Sonatype Nexus Repository 3.98.0 Release Notes

Released November 3, 2026

What’s New and Noteworthy in This Release?

Nexus One UI Now the Default Experience

Sonatype Nexus Repository now uses the Nexus One UI as the default experience for all users. Previously available as an optional interface, Nexus One provides a more modern and streamlined way to navigate Nexus Repository, search and browse content, and manage repositories and administrative workflows. The updated design also aligns Nexus Repository more closely with other Sonatype products, helping teams move between solutions with a more consistent experience.

Nexus One is designed to reduce navigation friction and make frequently used information and actions easier to find. Improvements include clearer repository information, streamlined navigation, and system health status directly in the global header so administrators can identify conditions that need attention more quickly. Together, these changes make everyday repository management easier while providing a consistent foundation for continued improvements to search, browse, administration, and other workflows.

Users who prefer the previous experience can switch back to the Classic UI from UI Settings or by selecting Switch to Classic UI.

Extended Telemetry Grace Period for Community Edition

Sonatype Nexus Repository Community Edition now provides a 30-day grace period for required telemetry reporting failures, increased from 10 days. This extension gives Community Edition administrators more time to restore telemetry reporting before Nexus Repository switches to read-only mode, helping minimize disruptions to repository operations.

Repository Firewall: Improved Component Identification and Container Scanning Accuracy

Sonatype Repository Firewall now provides more accurate component identification for Python and Java packages, improving CVE reporting for Python packages that contain Red Hat backported security fixes. We have also expanded package detection for Go and APK packages and improved scanning accuracy for Red Hat hardened and OpenShift container images.

These improvements provide more complete visibility into components across supported environments, helping you assess security risks more confidently and prioritize remediation efforts based on more accurate vulnerability information.

Bug Fixes

Issue ID	Description
NEXUS-55963	JWT library dependencies are kept current, ensuring the distributed application contains only well-maintained transitive components.
NEXUS-55862	Audit event persistence and the Audit page are now disabled by default, preventing unbounded growth of the `audit_events` table on busy instances; operators can enable both by setting `nexus.previewui.audit.enabled=true`.
NEXUS-55730	NuGet V2 proxy repositories no longer generate redundant audit events or unnecessary database writes when re-fetching package metadata that has not changed upstream.
NEXUS-55655	Sift appender log discriminators now stay within required length limits, ensuring task, replication, and blob store reconciliation log entries are written to their correct destinations without warnings appearing in the application log.
NEXUS-55592	NuGet package downloads now consistently return the correct archive, even when Symbol Server processing is enabled.
NEXUS-55520	Cargo group repositories now preserve the `pubtime` field in sparse-index entries, ensuring that Cargo's `registry.global-min-publish-age` setting correctly excludes recently published crate versions when resolving dependencies through a group repository, consistent with the behavior of a member proxy repository.
NEXUS-55482	Audit event database storage is now controlled more efficiently, with the default retention period reduced from 90 to 30 days and asset download, attribute-change, and proxy metadata refresh events excluded from the `audit_events` table. These events remain available in `audit.log`.
NEXUS-55364	Hosted Conda repositories with the “Disable redeploy” policy now accept subsequent package uploads and automatically refresh repository metadata files without errors.
NEXUS-55294	Repositories configured with Disable Redeploy now correctly reject duplicate NuGet package uploads with HTTP 400. NuGet hosted repositories also correctly reject re-uploads of standard `.nupkg` packages containing embedded `.pdb` files.
NEXUS-55284	Repository online/offline status displays consistently across all pages when viewing repository details.
NEXUS-55283	Ephemeral log storage starts up reliably when `fsGroup` is configured in the pod security context for HA Helm chart deployments.
NEXUS-55232	NuGet V2 OData feed responses now correctly represent unversioned dependencies without an explicit version range, preventing Chocolatey clients from unnecessarily re-downloading and re-executing install scripts for already-satisfied transitive dependencies.
NEXUS-55186	The Data Repair Plan task log now includes detailed information for each planned action, showing the blob ID, repository name, file path, reason for the finding, and the specific action that will be taken when the plan is executed.
NEXUS-55134	Alpine proxy repository creation in the New UI now works correctly, with the signing key and passphrase fields available for all three Alpine repository types (hosted, proxy, and group), and saved passphrases preserved when editing existing repositories.
NEXUS-55128	Advanced cron scheduling in the Tasks UI now returns a clear validation message when an unsupported cron expression is submitted, without exposing internal error details or Java exception information.
NEXUS-55077	Direct PUT uploads to a Conda hosted repository now return a clear error when the request URL includes a channel prefix (such as `.../main/noarch/package.conda`), preventing a situation where a successful upload response did not match the actual stored package location.
NEXUS-55064	Maven component deletion from hosted repositories performs consistently regardless of the number of components sharing a groupId.
NEXUS-55062	The npm asset Attributes tab now displays the complete set of package metadata fields, including `description`, `author`, `license`, and `keywords`, in both the Classic UI and Nexus One UI, restoring the visibility that was present prior to version 3.93.0.
NEXUS-55035	The repository online/offline toggle button in the Preview UI now displays “Take Offline” and “Bring Online” labels that clearly communicate the action being performed.
NEXUS-55020	“Allow Anonymous Docker Pulls” settings on Docker proxy repositories using path-based routing are now enforced correctly, requiring authentication when anonymous pulls are disabled.
NEXUS-54976	Metrics endpoints (`GET /service/rest/v1/monthly-metrics`, `GET /service/rest/v1/daily-metrics/egress`, and `GET /service/rest/v1/daily-metrics/storage`) now return results for service accounts granted the `nx-metrics-all` privilege, without requiring full administrator permissions.
NEXUS-54962	Automatic Malware Management findings for flagged components remain active across repeated task runs, with accurate component details preserved and no false retraction records created in the Malware Components report.
NEXUS-54867	High-availability distributed cache indexes are created reliably on first startup, preventing cache write failures and ensuring HA cluster functionality after initial deployment.
NEXUS-54763	Authenticated sessions on ARM64 deployments remain active for their full configured timeout duration, even under high concurrent request load.
NEXUS-54739	Conan and Terraform repository metadata rebuilds correctly after a Data Repair task restores blobs, allowing clients to successfully download components without encountering 404 errors.
NEXUS-54540	Search results through group repositories now return components correctly when users have read access to the group but not explicitly to its member repositories.
NEXUS-54368	In high-availability clusters, scheduled tasks running on one node remain unaffected when another node restarts, preventing tasks like Rebuild Yum Repository Metadata from being incorrectly marked as interrupted.
NEXUS-46259	Tag-based staging promotions complete successfully even when the destination repository already contains components associated with the same tag.
FIRE-1227	The Enable Quarantine on All Proxies button is no longer displayed on the Malware Risk page, removing a control that previously appeared functional but had no effect.
FIRE-879	Container scans of RedHat UBI images now correctly identify Python packages using their platform-specific variants, eliminating false positive reports that previously required manual investigation to distinguish from genuine security findings.