# Nexus Repository Cloud Bug Fixes

This page contains a list of bug fixes included in our 2026 Sonatype Nexus Repository Cloud releases.

New features and enhancements are covered in the [2026 Sonatype Nexus Repository Cloud Release Notes](https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html "Nexus Repository Cloud Release Notes").

## July 22, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-54025** – Basic Auth credential verification no longer performs per-request password hash provider lookups, eliminating lock contention that reduced throughput for username/password authenticated clients.

- **NEXUS-53975** – Terraform proxy repositories can now send credentials with the initial request when pre-emptive authentication is enabled, allowing chained proxy configurations to authenticate successfully.

- **NEXUS-53923** – Updated an upgrade step to schedule blob reference migration tasks unconditionally as lightweight background operations, eliminating the blocking full-table scan that previously ran on the startup thread and caused upgrades to stall for hours on large instances.

- **NEXUS-53874** – Dart/Pub hosted repositories now accept package names beginning with an underscore, aligning with the official pub.dev specification.

- **NEXUS-53861** – Read-only users browsing repositories in the Preview UI no longer see an enabled Delete button for assets, components, or folders they lack permission to remove.

- **NEXUS-53830** – Docker layer uploads to Azure blob store repositories now use server-side copy for single-chunk transfers, reducing the time required to push large layers.

- **NEXUS-53826** – Terraform, Ansible Galaxy, and Swift hosted repositories no longer cache "not found" responses, so post-upload verification requests return the correct status instead of a stale 404.

- **NEXUS-53662** – The `PUT /service/rest/v1/security/users/{userId}` endpoint now accepts user update requests that omit `firstName`, `lastName`, or `emailAddress`, matching the documented API contract.

- **NEXUS-53486** – The Default Role Realm is now retained during node shutdown, preserving access to User Tokens and other realm-dependent features after AWS ASG instance refreshes or ECS task changes.

- **NEXUS-53458** – The _Settings_ → _Repositories_ page loads at normal speed during post-upgrade blob-size copy task execution, as the task completion check now caches negative results for 30 seconds instead of querying the database once per repository on every page render.

- **NEXUS-51524** – The _Repair - Execute Data Repair Plan_ task UI now displays the complete plan count across all available plans, regardless of total volume, by retrieving aggregated statistics from a new server-side summary endpoint instead of a single paginated page capped at 100 entries.

- **NEXUS-37620** – The _Repair - Rebuild Maven repository metadata_ task now regenerates missing Maven metadata checksum files even when the underlying metadata content has not changed.

## July 15, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-53833** – PyPI hosted repository simple index requests no longer create blob store files or updated-uploaded audit log entries during read operations.

- **NEXUS-53755** – The top-level search More Criteria menu now includes Name and Version fields, making version-based filtering available across all package formats.

- **NEXUS-53739** – JVM heap usage alerts are now logged at WARN level during normal G1GC major collections, reducing unnecessary ERROR-level log entries.

- **NEXUS-53719** – Permission checks for users authenticated through external realms now cache role-to-permission mappings per request, improving UI performance for users with large role sets.

- **NEXUS-53697** – NuGet hosted repositories now return correct partial content responses for byte-range requests, enabling clients to download only the requested portion of a package.

- **NEXUS-52826** – Group repositories now display aggregated Firewall Report protection status based on their proxy members, and the Firewall Report column is correctly identified as non-sortable.

- **NEXUS-53476** – Existing cached `.whl.metadata` assets are automatically migrated to use the `application/octet-stream` content type during upgrade; remove any reverse proxy rules or workarounds that were previously used to override this header to prevent conflicts.

## July 8, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-53733** \- PyPI proxy repositories now send the correct upstream `If-None-Match` header to preserve `304 Not Modified` responses and prevent unnecessary downloads and blob creation for cached simple index pages.

- **NEXUS-53682** \- Source RPMs in hosted Yum repositories now generate `primary.xml` metadata with the correct `arch="src"` value, ensuring `yum` and `dnf` clients resolve source and binary packages correctly.

- **NEXUS-53599** \- Blob store metrics are now preserved when promoting a blob store to a group, eliminating the need to run the Recalculate _Blob Store Storage_ task.

- **NEXUS-53586** \- The selected Source filter in _Security_ \> _Users_ is now preserved after deleting a non-local user.

- **NEXUS-53496** \- Duplicate Ansible collection publish attempts now return `HTTP 409` Conflict with a Galaxy-compatible error response instead of `HTTP 400`.

- **NEXUS-53492** \- PyPI group repositories now return a single authoritative index entry per filename, allowing hosted packages to take precedence and enabling successful PEP 658 hash verification.

- **NEXUS-53454** \- High Availability deployments now prevent duplicate `repository.search.update` tasks from being scheduled across multiple nodes.

- **NEXUS-53372** \- Yum group repositories now serve cached metadata without triggering unnecessary rebuilds when hosted members contain stale cache attributes.

- **NEXUS-53263** \- Components associated with tags now remain searchable for users with Repository Content Selector permissions after rebuilding repository search indexes.

- **NEXUS-52942** \- Docker group repository tag pagination now preserves the requested group repository path in the `Link` response header.

- **NEXUS-52176** \- IQ Server connection verification failures now report actionable error messages in `nexus.log` instead of the misleading compatibility error.

- **NEXUS-51662** \- Multi-term searches on PostgreSQL now respect term order when `nexus.search.multi.wildcard.regex.enabled=true`.

- **NEXUS-51451** \- Conan proxy repositories now return cached search results when the remote repository is manually blocked instead of returning an `HTTP 500` error.

- **NEXUS-51368** \- Raw repository filename searches now return correct results for filenames containing period (.) characters.

- **NEXUS-50783** \- Removing a member from a Maven group repository now completes immediately while orphaned asset cleanup runs in the background.

- **NEXUS-29099** \- Task log file handles are now released immediately after task completion to prevent open file counts from increasing over time.

## July 1, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-53496** -Ansible Galaxy hosted repositories with redeployment disabled now return the Galaxy-compatible HTTP 409 response and `conflict.collection_exists` error body when duplicate collection versions are published.

- **NEXUS-53383** \- Pub repository uploads now correctly identify the root `pubspec.yaml` in package archives containing multiple `pubspec.yaml` files, ensuring accurate validation and metadata generation.

- **NEXUS-53373** \- Air-gapped telemetry script requests now complete within a configurable timeout and serve cached content when the remote telemetry service is unavailable.

- **NEXUS-53343** \- Rebuild - Repository Search tasks now keep existing search index records available throughout the rebuild and remove orphaned entries only after repopulation completes.

- **NEXUS-53300** \- NuGet v3 hosted repository queries now return expected results when PostgreSQL-backed Repository Content Selector privileges use path-based expressions.

- **NEXUS-53265** \- NuGet tag association by non-admin users with Repository Content Selector privileges now succeeds when content selectors use mixed and/or expressions with explicit operator precedence.

- **NEXUS-53263** \- Components governed by Repository Content Selector privileges remain searchable after tag association, and repeated tag operations no longer return HTTP 404 responses.

- **NEXUS-52995** \- Policy-Compliant Component Selection diagnostic logs for npm proxy repositories now include the catalog date and policy constraint details for quarantined component versions.

- **NEXUS-52942** \- Docker group repository pagination Link headers now reference the original group repository path instead of the resolved member proxy path.

- **NEXUS-37907** \- Task completion emails now display correct durations for scheduled tasks that run longer than 24 hours.

- **NEXUS-29245** \- `npm dist-tag add` and `npm dist-tag rm` commands now work with group repositories by delegating tag operations to the configured writable member repository.

- **NEXUS-29099** \- Task log file handles are now released immediately after task completion, preventing the accumulation of open file descriptors.

## June 26, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-53281** – Firewall quarantine requests now remain compatible with IQ Server versions earlier than 204 by omitting the `quarantineEnabled` field when unsupported, preventing HTTP 400 errors. (Also included in self-hosted 3.93.1)

- **NEXUS-53184** – NuGet V2 `FindPackagesById()` now returns only exact package ID matches, preventing unrelated packages from appearing in search results. (Also included in self-hosted 3.93.1)

- **NEXUS-53007** – NuGet API key rate limiting is now scoped to individual token hashes, preventing invalid tokens from affecting other users.

