log entries are now recorded whenever a tag is associated or disassociated from a component via the REST API, providing a complete history of tagging activity.
NEXUS-45796	Tag association after RPM component uploads now completes successfully, with the API waiting for search indexing to finish before applying the tag rather than returning a 404 error.
NEXUS-45438	APT hosted repository package indexes now include a correctly formatted relative `Filename` path (without a leading slash), ensuring compatibility with apt clients such as aptly when mirroring or proxying hosted APT repositories.
NEXUS-44162	The Blob Stores page now displays "Calculating..." instead of zeros while blob store metrics tasks are still running after a database migration, preventing confusion about whether data was migrated successfully.
NEXUS-43689	LDAP server connections created via the Swagger UI API page complete successfully when optional fields are included in the request payload.
NEXUS-42345	Proxy repositories now preserve encoded special characters in request URLs when forwarding requests to remote repositories, preventing download failures for packages with special characters in their filenames or paths.
NEXUS-42101	Maven group repository `maven-metadata.xml` now reflects accurate version lists when components are deleted from member hosted repositories, eliminating stale metadata that previously caused client build failures.
NEXUS-40172	The `nodeHeartbeatExport.json` file included in support zips is significantly smaller.
NEXUS-36481	Docker group repository search commands complete successfully even when a member proxy repository returns an invalid response, with the invalid proxy results excluded from search output and logged as warnings.
NEXUS-36020	REST API validation for repository write policies now correctly rejects invalid case values, preventing invalid configurations that could cause startup failures.
NEXUS-27439	Docker repository-level anonymous access configuration now correctly controls unauthenticated pull access, overriding global anonymous access settings.
NEXUS-27044	LDAP diagnostic logging now captures complete stack traces, exception details, and full query parameters, making it easier to troubleshoot and diagnose LDAP connectivity and authentication issues.
NEXUS-25658	The Invalidate Cache button on proxy repositories is now enabled for users granted edit permission on that specific repository, without requiring a global edit permission across all repositories.
NEXUS-25475	The `writePolicy` field in the REST API now accepts values in any letter case (e.g., `allow_once`, `ALLOW_ONCE`) and correctly normalizes them, preventing deployment failures when hosted repositories are configured as writable members of group repositories.
NEXUS-21637	Support ZIP generation completes successfully and includes all selected files even when duplicate configuration filenames (such as `nexus-store.properties` or `hazelcast-network.xml`) exist across different directories in the installation.