Sonatype Nexus Repository 3.97.0 – 3.97.3 Release Notes

NEXUS-55606

Docker image pushes now complete successfully for users whose repository access relies exclusively on Content Selector permissions.

NEXUS-55243

Blob uploads of 2 GB or larger to hosted OCI repositories now complete successfully without errors.

NEXUS-55899

The Download and Copy URL actions on the Browse page now include the configured context path when generating asset links in Sonatype Nexus Repository.

NEXUS-55897

Startup on PostgreSQL databases with non-English server locales completes successfully when upgrading to 3.97.x

NEXUS-55699

Proxy repository cache tokens now synchronize correctly across all nodes in an HA cluster, ensuring that components with a maximum age of -1 are served from cache without triggering repeated upstream requests after cache invalidation.

NEXUS-55356

PyPI proxy repositories handle high volumes of concurrent simple index requests reliably without triggering out-of-memory errors.

NEXUS-54725

Concurrent Docker proxy pulls of cached tag manifests complete reliably without exhausting request threads or database connections, even for repositories with large numbers of signature artifacts or multi-platform images.

NEXUS-55727

Policy Compliant Component Selection (PCCS) now correctly updates npm and PyPI proxy chains and groups to unhide cleared component versions and prevent stale cached filtering results.

NEXUS-54553

npm packument metadata now refreshes correctly after policy changes, waivers, or removals in Sonatype Lifecycle, preventing stale component version filtering.

NEXUS-55658

HEAD requests to npm group repositories return successful responses instead of HTTP 500 errors when member proxy repositories are included.

NEXUS-55428

PyPI proxy repositories with Preserve Encoded Characters enabled now correctly install packages when proxying through another Nexus instance, resolving 404 errors that occurred for packages whose index pages were fetched without a required trailing slash.

NEXUS-55223

PyPI proxy repositories now return the correct format (HTML or JSON) to each pip client when concurrent requests for the same Simple index page arrive with different Accept headers.

NEXUS-55200

OCI proxy repository blob pulls now complete successfully when the remote registry redirects to a signed storage URL (such as Azure Blob Storage SAS URLs) containing consecutive slashes in the path, preserving the exact redirect path bytes so that upstream signature validation succeeds.

NEXUS-55030

Authentication rate limiting now correctly releases blocked accounts after the advertised Retry-After interval elapses, and successful logins clear the lockout state so automated clients and users can recover without administrator intervention.

NEXUS-55004

Cleanup policies now remove eligible components from RubyGems repositories on PostgreSQL as expected, rather than silently reporting zero assets cleaned up.

NEXUS-54977

NuGet V3 group repositories now return complete version lists, including packages published with release qualifiers alongside their base versions.

NEXUS-54915

"Retain last N versions" cleanup policies now correctly preserve the newest component versions across npm, PyPI, Helm, NuGet, RubyGems, Go, Yum, Terraform, Swift, Apt, and Pub repositories when repositories contain components published before and after a version-normalization format change introduced in 3.94.

NEXUS-54913

Ansible Galaxy proxy repositories correctly forward collection version and pagination requests upstream, allowing ansible-galaxy clients to resolve and install collections without receiving HTTP 404 errors.

NEXUS-54855

User token lookup via GET /service/rest/v1/security/user-tokens/tokens now accepts nameCode as the official query parameter, with the previously undocumented lowercase namecode retained as a backward-compatible alias.

NEXUS-54839

Conda hosted repositories now automatically generate an empty noarch/repodata.json metadata file upon creation, allowing Conda clients to browse and install packages without requiring a noarch package to be uploaded first.

NEXUS-54837

HuggingFace XET presigned URL sweep task logging runs quietly in the background by default, eliminating repetitive log entries that appeared every 60 seconds and caused unnecessary noise in customer logs.

NEXUS-54829

Audit log entries for assets removed by cleanup tasks now include the full asset path, type, and blob store location, providing the complete details needed for selective content recovery.

NEXUS-54817

Go hosted repositories now correctly resolve module versions containing uppercase prerelease characters (such as v1.1.2-PRE-RELEASE) when requested by a standard Go client via GOPROXY.

NEXUS-54771

OCI proxy repositories now enforce the same http:// or https:// remote URL requirement as all other proxy formats, ensuring consistent validation behavior across both the UI and REST API.

NEXUS-54764

Anonymous Docker pulls continue to work correctly after running the Admin – Delete orphaned API keys task, with no authentication failures, rate-limit blocking, or service restart required.

NEXUS-54760

Ansible Galaxy proxy repositories now return Content-Type: application/json for v3 collection metadata endpoints, ensuring compatibility with strict REST clients, API gateways, and content-type-aware tooling.

NEXUS-54753

OCI repository creation and updates complete successfully when subdomain routing is configured on instances that also host legacy Docker repositories.

NEXUS-54715

HEAD requests to npm group repositories return correct responses when the requested package is not yet cached locally.

NEXUS-54691

User tokens remain valid after upgrading from an OrientDB-based installation that was migrated to H2 or PostgreSQL.

NEXUS-54638

XML processing in WebFlux endpoints now correctly enforces configured memory limits when parsing asynchronous XML payloads.

NEXUS-54604

Data Repair Plan tasks against S3 blob stores now scan blob attributes concurrently, eliminating the serial bottleneck that caused reconciliation workers to sit idle and made large-scale repair plans impractical to complete.

NEXUS-54602

Sensitive session tokens in Set-Cookie response headers (including Keycloak identity cookies) are now masked at write time in all log files, rolled archives, Support ZIPs, and cloud JSON logs, with an option to extend masking to additional custom cookie names via the nexus.log.mask.cookies system property.