- **NEXUS-52855** – Rebuild Maven repository metadata tasks now complete successfully when the specified `groupId` or `artifactId` is not present in a repository.

- **NEXUS-52827** – Search results now sort correctly by repository name across all repository formats.

- **NEXUS-52799** – Maven proxy repositories with strict content type validation now correctly download and cache macOS universal binary `.exe` artifacts.

- **NEXUS-51877** – Rebuild repository search tasks now skip empty component batches, preventing malformed SQL statements from being logged by PostgreSQL.

- **NEXUS-51643** – Helm chart push rejections now return JSON-formatted HTTP 409 responses, allowing `helm cm-push` to display rejection details correctly.

- **NEXUS-51449** – The Repository Health Check column is now hidden as expected when an IQ Server Firewall license is configured.

- **NEXUS-53468** \- Sonatype Nexus Repository now correctly routes Terraform proxy repository requests for providers with long namespace names without interpreting the namespace as an authentication token.

- **NEXUS-53396** – Conda proxy repositories configured with channel-specific upstream URLs now send the correct package path to Sonatype IQ Server, allowing malicious packages to be identified and quarantined as expected.

- **NEXUS-53394** \- Google Cloud Storage 503 errors during blob store compaction are retried with backoff, and compaction runs that cannot delete soft-deleted blobs now appear as failed in the UI.

- **NEXUS-53338** \- Pull replication now fetches modified assets from the source immediately without applying the proxy staleness check or configured maximum metadata age.

- **NEXUS-53310** \- Ansible Galaxy proxy repository metadata now returns component download URLs using the correct scheme, hostname, and port from each inbound request.

- **NEXUS-53297** \- PyPI package indexes at all group levels now automatically show newly uploaded or cached package versions without requiring manual cache invalidation.

- **NEXUS-53266** \- Sensitive HTTP authentication headers, including `Authorization: Bearer`, `Authorization: Basic`, `X-Auth-Token`, and `X-API-Key`, are now redacted from log files before support ZIP bundles are generated.

- **NEXUS-53242** \- Hugging Face proxy repositories now download complete non-LFS blob files by converting `HEAD` requests to `GET` requests when following redirects to blob storage.

- **NEXUS-53199** \- After login, the UI becomes interactive while permissions load asynchronously, removing the blocking _Loading Permissions_ window for users with large role sets.

- **NEXUS-52769** \- RAW proxy repositories with `preserveEncodedCharacters=true` now forward signed redirect URLs containing consecutive slashes byte-for-byte so upstream storage signatures validate correctly.

- **NEXUS-51938** \- All nodes in an HA cluster now flush their shared HTTP connection pool when proxy or HTTP client settings change.

- **NEXUS-51661** \- Trailing wildcard searches with fewer than three characters before the wildcard now return an HTTP 400 response with a clear error message, and the minimum prefix length can be configured with `nexus.search.wildcard.minPrefixLength`.

- **NEXUS-51522** \- Docker repositories with mixed-case names created before version 3.90 can now be updated through the REST API, except for newly enabling path-based routing.

- **NEXUS-50701** \- SSRF validation now uses the configured global HTTP proxy when direct DNS resolution fails, allowing proxy repository creation and artifact retrieval in locked-down network environments.

- **NEXUS-25793** \- PyPI proxy repositories now return valid empty package index pages with HTTP 200 responses for upstream packages that have no downloadable files.

- **NEXUS-53463** – PyPI group repositories automatically invalidate cached indexes when Repository Firewall policy filtering (PCCS) is enabled or disabled on a member proxy repository.

- **NEXUS-52050** \- Clicking the Sonatype logo now navigates correctly to the appropriate landing page.

- **NEXUS-28581** – Log messages generated when the proxy thread cooperation limit is exceeded now include the current limit, cooperating thread count, and the `nexus.proxy.cooperation.threadsPerKey` property.

- **NEXUS-53317** – YUM group and proxy repositories now automatically remove stale browse tree entries when merged repository metadata is replaced.

- **NEXUS-51526** – The _Repair - Data Repair Plan_ task now removes orphaned asset database records when the corresponding `.bytes` file is missing and Keep db records is disabled

## June 10, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-53214** – Ansible Galaxy hosted repositories configured with Disable RIQ edeploy now allow publishing new collection versions while continuing to block redeployment of existing versions. (Also included in self-hosted 3.93.1)

- **NEXUS-53183** – Collection installations from Ansible Galaxy hosted repositories now correctly resolve dependencies and complete successfully. (Also included in self-hosted 3.93.1)

- **NEXUS-53062** – Chained PyPI proxy repositories now successfully retrieve packages from upstream Nexus Repository instances that redirect artifact requests to S3 presigned URLs by removing the Authorization header before following cross-host redirects. (Also included in self-hosted 3.93.1).

- **NEXUS-52961** – Support zip exports now include an `oauth2UserExport.json` file containing OAuth2 user account data from the `oauth2_user` table. (Self-hosted deployments only)

- **NEXUS-52846** – Logout requests for instances configured with Okta OIDC now include the required id\_token\_hint parameter and complete successfully.

- **NEXUS-52813** – PyPI hosted repositories now immediately reflect newly uploaded package versions in the per-package simple index for packages with non-normalized names, eliminating the need for a manual metadata rebuild.

- **NEXUS-52580** – Terraform hosted repository Data Repair Plan recovery now restores the `versions.json` asset with the correct `MODULE_VERSIONS` kind, allowing subsequent module uploads to succeed.

- **NEXUS-52551** – Chained PyPI proxy repositories now generate correct outbound package download URLs for .whl files without duplicating repository path segments (Also included in self-hosted 3.93.1)

## June 3, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-52921** – Swift proxy repositories now normalize Git tags by removing leading v and V prefixes, allowing SwiftPM dependency resolution to succeed for packages that use version tags such as `v5.3.0`.

- **NEXUS-52856** – Keyword-only searches now display the group repository name when access is granted through a group repository instead of showing the underlying member repository.

- **NEXUS-52812** – Outbound TLS connections now complete successfully in FIPS mode on Java 21 by enforcing compatible TLS and keystore settings.

- **NEXUS-52759** – Groovy script execution now works correctly on Java 25 following the upgrade to Groovy 5.0.6. Groovy scripts that rely on indirect imports may require updates due to stricter `SecureASTCustomizer` sandbox enforcement.

- **NEXUS-52625** – YUM and RPM components with large asset counts are now partially indexed when PostgreSQL search limits are exceeded, allowing matching content to remain searchable.

- **NEXUS-52620** – Blob store creation and updates through the User Interface now complete successfully when Nexus Repository is accessed over HTTPS with inbound SSL enabled.

- **NEXUS-52583** – Permission loading for users with large numbers of roles now completes significantly faster, reducing login delays in the UI. (Fixed for self-hosted in 3.93.0)

- **NEXUS-52571** – LDAP and SAML users can now be saved successfully after all local roles are removed.

- **NEXUS-52414** – Wildcard component searches that include path separators now return expected results in PostgreSQL-backed deployments.

- **NEXUS-52027** – Policy-Compliant Component Selection now selects the highest stable release when an npm package's latest dist-tag references a quarantined version and only falls back to a pre-release version when no stable release is available.

- **NEXUS-52006** – `lastDownloaded` timestamp updates now use a database-backed operation that prevents orphaned temporary property files from accumulating on NFS and CIFS blob stores.

- **NEXUS-51967** – PyPI proxy repositories now report their Policy-Compliant Component Selection status correctly to IQ Server when quarantined versions are removed.

- **NEXUS-51593** – Content selector privileges now display the correct repository and format values in the UI regardless of whether they were created through the UI or REST API.

- **NEXUS-51521** – Docker pushes to S3-backed hosted repositories now complete successfully without stream closure errors.

- **NEXUS-41851** – Logger override configurations stored in the database are now included in support zip exports for High Availability deployments.

- **NEXUS-27554**– The NuGet API Token section is now hidden from user profiles when the NuGet API-Key realm is disabled.

## May 27, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-52659** – Anonymous Docker pulls through group repositories now succeed when _Allow Anonymous Docker Pulls_ is enabled on the group, regardless of member repository settings.

- **NEXUS-52475** – Pre-signed URL generation and multipart uploads for S3 blob stores now consistently use the configured blob store credentials instead of environment credentials.

- **NEXUS-52320** – Terraform repositories hosted under non-root context paths now authenticate correctly with User Tokens during `terraform init`.

- **NEXUS-52117** – Uploading components and artifacts through the _Upload_ sidebar tab to hosted repositories now completes successfully without errors.

- **NEXUS-52107** – Startup failures caused by missing or stale HTTP client secrets now identify the affected repository and `httpclient.authentication.password` configuration in the error logs.

- **NEXUS-51920** – Terraform hosted repositories now support upload and download of modules that use SemVer pre-release versions containing hyphens.

- **NEXUS-51835** – Azure blob store initialization failures now log the root cause exception and full stack trace at the default ERROR level.

## May 26, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-52635** – Concurrent npm and PyPI proxy requests under PCCS now coalesce across cluster nodes, preventing uncoordinated IQ Server evaluation calls that could exhaust heap memory and cause a full Firewall outage. (This fix requires Nexus Repository 3.92.3+ and IQ 204+.)

- **NEXUS-52434** – PCCS evaluation results for npm and PyPI proxy repositories are now reused within the configured metadata cache window, improving performance for packages with large version counts

## May 21, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-52781** – Search indexing for NuGet V2 proxy repositories now completes successfully when cached components contain an empty package name derived from a blank `<d:ID>` OData feed element. (Fixed for self-hosted in 3.92.3)

- **NEXUS-52631** – UI Branding headers and footers now correctly apply CSS rules defined in `<style>` blocks, though configurations embedding `<style>` elements inside `<head>` tags must move them into the `<body>` to preserve existing layouts.

- **NEXUS-52384** – Swift proxy repositories now retrieve the correct version-specific manifest file when a `?swift-version` query parameter is provided and return a `303 See Other` redirect to `Package.swift` when no matching upstream manifest exists.

- **NEXUS-52353** – CocoaPods proxy repositories now perform full recursive git clones for pods declaring `"submodules": true`, ensuring archives include all required submodule content.

- **NEXUS-52266** – The Compact blob store task now rebuilds the deleted blob index for S3 blob stores when the `rebuildDeletedBlobIndex` flag is enabled and removes the flag from `metadata.properties` after completion.

- **NEXUS-51975** – Cleanup policy asset name regex patterns containing the `+` quantifier are now preserved correctly during preview and policy creation, returning accurate results without workaround patterns.

- **NEXUS-50997** – Routing rule updates and deletions now propagate immediately across all High Availability nodes, keeping repository routing behavior consistent throughout the cluster.

- **NEXUS-50972** – PyPI simple index pages now update correctly after cleanup policies remove packages, preventing stale links that return `404` errors.

- **NEXUS-50725** – During startup in High Availability environments, Nexus Repository no longer logs misleading timeout warnings when long-running tasks are active on other cluster nodes.

## May 13, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-52584** – npm group repositories now reflect newly published versions in the \`latest\` tag immediately, without waiting for the 24-hour metadata cache to expire.

- **NEXUS-52536** \- Docker GC tasks now evaluate all unreferenced blob assets across every page, ensuring unused layers beyond the first 100 are correctly identified and reclaimed during cleanup runs.

- **NEXUS-52434** – PCCS evaluation results for PyPI and npm proxy repositories are now cached and reused within the configured metadata maximum age window, so a single request to IQ Server serves all subsequent lookups until the cache expires. (Fixed for self-hosted deployments in 3.92.3)

- **NEXUS-52412** – Swift proxy repositories now successfully resolve and fetch packages through authenticated corporate HTTP proxies, replacing the previous JGit-based transport with Nexus's native HTTP client infrastructure.

- **NEXUS-51672** – Heap memory warnings now require sustained elevated usage across multiple consecutive samples before logging, preventing false alarms from normal sawtooth GC patterns on busy instances.

## May 8, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-52199** – Yum hosted repository metadata rebuilds now use direct key lookups when checking RPM registration status, preventing rebuild tasks from stalling on large repositories.

- **NEXUS-51931** – npm group repositories now return valid JSON with a single deduplicated `sonatype_filtered_versions` field when multiple proxy members contribute filtered version lists.

- **NEXUS-51700** – Optimized NuGet v2 `Search()` requests for group repositories by moving filtering, sorting, and pagination to the database layer, significantly improving performance under concurrent load.

- **NEXUS-50780** – PyPI proxy and hosted repositories now correctly resolve package links regardless of trailing slash usage in simple index URLs, including when Firewall quarantine filtering is enabled.

- **NEXUS-50731** – OAuth2/OIDC configuration is now available through a public REST API, enabling administrators to manage OAuth2 settings programmatically. (Self-hosted deployments only)

- **NEXUS-52382** – Large Azure Blob Storage downloads now use bounded, backpressure-aware streaming to prevent heap exhaustion and `OutOfMemoryError` conditions during concurrent or slow-consumer downloads.

- **NEXUS-52362** – Maven group repositories now honor the lowest `metadataMaxAge` value from proxy members so merged `maven-metadata.xml` content refreshes correctly from upstream sources.

- **NEXUS-52333** – Helm proxy repository parsing failures for `index.yaml` now include full exception details and filenames in the error log, improving troubleshooting without requiring DEBUG logging.

- **NEXUS-52224** – Startup logging no longer writes the full `nexus.properties` configuration map, preventing sensitive values such as database credentials and JDBC URLs from appearing in plaintext logs.

- **NEXUS-52218** – The Malware Components CSV now reconciles findings against current Sonatype threat intelligence so reclassified or cleared components no longer appear as unresolved malware findings.

- **NEXUS-52197** – Verbose PortEx PE binary parsing output is now suppressed to WARN level in `nexus.log` during Firewall Audit and Quarantine scans of Docker proxy layers containing Windows executables.

- **NEXUS-51884** – npm proxy repository metadata ETags now refresh correctly after quarantined components are released through firewall report waivers, preventing stale package metadata responses.

- **NEXUS-51647** – The `repository.blob.mismatch.task` upgrade task now runs concurrently with other upgrade tasks, allowing critical post-upgrade processing to complete sooner.

- **NEXUS-51450** – The Automatic Malware Management task log now reports accurate quarantine states for malicious components detected in Firewall-enabled repositories.

- **NEXUS-50778** – APT snapshots now include `i18n/Translation` metadata files so Debian and Ubuntu clients can run apt update successfully against snapshot repositories.

- **NEXUS-47909** – Maven group repositories now return the correct hash file content for `archetype-catalog.xml` requests instead of returning a 500 error.

- **NEXUS-39223** – RubyGems group repositories now merge duplicate gem entries across hosted and proxy members into a single `/versions` entry so Bundler can correctly resolve shared gems.

- **NEXUS-22160** – Yum hosted repositories now support modules.yaml, enabling offline mirroring for RHEL 8+ and CentOS 8+ modular repositories.

## April 29, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-51882** – PyPI hosted repositories now maintain consistent metadata during concurrent uploads by marking indexes as stale instead of deleting them, ensuring newly uploaded packages are accurately reflected.

- **NEXUS-51795** – User-configured SAML Entity ID URIs now take precedence over the browser URL when generating SP metadata and authentication requests.

- **NEXUS-51699** – The `BlobRepositoryMismatch` task now persists per-repository progress, resumes after restarts, logs progress periodically, and uses a CPU-scaled thread count instead of a fixed value.

- **NEXUS-51514** – The compact blob store task now continues processing when individual S3 deletions fail, logging failures at WARN level instead of stopping the task.

## April 22, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-52054** \- Terraform hosted repository signing key material and passphrase are now redacted in support zip configuration exports.

- **NEXUS-51930** \- Conditional GET requests against proxy repositories now undergo Firewall policy evaluation, returning 403 Forbidden when a component is quarantined rather than incorrectly signaling 304 Not Modified.

- **NEXUS-51633** \- PyPI repositories now automatically invalidate and rebuild stale indexes after Verify and Repair blob restore tasks complete, eliminating the need to manually trigger index regeneration via API calls.