NEXUS-54601

Large Docker and OCI layer commits to S3-backed blob stores complete successfully during concurrent or high-volume pushes.

NEXUS-54596

Cargo group repository config.json requests are served efficiently without creating or storing unnecessary assets on each request.

NEXUS-54579

The Cleanup Policy Preview repository dropdown now consistently displays all repositories matching the selected format across all supported formats — including npm, PyPI, Go, Helm, NuGet, Yum, RubyGems, Terraform, Swift, Apt, and Pub.

NEXUS-54576

NuGet package publishing to hosted repositories with Disable Redeploy now completes successfully when multiple packages share common embedded PDB files, and packages containing PDBs alongside DLLs are correctly stored as standard NuGet packages rather than symbol packages.

NEXUS-54572

NuGet symbol assets (.snupkg and .pdb files) are now stored with the required package attributes, enabling reliable search and preventing HTTP 500 errors during symbol package operations.

NEXUS-54571

Ansible Galaxy collection downloads through chained proxy repositories now complete successfully, with metadata URLs rewritten to reflect the downstream proxy’s address rather than exposing upstream host information that clients cannot reach.

NEXUS-54570

npm proxy repositories in HA clusters now return consistent responses across all nodes when a previously unavailable package becomes accessible, eliminating the stale 404 responses that persisted on individual nodes until cache expiration.

NEXUS-54568

The Keep database records when blob is missing checkbox on the Verify and Repair Data Consistency task now renders as checked by default for tasks migrated from earlier versions, preventing unintended deletion of database records when saving unrelated task settings.

NEXUS-54563

The Repair - Execute Data Repair Plan task now successfully removes orphaned database records for assets whose blob files are missing, preventing recurring MissingBlobException errors when those assets are subsequently requested.

NEXUS-54558

PyPI proxy repositories configured with an empty indexPath via the REST API will now correctly route upstream requests without appending /simple/ to the URL.

NEXUS-54552

npm package metadata browse nodes remain visible and deletable after all associated tarball assets are removed from a proxy repository.

NEXUS-54550

Docker proxy repositories backed by Amazon ECR accept pre-generated ECR Docker tokens (obtained via aws ecr get-login-password) as valid HTTP Basic authentication credentials when saving repository configuration.

NEXUS-54526

npm proxy repositories now successfully download packages from registries that redirect to Azure Blob Storage, with authentication credentials correctly scoped to each host during cross-domain redirects.

NEXUS-54469

Docker proxy repository responses now return a stable Last-Modified header for cached manifests, ensuring tools like Dependabot correctly recognize unchanged images instead of treating every request as newly modified content.

NEXUS-54468

npm packument responses of any size are now gzip-compressed when clients request it, eliminating the previous 10 MiB ceiling above which compression was silently skipped.

NEXUS-54465

Email server configuration via the REST API now correctly enforces application/json as the required content type, and PUT requests to /v1/email are accepted and validated as expected.

NEXUS-54434

Browser refresh and direct deep links to permission-gated pages now load the intended page reliably, without redirecting to the Welcome page, even for users with large role sets.

NEXUS-54322

User account changes — deletions, deactivations, and role updates — now take effect across all nodes in an HA cluster within seconds, rather than remaining stale on remote nodes for up to two minutes.

NEXUS-54233

Browse tree updates for newly uploaded Raw components now reflect across all repositories promptly, even when instances contain tens of millions of components under high concurrent upload activity.

NEXUS-54229

In clustered PostgreSQL deployments, Sonatype Nexus Repository now propagates repository configuration changes across nodes immediately by default, so consecutive create-and-use requests routed to different nodes no longer fail while waiting for the polling interval.

NEXUS-54208

OIDC logout now terminates the user’s session at the identity provider (such as Keycloak), ensuring that subsequent SSO login attempts require re-authentication as expected.

NEXUS-54132

Docker proxy repositories without configured credentials now log anonymous bearer token exchange failures at the debug level instead of generating misleading warning-level log entries.

NEXUS-54127

Deleting a shared layer blob or a manifest-list child manifest in Docker and OCI hosted repositories now returns HTTP 409 when the asset is still referenced by one or more live manifests, preventing the deletion from proceeding until all referencing manifests are removed first.

NEXUS-53780

Maven group repository metadata merges correctly when Gradle clients issue HEAD requests, ensuring all member repository versions are included in subsequent GET responses.

NEXUS-53722

The classic UI Administration → Repositories list loads significantly faster on instances with large numbers of repositories, as size metrics are now retrieved in a single bulk query instead of one query per repository.

NEXUS-49734

A new REST API at /service/rest/v1/security/oauth2/users enables administrators to create, read, update, and delete locally cached OAuth2 user records directly in the database without forwarding any changes to the remote identity provider.

NEXUS-46386

The HA Helm chart now sets securityContext on all containers, enabling successful pod deployment in Kubernetes environments that enforce the PodSecurity restricted profile, such as vSphere with Tanzu and OpenShift.

NEXUS-44892

PyPI proxy repositories now support a configurable suffix field in the REST API, allowing users to specify custom index sub-paths (such as /api/pypi/simple) when proxying non-standard PyPI-compatible registries like Artifactory or GitLab.

FIRE-774

npm proxy package metadata for frequently requested packages is now served from pre-rendered cached responses, reducing latency on repeated lookups by eliminating redundant parsing of upstream package data on every request.

FIRE-762

Cleanup policy removal of cached Docker images now triggers deletion of the corresponding container evaluation reports in Repository Firewall, preventing orphaned report accumulation on the IQ Server.