## April 20, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-51864** \- Version-specific npm requests (such as `/lodash/latest`) no longer invalidate or corrupt the PCCS cache. Subsequent metadata requests now return the complete and correct set of package versions.

- **NEXUS-51814** \- Docker tag pagination responses now correctly preserve connector-based paths when accessed via dedicated connector hosts or ports, ensuring Link headers remain compliant with the Docker Registry HTTP API V2 specification.

- **NEXUS-51659** \- The Search API now returns an HTTP 400 response with a clear validation message when unsupported wildcard patterns (such as leading wildcards or short trailing wildcards) are used in the Repository Name field, replacing previous silent empty responses.

- **NEXUS-51540** \- Maven group repository metadata now stays up to date when new component versions are uploaded to hosted repositories nested within sub-groups, ensuring accurate version resolution across group hierarchies.

- **NEXUS-51537** \- PyPI group repository simple index pages are now served from cache on repeated access, eliminating unnecessary blob creation and improving performance.

- **NEXUS-51523** \- The Data Repair Plan task now report "created plan entries" instead of "created plans," accurately reflecting the number of individual repair items identified rather than the number of executable repair plans.

- **NEXUS-51509** \- Concurrent Policy Compliant Component Selection requests for the same PyPI or npm package are now deduplicated. Only a single evaluation request is sent to Firewall (IQ Server), with concurrent requests reusing the result.

- **NEXUS-51485** \- Docker clients now receive a standards-compliant error response when Repository Firewall blocks a quarantined image. The response includes quarantine details and a link to the Firewall report directly in the JSON payload.

- **NEXUS-51389** \- Repositories that fail to initialize during startup are now skipped and marked offline, allowing Nexus Repository to start successfully without being blocked by individual repository failures.

- **NEXUS-51334** \- Improved logging for npm group repository fallback behavior. Messages are now logged at DEBUG level with clearer wording and no longer reference PCCS policy when Firewall is not configured.

- **NEXUS-51319** \- npm proxy repositories now include valid ETag headers in conditional requests, allowing cached tarballs to return HTTP 304 responses and preventing unnecessary re-downloads and blob duplication.

- **NEXUS-51283** \- RubyGems hosted repositories now perform incremental metadata updates when a single gem is uploaded, rather than rebuilding metadata for the entire repository. This improves performance but may affect environments with customized upload workflows.

- **NEXUS-51282** \- Download URLs generated from UI search results now correctly reference the group repository path instead of underlying member repositories, allowing users with group-only permissions to access assets without encountering authorization errors.

- **NEXUS-51279** \- Search API requests using unsupported wildcard patterns now return HTTP 400 responses with descriptive validation messages, ensuring consistent behavior across all search fields.

- **NEXUS-51266** \- Improved PostgreSQL query performance for prefix-based component searches by enabling index scans on key search\_components columns, reducing reliance on sequential table scans.

- **NEXUS-51247** \- Concurrent requests for the same component no longer generate ERROR-level log entries when multiple threads update blob property files simultaneously

- **NEXUS-51112** \- Increased timeout for Policy Compliant Component Selection when evaluating large PyPI packages (such as tensorflow and duckdb), allowing installations to complete successfully.

- **NEXUS-50782** \- NuGet v2 proxy repositories now correctly follow OData pagination links for `FindPackagesById` queries, ensuring all package versions and dependencies are cached and installable in a single operation.

- **NEXUS-49855** \- Prefix-based component name searches in High Availability deployments now return only components whose names begin with the specified term, ensuring accurate and predictable results.

- **NEXUS-48607** \- The UI telemetry service now avoids repeated attempts to reach unavailable remote endpoints, eliminating long page load delays in air-gapped and network-restricted environments.

## April 8, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-51926** – Raw repository searches that use trailing wildcards in the group field return matching assets as expected.

- **NEXUS-51666** – Administrators can now set `blob.repository.name.mismatch.skipProcessing=true` to allow the blob repository mismatch upgrade task to complete immediately without scanning assets, eliminating weeks-long processing delays for instances upgrading from versions prior to 3.69.0.

- **NEXUS-51551** – The system confirmed protection against malicious axios package versions after npm removed the compromised packages from the registry.

- **NEXUS-51523** – Data Repair Plan task logs now report "identified repair items" and "processing entries" instead of the ambiguous "created plans" terminology, clarifying that counts represent individual blob records requiring attention rather than the number of executable repair plans.

- **NEXUS-51391** – Content selectors using "starts with" operators correctly filter paths with segments shorter than three characters.

- **NEXUS-51334** – Fallback logging in npm group repositories now operates at DEBUG level instead of INFO, reducing log volume and removing misleading references to PCCS policy differences.

- **NEXUS-51327** – Wildcard component name searches against paths with leading slashes now return correct results across all formats.

- **NEXUS-51283** – Single RubyGems file uploads now update only the necessary metadata indices instead of regenerating data for every gem in the repository, eliminating temporary blob storage spikes during upload operations.

- **NEXUS-51282** – Search results for group repositories now generate download URLs that reference the group repository instead of the underlying member repository, allowing users with group-only permissions to successfully download assets.

- **NEXUS-51268** – The Auditing help page no longer displays placeholder notice content that was inadvertently published to the live documentation.

- **NEXUS-51247** – Concurrent requests for the same component no longer generate ERROR-level log entries when multiple threads update blob metadata simultaneously.

- **NEXUS-50782** – NuGet v2 proxy repositories now retrieve all package versions by following OData pagination links when resolving PowerShell module dependencies with large version histories.

- **NEXUS-50223** – Zscaler API key validation now occurs in both the UI and backend API, preventing configuration errors from incorrectly formatted keys.

- **NEXUS-49545** – PyPI and npm package metadata now includes a `sonatype_filtered_versions` field when Policy Compliant Component Selection filters vulnerable versions, providing transparency into which package versions were blocked by Firewall policy evaluations across proxy repositories, group repositories, and proxy chains.

## April 1, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-51488** \- Terraform service discovery now requires repository-level endpoint access at `/repository/{repository-name}/.well-known/terraform.json` instead of root-level access. Terraform CLI can successfully discover hosted registry services through this endpoint, enabling module and provider resolution.

- **NEXUS-51407** \- Maven proxy repositories now accept macOS Mach-O executables (such as ARM64 protoc binaries) when strict content type validation is enabled.

- **NEXUS-51397** \- Blob repository mismatch tasks now process blobs concurrently across available threads, significantly improving completion time during post-upgrade validation.

- **NEXUS-51301** – Disabling IQ Server integration in Nexus Repository Cloud instances completes immediately without blocking or causing node unresponsiveness.

- **NEXUS-51267** \- Failed login attempts are now recorded in the `audit.log` file with detailed authentication failure information, including failure reasons.

- **NEXUS-51248**\- The secrets migration upgrade task now trims whitespace from proxy repository URLs, allowing successful migration of repositories created prior to version 3.89.0.

- **NEXUS-51152** \- Swift proxy repositories now route Git operations through the HTTP proxy configured in the Nexus UI, removing the need for manual JVM configuration and restarts.

- **NEXUS-50878** – Task creation and update now prevent property-based overrides of the internal `typeId` field, ensuring the `nexus.scripts.allowCreation` security control cannot be bypassed through crafted task properties. This fix strengthens our resolution of [CVE-2020-11753](https://support.sonatype.com/hc/en-us/articles/360046233714).

- **NEXUS-47471** – Database migration completes successfully when Maven components contain null attribute values, allowing the process to continue rather than fail with an error.

- **NEXUS-46360** – The Helm chart for External Secrets Operator configurations accepts an optional property field to extract specific keys from HashiCorp Vault KV v2 secrets stored in JSON format.

- **NEXUS-40929** \- Repository Health Check columns and status requests are now hidden when IQ Server Firewall is enabled, preventing unnecessary API calls and timeout errors on large instances.

## March 25, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-51311** \- Capability state changes now complete without causing thread deadlocks that could block UI loading and API responses.

- **NEXUS-51210** \- Maven group metadata remains available during blob store migration tasks, preventing temporary inconsistencies.

- **NEXUS-51191** \- The Remove a member from a blob store group task now completes successfully when multiple instances run concurrently.

- **NEXUS-51164** \- Log messages for invalid Maven metadata files now include the repository name, improving troubleshooting.

- **NEXUS-51040** – Docker proxy repositories handle bearer token authentication requests without encountering null pointer exceptions during HTTP context operations.

- **NEXUS-51030** \- Proxy repository creation via the REST API no longer requires the blocked field, which now defaults to false when omitted.

- **NEXUS-50808** \- Docker tag listing now handles large tag sets without causing a `StackOverflowError` during pagination.

- **NEXUS-50764** & **NEXUS-39228** – Group repositories now properly detect policy-filtered version changes in member proxy repositories, ensuring metadata remains current and complete across npm and PyPI formats.

- **NEXUS-50585** \- Upgrade tasks now skip and log deprecated task types, such as OrientDB backup tasks, instead of failing during processing.

- **NEXUS-50510** \- DEBUG-level logging now records when SSRF protection blocks outbound proxy requests to private or local network addresses.

- **NEXUS-50471** \- Docker container startup now detects existing memory settings in `INSTALL4J_ADD_VM_PARAMS` and avoids adding duplicate JVM parameters.

- **NEXUS-50384** \- Docker content validation now correctly recognizes `application/zstd` layers, improving performance during image staging, push, and pull operations.

- **NEXUS-50322** \- Staging delete operations now log additional request details, enabling troubleshooting without requiring TRACE-level logging.

- **NEXUS-47043** \- Default reconcile thread usage has been reduced to better balance CPU consumption and minimize impact on smaller deployments.

- **NEXUS-37039** \- Cleanup tasks now remove stale asset blob records for deleted blob stores, preventing repeated warnings and unnecessary data growth.

- **NEXUS-20520** \- REST API endpoints now return HTTP 401 (Unauthorized) when authentication credentials are missing, ensuring proper authentication challenges.

## March 18, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-51199** – Deleting a Docker manifest now removes all associated tags, preventing orphaned tags from remaining in the repository.

- **NEXUS-51148** – Nexus Repository now logs detailed diagnostic information when npm package metadata requests to IQ Server approach timeout thresholds, including request timing, cache behavior, and actionable configuration guidance.

- **NEXUS-51144** – Blob store configuration changes now display warning messages only when modifying settings that affect data availability, such as storage location updates.

- **NEXUS-51143** – Terraform modules with subdirectory syntax (using `//`) now download directly from Git sources rather than through the proxy cache, ensuring correct directory structure resolution.

Note: Module downloads will bypass Nexus Repository caching and connect directly to upstream Git repositories (for example, GitHub) when using subdirectory references like `terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts`.

- **NEXUS-50861** – Docker repositories accept image names containing consecutive underscores, aligning with OCI Distribution Specification requirements.

- **NEXUS-50809** – The Swagger API documentation for the `GET /v1/repositories` endpoint now includes the `size` field, displaying repository size in bytes and matching the actual API response structure.

- **NEXUS-50504** – Container image scanning handles large Go binaries (500MB+) without memory exhaustion by using a streaming parser that maintains constant memory usage regardless of file size.

- **NEXUS-50246** – Wildcard version searches now return only packages where the version starts with the specified pattern, preventing matches on partial segments within version numbers.

- **NEXUS-49457** – APT proxy repositories now include cached packages in metadata even after upstream removal, allowing installations to succeed from the local cache.

- **NEXUS-41419** – Role editing operations automatically remove references to obsolete privileges instead of displaying error messages.

- **NEXUS-40545** – Conda proxy repositories now apply the "maximum metadata age" setting to repodata.json files instead of treating them as components subject to "maximum component age" rules.

## March 11, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-50905** – S3 blob stores on different endpoints now validate bucket existence independently, preventing initialization conflicts when multiple blob stores share the same node.

- **NEXUS-50831** – Group repositories in Nexus Repository Cloud deployments now accurately calculate and display their total size, including content from nested group members.

- **NEXUS-50813** – Tag association operations now complete synchronously, allowing immediate component promotion and tag-based searches without delays in both High Availability and non-HA deployments.

- **NEXUS-50640** – SAML authentication handles missing cookies gracefully when reverse proxies strip cookie headers, preventing server errors during the login flow.

- **NEXUS-50628** – Schedule modifications to the _Admin - Cleanup expired user tokens_ task persist across Nexus Repository restarts.

- **NEXUS-50552** – The Browse menu now appears for users who have content selector privileges with browse action, matching the visibility behavior of standard repository-view permissions.

- **NEXUS-50532** – Docker group repositories now return a 504 Gateway Timeout error when firewall scanning encounters a cooperative wait timeout, instead of incorrectly returning 404 Not Found.

- **NEXUS-50196** – SAML external role mappings now synchronize on every login, removing outdated role assignments when IdP groups change and preventing users from retaining elevated privileges after group revocation.

- **NEXUS-50167** – Added support for configuring pod-level `securityContext` in the Sonatype Nexus Repository HA helm chart StatefulSet, enabling `fsGroup` and `fsGroupChangePolicy` to reduce volume permission overhead and improve pod startup times on large storage deployments.

- **NEXUS-49003** – Repository browse rebuild tasks now display overall progress across all repositories, showing the current repository name, completion percentage, and repository count.

- **NEXUS-48819** – The _Default Role_ capability now supports built-in roles like nx-anonymous and nx-admin across instance restarts and upgrades.

- **NEXUS-45518** – Tag creation, updates, and deletions are recorded in the audit log with details about the initiator, tag name, and attributes.

- **NEXUS-44583** – Maven repositories no longer allow non-timestamped SNAPSHOT artifacts (e.g., `my-app-1.0-SNAPSHOT.jar`) uploaded directly through the GUI; all SNAPSHOT artifacts must now use timestamped versions (e.g., `my-app-1.0-20241016.074913-1.jar`) as generated by standard Maven or Gradle deployment tools.

Asset views display successfully when clicking on SNAPSHOT components that were uploaded directly via the GUI with non-timestamped versions.

- **NEXUS-44136** – Database migrations between H2 and PostgreSQL now preserve blob store metrics, ensuring accurate counts and sizes appear immediately after migration without requiring manual recalculation tasks.

- **NEXUS-44075** – FluentBit log processing in Kubernetes deployments no longer generates tag prefix errors when parsing Nexus application logs.

- **NEXUS-39878** – Maven repository import tasks with hard links enabled process checksum files without generating misleading errors in the logs.

## March 4, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-50951** – From Nexus Repository version 3.89.0+, newly created Docker repositories must use lowercase names. This fix allows users to edit, via the UI, the configuration of upgraded Docker repositories that have mixed/upper case naming.

- **NEXUS-50929** – Terraform token authentication no longer applies to non-Terraform repository formats. Anonymous access to raw hosted repositories works correctly for paths matching `/v1/providers/**` patterns.

- **NEXUS-50761** – Repository browse displays all content for users with administrative permissions, regardless of any additional content selector privileges assigned through other roles.

- **NEXUS-50623** – npm group repositories now return valid JSON metadata with a single `_id` field instead of duplicating it at the top level.

- **NEXUS-50616** – Hugging Face proxy repositories correctly process filenames containing spaces and special characters by properly encoding URI segments in outbound requests.

- **NEXUS-50251** – Search indexing completes successfully for components with tens of thousands of associated file paths by implementing PostgreSQL parameter limits.

- **NEXUS-48954** – Session timeout values configured in the UI Settings capability now apply correctly in High Availability deployments, ensuring users remain logged in for the specified duration.

- **NEXUS-45172** – When attempting to redeploy an asset with the "Allow Redeploy" setting disabled, error messages now explicitly state that redeployment is not permitted for the repository, replacing the previous generic "blob upload invalid" message across all repository formats.

- **NEXUS-44209** – The Compact blob store task now successfully removes soft-deleted blobs after they've been relocated by the _Remove a member from a blob store group_ task.

- **NEXUS-42338** – Yum repositories now correctly identify the architecture of signed RPM packages by reading metadata from the RPM header tags instead of the lead header.

- **NEXUS-39798** – Database connection failures during authentication now return HTTP 503 Service Unavailable instead of HTTP 401 Unauthorized, clearly indicating a server-side infrastructure issue rather than incorrect credentials.

- **NEXUS-39080** – Docker proxy repositories now return HTTP 404 (Not Found) instead of HTTP 400 (Bad Request) when remote content fails digest validation.

- **NEXUS-29440** – PyPI proxy repositories support remote URLs without the `/simple` endpoint by allowing an empty index path configuration for services like GemFury and NVIDIA PyPI.

## February 25, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-50718** – Terraform hosted repositories now correctly generate provider metadata for all uploaded providers, ensuring consistent discovery and installation through the Terraform CLI.

- **NEXUS-50711** – Improved search API filtering to accurately return results when combining component criteria (such as name or repository) with asset-level checksums in a single query.

- **NEXUS-50706** – Improved cache invalidation for npm proxy repositories to properly handle packages with names starting with underscores or periods.

- **NEXUS-50690** – Corrected npm search query handling to ensure consistent result ordering and de-duplication in PostgreSQL environments.

- **NEXUS-50574** – npm audit requests for projects without dependencies now complete successfully instead of generating error logs.

- **NEXUS-50554** – During _Change repository blob store_ migrations to S3, asset requests now validate blob existence in the target cloud store and properly fall back to the source blob store, preventing 500 errors and build failures while migration is in progress.

- **NEXUS-50529** – Improved session timeout handling for OIDC-authenticated users to allow seamless logout and continued UI access after session expiration.

- **NEXUS-50503** – Improved credential provider lifecycle management to maintain stable S3 blobstore connections when using IAM Roles for Service Accounts (IRSA) in EKS environments.

- **NEXUS-50499** – Path-based Docker repositories now correctly respect individual anonymous pull settings.

- **NEXUS-50473** – Restored transitive permissions for group repositories so users with `read` and `browse` access to a group can access content in its member repositories. Aligned content selector behavior across authentication, preview, and browsing to ensure consistent access control.

- **NEXUS-50437** – Enhanced debug logging to include policy violation details (policy name, ID, and threat level) when policy-compliant component selection filters component versions, improving troubleshooting capabilities for quarantined packages.

- **NEXUS-50430** – Improved reliability of concurrent artifact downloads in high-availability deployments.

- **NEXUS-50428** – The npm metadata rebuild task now preserves original package version timestamps, ensuring downstream tools that validate publish dates continue to function correctly.

- **NEXUS-50324** – Logging out of Nexus Repository SaaS now fully terminates authentication sessions, requiring users to re-enter credentials instead of only MFA codes when signing back in.

- **NEXUS-50181** – Optimized Docker image pull performance when retrieving images by SHA256 digest.

- **NEXUS-50168** – Added warning messages in the file blob store creation form to alert administrators when configuring paths under the working directory in HA deployments, helping prevent data inconsistency and pod startup delays.

- **NEXUS-49785** – Improved Docker image pull reliability in HA deployments with Firewall enabled by extending the cooperation timeout to accommodate longer evaluation times.

- **NEXUS-48979** – Cleanup policy preview CSV files now display the accurate redeploy date for components in the _Published Date_ column.

- **NEXUS-48742** – Conan 2.0 repositories now accept metadata files, including SBOM artifacts, during package uploads.

- **NEXUS-48260** – Content selectors with negative search expressions now enforce access consistently across preview, browse, and download operations, preventing 403 errors and `AuthorizationException` responses when artifacts are shown as accessible.

- **NEXUS-46663** – Parallel automation scripts can now create content selectors concurrently without encountering errors during high-volume operations.

- **NEXUS-46266** – Optimized Firewall Audit Capability activation to significantly reduce startup time when multiple repository firewall capabilities are configured.

- **NEXUS-45379** – The H2 database backup task now automatically trims leading and trailing whitespace from configured backup paths, ensuring backups are created in the expected location.

- **NEXUS-45357** – Improved import tasks to successfully process attribute files containing legacy character encodings from earlier Nexus Repository instances.

- **NEXUS-44603** – Enhanced scheduler health check alerts to provide clear guidance when tasks are automatically recovered after trigger data loss, eliminating the need for support intervention.

- **NEXUS-43667** – Cleanup policies based on last download time now work correctly for Maven repositories imported from Nexus Repository 2, ensuring regenerated checksum files maintain appropriate metadata for policy evaluation.

- **NEXUS-43238** – Deleting a folder from the _Browse_ view of a Go repository now removes all associated components and assets, ensuring the entire folder and its contents are fully deleted instead of leaving residual items behind.

- **NEXUS-42660** – Namespace confusion protection settings now appear only for repository formats supported by Sonatype Repository Firewall.

- **NEXUS-42488** – Improved the asset blob reference migration process to reliably complete after system restarts, ensuring database consistency and preventing redundant cleanup operations.

- **NEXUS-42298** – Improved the blob store group member removal task to handle temporary file cleanup scenarios more reliably through automatic retry logic and graceful handling of already-deleted blobs.

- **NEXUS-40915** – PyPI group repositories now consistently include all package files in metadata regardless of filename casing differences or member repository order.

- **NEXUS-39228** & **NEXUS-50764** – Group repositories now properly detect policy-filtered version changes in member proxy repositories, ensuring metadata remains current and complete across npm and PyPI formats.

- **NEXUS-39077** – Reconciliation tasks now preserve the original blob creation timestamp when restoring database records for imported components.

- **NEXUS-37989** – Added backend validation to enforce naming requirements when creating or renaming blob stores through the REST API, ensuring consistency with UI validation rules.

- **NEXUS-37132** – Conan proxy repositories now return properly formatted JSON responses when searching for non-existent packages, allowing the Conan client to continue searching through additional configured repositories.

- **NEXUS-36994** – Proxy repositories now return appropriate 404 responses when handling requests with invalid or incomplete paths, replacing unexpected server errors with clearer feedback.

- **NEXUS-34351** – Optimized the import task to handle flat directory structures with millions of files more efficiently, significantly reducing import completion time.

## February 11, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-50621** – APT hosted repositories now correctly include all package versions in generated Packages files for each architecture. (Also fixed in self-hosted 3.89.1.)

- **NEXUS-50612** – Upgraded installations now successfully migrate the asset\_blob\_size column when upgrading directly from versions prior to 3.67.0 to 3.87.0 or later, ensuring artifact uploads complete without database errors.

- **NEXUS-50592** – Content selectors now appear in alphabetical order within the Repository Content Selector Privilege dropdown, making it easier to locate specific selectors when working with large lists.

- **NEXUS-50362** – Maven repositories now correctly return HTTP 404 responses when requesting non-existent hash signature files with compound extensions like \`.md5.asc\`.

- **NEXUS-50277** – Improved repository synchronization in high availability deployments to maintain consistent state across all nodes during concurrent deletion operations.

- **NEXUS-50273** – Improved Quartz scheduler initialization to prevent extended startup delays, reducing the time required for Sonatype Nexus Repository to become fully operational after restart.

- **NEXUS-50243** – Improved Maven group metadata accuracy to consistently reflect the latest artifact versions across nested group configurations.

- **NEXUS-50153** – Yum group repositories now serve cached metadata to clients while regenerating merged metadata in the background, preventing incomplete repodata responses during the merge process.

- **NEXUS-48604** – Enhanced LDAP credential rotation to maintain consistent cache synchronization across all nodes in high availability clusters. (Also fixed in self-hosted release 3.89.1.)

- **NEXUS-47776** – Improved URL encoding handling in proxy repositories to preserve special characters in redirect URLs, ensuring successful retrieval of artifacts from remote sources.

- **NEXUS-47618** – Cleaned up Prometheus metrics by removing unused S3 blob store timers that always displayed zero values.

- **NEXUS-46841** – Improved Docker token request handling to reliably process concurrent authentication attempts from the same client.

- **NEXUS-46805** – Non-administrator users can now configure Content Replication with repository-specific privileges without encountering permission errors.

- **NEXUS-46315** – Added JVM memory and garbage collection monitoring logs to help diagnose system resource issues across all deployment configurations.

- **NEXUS-44226** – Added a new paginated REST API endpoint for retrieving SAML users, with the existing endpoint now limiting results to 100 users to improve performance and scalability for large user bases.

- **NEXUS-43881** – Improved browse tree cleanup in YUM repositories to properly remove directory nodes when deleting duplicate RPM files uploaded to multiple paths.

- **NEXUS-42251**– Optimized repository export performance by caching delta file data in memory, significantly reducing prerequisite checking time when exporting large repositories to network file systems.

- **NEXUS-40204** – Optimized HEAD request handling for proxy repositories to return header information immediately without downloading full content from remote sources, improving response times and preventing timeout errors.

## February 4, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-50435** – Improved the search API to properly handle the `prerelease` parameter when using H2 databases.

- **NEXUS-50105** – Docker images imported into hosted repositories now retain their correct `content-type` metadata, ensuring manifests and tags can be pulled successfully.

- **NEXUS-49708** – IQ Server connection verification now properly validates that the configured user has the required permissions before allowing the configuration to be saved.

- **NEXUS-49531** – Enhanced security by upgrading the CycloneDX core library to address an XML External Entity (XXE) injection vulnerability.

- **NEXUS-47362** – ROOT logger level changes now persist correctly after restarting Nexus Repository.

- **NEXUS-47010** – Proxy repository authentication passwords containing special characters save as expected even when pre-emptive pull is enabled.

- **NEXUS-44467** – Maven POM files can now be uploaded through the UI when the version number contains hyphens or other suffixes.

- **NEXUS-13303** – Email server connections now properly support plaintext communication when the _Use the Nexus Trust Store_ option is enabled without SSL/TLS encryption options selected.

## January 28, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-50419** – Updated the image scanning process to ensure temporary resources are properly cleaned up, improving system stability and preventing potential memory issues.

- **NEXUS-50338** – LDAP configuration updates via REST API now reliably preserve all required fields during credential rotation and server configuration changes. (Fixed in self-hosted 3.89.1)

- **NEXUS-50313** – The log management API now works as expected to retrieve audit or request type events in Nexus Repository Cloud environments. Documentation will also be available soon.

- **NEXUS-50240** – Anonymous access to Terraform proxy repositories now correctly allows unauthenticated users to retrieve provider versions without receiving a 401 response.

- **NEXUS-50163** – The user interface handles rapid navigation during page loading without encountering null reference errors.

- **NEXUS-50133** – Support zip log files now truncate from the bottom up, preserving the most recent log entries needed for effective troubleshooting.

- **NEXUS-50116** & **NEXUS-50151** – Resolved an issue with the _Repair - Execute Data Repair Plan_ task that previously led to some unexpected assets being removed. Note that this task remains disabled by default in release 3.89.0.

- **NEXUS-50112** – Importing Docker images no longer removes the `/library/` namespace prefix.

- **NEXUS-50056** – Docker tag list responses now include the correct Link header path when requests are made using repository or path-based URLs.

- **NEXUS-50040** – The REST APIs for Hosted Repository Analysis now evaluate artifacts without returning an HTTP 500 error, preventing a `NullPointerException` when determining repository scan support.

- **NEXUS-49769** – Uploading RPMs to a Yum hosted repository no longer leaves behind empty repodata folders in the Browse UI.

- **NEXUS-49722** – Search results for pre-upgrade components with underscores in the group name now return correctly after upgrading without requiring a manual search index rebuild.

- **NEXUS-49164** – Wildcard searches in HA environments now correctly return results when the search term includes a hyphen-prefixed token.

- **NEXUS-48701** – The `nexus_cluster.log` file is no longer created when using H2 or PostgreSQL, eliminating confusion caused by an unused log file in non-OrientDB environments.

- **NEXUS-48281** – Task execution durations now reflect the actual start time of each task, ensuring the _Last Result_ column shows accurate elapsed time when tasks run concurrently or are queued.

- **NEXUS-47819** – The REST API now allows all roles to be removed from a SAML user, matching the behavior available in the UI and enabling consistent role management through automation.

- **NEXUS-47716** – UI metrics for total components and peak request rates now match the values returned by the `/service/metrics/data` API.

- **NEXUS-47433** – The npm v1 search now returns accurate and complete results even in large repositories with many assets.

- **NEXUS-46398** – npm login and logout actions are now captured in the audit log.

- **NEXUS-45352** – NuGet group repository queries no longer return a 500 error when a proxy member is manually blocked; cached metadata is now served correctly without requiring remote access.

- **NEXUS-44432** – After a UI session timeout, the _Go Back_ button on the unsaved changes popup now behaves as expected or no longer appears unnecessarily.

- **NEXUS-44177** – NuGet V3 proxy repositories now return accurate search results after replication, even when the remote source is blocked or the original component has been deleted.

- **NEXUS-40099** – Warning messages about invalid active nodes in clustered deployments are now clearer and include actionable context.

- **NEXUS-30682** – The cURL example for the `tasks/{id}/run` endpoint in the Swagger UI now includes the correct headers and formatting.

- **NEXUS-23799** – The _distribution_ field is no longer required when configuring an Apt proxy repository.

- **NEXUS-11917** – Nexus Repository now better handles misconfigured or unreachable IQ Server connections by providing clearer error messages and reducing unnecessary log noise.

## January 21, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-50183** – Uploads to Azure blob stores now apply backpressure to limit in-memory chunk accumulation, preventing OutOfMemoryError during large file proxying and improving stability for high-concurrency environments.

- **NEXUS-49485** – Requests to APT hosted repositories now block until metadata is available during rebuilds, preventing transient 404 responses and ensuring more reliable package retrieval in high-traffic environments.

- **NEXUS-49265** – Searches in the Namespace, Name, and Version columns in HA environments now return only exact matches unless a wildcard is explicitly included, restoring the expected strict matching behavior.

- **NEXUS-48975** – Creating new Docker repositories with mixed case names is now blocked to ensure compatibility with path-based routing and align with Docker's lowercase naming requirements.

- **NEXUS-48956** – Added logging to the browse node migration upgrade step to provide visibility into potentially long-running schema changes on large `browse_node` tables.

- **NEXUS-46771** – NuGet v2 proxy repositories now proactively prefetch package dependencies.

- **NEXUS-44560** – Made adjustments to safely handle a race condition during repository recreation to prevent failures when uploading content or starting facets after rapidly deleting and recreating a repository with the same name.

- **NEXUS-28286** – Browsing behavior now respects content selectors as expected.

## January 14, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-49996** – Improved repository deletion performance and reliability by optimizing role privilege cleanup and addressing race conditions across HA nodes.

- **NEXUS-49970** – Improved performance of delta APT metadata rebuilds for large hosted repositories by optimizing how metadata updates are written to the database.

- **NEXUS-49845** – Corrected a race condition that caused npm group metadata updates to fail when handling non–URL-safe package names.

- **NEXUS-49758** – Group repositories now correctly honor the offline status of member proxy repositories.

- **NEXUS-49414** – Updated permission checks in the _Browse_ interface.

- **NEXUS-47679** – Improved synchronization of password changes across HA nodes to ensure updated credentials are recognized immediately.

- **NEXUS-45388** – Improved the _Admin - Cleanup Tags_ task to gracefully handle missing components by skipping over them.

- **NEXUS-42793** – Improved PyPI index page handling in Repository Firewall by filtering out invalid component versions during processing.

- **NEXUS-38502** – Corrected YUM group metadata handling so repositories with invalid or missing member metadata no longer return an empty repomd.xml, instead rebuilding metadata or returning a 404 to reflect the invalid state accurately.

## January 9, 2026

This Sonatype Nexus Repository Cloud release includes the following bug fixes:

- **NEXUS-50063** – Improved documentation around Firewall fail-open mode.

- **NEXUS-49991** – Updating an S3 blob store's Access Key no longer triggers an invalid state error when the blob store is already running, preventing it from entering a failed state and avoiding unnecessary instance restarts.

- **NEXUS-49940** – SAML SSO in the UI now correctly redirects to the identity provider when using a custom context path.

- **NEXUS-49924** – Reduced overhead during permission checks, resulting in faster performance for environments with frequent authorization lookups. As part of this fix, we created a new cache to manage each user's permissions. This cache is enabled by default, but administrators can disable it with `nexus.security.principal.permissions.cache.enabled=false`.

- **NEXUS-49902** – The _Verify and Repair Data Consistency_ tasks now correctly handle group blob stores.

- **NEXUS-49901** – Group blob stores in a high-availability deployment now start correctly after an upgrade.

- **NEXUS-49893** – Cargo group repositories now correctly generate and serve package metadata, allowing `cargo build` commands to succeed when resolving dependencies through a group instead of requiring direct access to individual proxy repositories.

- **NEXUS-49883** – Regenerated `.properties` files during data repair now correctly restore the original `@BlobStore.blob-name` value instead of using the internal blob path.

- **NEXUS-49792** – The user interface now automatically trims leading and trailing spaces from proxy repository URLs.

- **NEXUS-49791** – Trailing spaces in proxy repository remote URLs no longer cause errors in startup tasks.

- **NEXUS-49777** – NuGet V3 search queries now return the correct `totalHits` value and properly exclude pre-release packages when specified.

- **NEXUS-49744** – NuGet metadata now preserves dot separators in target framework monikers.

- **NEXUS-49729** – The _Repair - Rebuild repository search_ task now processes assets in batches, preventing PostgreSQL parameter limits from being exceeded.

- **NEXUS-49651** – Resolved a deadlock condition that was sometimes occurring during remote event processing in high-availability deployments.

- **NEXUS-49606** & **NEXUS-49502** – Component search and the `/v1/search/assets` API now return results correctly for group IDs containing uppercase letters in non-HA environments.

- **NEXUS-49573** – The _Upload Component_button has been restored in the _Browse_ view for hosted repositories.

- **NEXUS-49489** – npm tarballs are now correctly served from group repositories even when member proxies have differing PCCS waiver configurations.

- **NEXUS-49371** – NuGet V2 status checks no longer show a misleading warning on HA node startup when no NuGet V2 repositories exist.

- **NEXUS-49127** – The _Repair - Rebuild npm metadata_ task now fully regenerates metadata from existing package versions, removing references to deleted packages.

- **NEXUS-49069** – Uptime log entries once again include the running Sonatype Nexus Repository version during startup and shutdown, making it easier to identify the source version when investigating upgrade-related support cases.

- **NEXUS-49035** – The Nexus Repository Operator no longer includes the chart version in StatefulSet names, ensuring PersistentVolumeClaims retain consistent names across upgrades and allowing reuse of existing storage.

- **NEXUS-48992** – Search results from the /rest/v1/search/assets API are no longer silently truncated at 10,000 items, as the removal of Elasticsearch eliminates the underlying limitation that caused incomplete responses without indication.

- **NEXUS-48945** – The _Repair - Rebuild npm metadata_ task now preserves the existing latest tag based on publish order.

- **NEXUS-48893** – Yum repositories now recognize architecture as part of a component’s identity, allowing multiple RPMs with the same name and version but different architectures to coexist when using a deploy-once policy.

- **NEXUS-48881** – Outbound request logs now consolidate all relevant details into a single line, including the HTTP method and response time.

- **NEXUS-48839** & **NEXUS-48905** – Docker Bearer Token authentication now uses the correct token URL when anonymous pull is enabled.

- **NEXUS-48531** – PyPI group repositories now serve previously cached metadata when PCCS evaluations time out.

- **NEXUS-48147** – The Nexus HA Helm chart now uses a centralized and consistent naming mechanism for StatefulSets, removing the nonfunctional statefulset.name parameter to avoid confusion and ensure predictable resource naming.

- **NEXUS-47784** – Database migration errors now include full query parameters in the logs.ons.

- **NEXUS-47774** – Migrations from Nexus Repository 2 now correctly preserve the `fileTypeValidation` setting by mapping it to `strictContentTypeValidation` in Nexus Repository 3.

- **NEXUS-47646** – The _Repair - Rebuild Maven repository metadata_ task is properly triggered when necessary, even if the initial move operation encounters errors.

- **NEXUS-47285** – The malware evaluation task now skips components with missing or empty hashes instead of failing.

- **NEXUS-47092** – Maven metadata at the group-artifact level is now correctly maintained when artifact and group IDs overlap.

- **NEXUS-46700** – Removed inapplicable API endpoints from Nexus Repository Community Edition Swagger.

- **NEXUS-46696** –The Search API now correctly filters results by `maven.extension` and `maven.classifier`.

- **NEXUS-46565** – Log messages about duplicate browse nodes are now recorded at the DEBUG level instead of WARN.

- **NEXUS-46095** – Large PostgreSQL migrations no longer fail due to heap exhaustion, as the database migrator now cleans up accumulated component and asset data during and after processing to significantly reduce memory usage.

- **NEXUS-45786** – The Search Assets API now returns a 400 Bad Request with a clear error message when an invalid sort field is used.

- **NEXUS-45636** – Conan 2 search in HA deployments now returns up to 10,000 results by default.

- **NEXUS-45425** – Removed the Version Policy, Layout Policy, and Content Disposition fields from the UI for creating Maven group repositories.

- **NEXUS-45400** – Improved performance of the internal group member cache to reduce delays and failures during search operations.

- **NEXUS-45399** – Modifying a Docker cleanup policy using the REST API no longer causes the UI to hang when editing the policy.

- **NEXUS-45299** – Optimized how large XML files are merged to improve Yum group metadata rebuilds.

- **NEXUS-45291** – Warning logs for group repository metadata generation now include the names of member repositories missing ETag headers, making it easier to identify the source of repeated and expensive metadata rebuilds.

- **NEXUS-44810** – Updating a proxy repository with an invalid remote URL works as expected.

- **NEXUS-44434** – Session timeouts in one browser tab no longer log out other active tabs.

- **NEXUS-43699** – Nexus Repository now preserves the scripts section from package.json when npm packages are uploaded to a hosted repository via the UI, REST API, or import task.

- **NEXUS-43451** – The `/rest/v1/search/assets` API consistently returns results based solely on asset-level content selector permissions.

- **NEXUS-41276** –The Component Upload API documentation no longer lists unsupported Docker parameters.

- **NEXUS-41229** – Repository content selector privileges can now be created and updated via the REST API using format-specific wildcards like \*-maven2.

- **NEXUS-40005** – Improved npm search index handling to prevent creation of excessive and redundant assets.

- **NEXUS-39789** – The Docker garbage collection task now logs detailed reasons when a V2 manifest is invalid.

- **NEXUS-39514** – Pagination using the from parameter in the npm /v1/search endpoint works correctly.

- **NEXUS-39468** – npm audit requests made to group repositories now correctly track and associate the responding proxy repository.

- **NEXUS-39374** – Cached Docker blob layers can now be deleted from Docker proxy repositories using the same HTTP DELETE requests supported by hosted repositories.

- **NEXUS-37810** – Strict Content Type Validation now correctly recognizes the MIME type application/x-sharedlib.

- **NEXUS-35782** – The Roles REST API now returns all directly contained roles and privileges for SAML-based roles.

- **NEXUS-35758** – Nexus Repository now checks whether an H2 database exists before attempting a restore.

- **NEXUS-34513** – Asset paths in the _Browse_ and _Search_ views now display with a leading slash.

## Search results

No results found

[Would you like to provide feedback? Just click here to suggest edits.](mailto:docs@sonatype.com?subject=Feedback%20for%20help%20topic%20%22Nexus%20Repository%20Cloud%20Bug%20Fixes%22&body=%0A%09%09%09%09%0A%09%09%09%09%0A%09%09%09%09_______________________%0A%09%09%09%09%0A%09%09%09Please%20add%20your%20feedback%20above%20for%20topic%20%22Nexus%20Repository%20Cloud%20Bug%20Fixes%22%20in%20the%20publication%20%22Sonatype%20Help%22.)

- [Prev](https://help.sonatype.com/en/2026-nexus-repository-cloud-release-notes.html)
- [Next](https://help.sonatype.com/en/nexus-repository-2026-release-notes.html)

Copy as Markdown

Ask Sona

reCAPTCHA

Recaptcha requires verification.

protected by **reCAPTCHA**