Nexus Repository Cloud Release Notes

This page contains a list of new features and enhancements in our Sonatype Nexus Repository Cloud releases.

For bug fix details, see the Sonatype Nexus Repository Cloud bug fixes page.

Note that while we strive to fully document new features before releasing them to our Cloud environments, there may be occasional delays. In such instances, we will update this page with links to the relevant help documentation as soon as it becomes available.

July 22, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Added support for Chocolatey registry in NuGet hosted, proxy, and group repositories.

• Added support for Microsoft Symbol Server in NuGet hosted, proxy, and group repositories.

• The HuggingFace proxy now implements the /tree/ API restoring snapshot_download() and hf download for huggingface_hub 1.22.0+ and for large repositories (>1,000 files). Pinning huggingface_hub to ≤1.21.0 is no longer required.

• Hugging Face repositories now support bearer token authentication compatible with huggingface-cli login and hf auth login, including huggingface_hub 1.0 and later.

• Cleanup policies now extend Retain Select Versions support to additional repository formats, helping teams protect the newest component versions while automating repository cleanup. Administrators can also assign repositories from the cleanup policy form and preview or run targeted cleanup operations on demand through a new REST API. For supported formats, see the Cleanup Criteria help documentation.

• Azure blob store API endpoints now return specific HTTP error codes for common configuration failures, making it easier to identify permission and feature-related issues when enabling direct downloads.

• The content selector preview endpoint now enforces repository browse permissions so users can preview assets only from repositories they are authorized to access. The response also returns only essential asset information, reducing exposure of sensitive metadata.

• Nexus Repository now protects against a denial-of-service vulnerability caused by excessively large Maven POM metadata. Oversized pom.name and pom.description values are automatically truncated during ingestion.

• PyPI proxy repositories now support pre-emptive authentication, enabling successful proxying of private authenticated repositories such as GitLab.com-hosted PyPI instances.

• Added support for temporary AWS credentials for Amazon ECR proxy repositories by allowing you to configure an optional AWS session token alongside your access key and secret key. This update enables authentication with AWS STS and IAM Identity Center (SSO) credentials while preserving existing support for long-lived AWS access keys.

• Various bug fixes.

July 15, 2026

This Sonatype Nexus Repository Cloud release does not include any new features. See Nexus Repository Cloud Bug Fixes.

July 8, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Proxy repositories now support repository-specific URL encoding rules, enabling format-specific configurations such as encoding + as %2B for PyPI repositories that use PEP 440 local version strings. Existing global configurations continue to work unchanged.

• PyPI proxy repositories now support preemptive authentication, enabling successful proxying of private repositories that do not issue authentication challenges, such as GitLab.com-hosted PyPI repositories.

• Various bug fixes.

July 1, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Sonatype Nexus Repository Cloud now checks authentication rate limits. Once the authentication rate limit is exceeded, all subsequent authentication attempts receive a 429 Too Many Requests response until the rate limit expires, regardless of whether the credentials are valid.

• Various bug fixes.

June 26, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Added support for native OCI (Open Container Initiative) hosted, proxy and group repositories.

• Added support for AWS Elastic Container Registry (ECR) in Docker proxy repositories, enabling centralized access to and caching of images from private ECR registries.

• Sonatype Nexus Repository now validates realm configurations submitted through Security > Realms against registered realm IDs, preventing invalid or unauthorized realm IDs from running at startup.

• PyPI repositories now support Simple API v1.1 (PEP 700), providing package metadata that enables modern clients such as pip and uv to make faster, more efficient dependency resolution decisions. Existing PEP 503 HTML and Simple API v1.0 behavior remain unchanged for full client compatibility.

• Sonatype Repository Firewall cloud deployments now automatically activate the Ansible Galaxy security realm at startup, ensuring existing tenants use the correct AnsibleGalaxyToken authentication configuration without manual intervention.

• The Content Disposition setting is no longer available for Maven and Raw repositories in cloud deployments. Download behavior is automatically managed by cloud storage, ensuring a consistent download experience.

• Various bug fixes.

June 10, 2026

June 3, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Docker repository management now simplifies connector configuration with port suggestions, provides richer image metadata in search results, and generates docker pull commands that correctly reference your Sonatype Nexus Repository registry.

• URL encoding is now controlled exclusively through the Preserve Encoded Characters setting in each proxy repository's configuration.

• New Conan proxy repositories now default to Protocol Version V2 and automatically update the Remote Storage URL example to https://center2.conan.io.

• Various bug fixes.

May 27, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Terraform proxy repositories now dynamically detect upstream service discovery paths, improving compatibility with compliant registries such as OpenTofu registries and registry.coder.com.

• Various bug fixes.

May 26, 2026

May 21, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• The Usage page in Repository Cloud now includes additional context explaining differences between Peak Storage and repository totals.

• Terraform proxy repositories now dynamically read service discovery paths from upstream registries, enabling compatibility with compliant registries that use non-standard module or provider paths.

• Changing a user's password now immediately invalidates all active sessions across devices and browsers, requiring re-authentication with the updated credentials to improve account security.

• API keys for NuGet, npm, Docker, and Conan formats now use UUID v4 generation. Existing keys remain valid, but Sonatype recommends regenerating keys to take advantage of the improved security model.

• Nexus Repository now supports Alpine Linux (APK) repositories with hosted, proxy, and group repository types, including APKINDEX generation, RSA-based index signing, and a unified endpoint for Alpine-based CI pipelines.

• Various bug fixes.

May 13, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Added support for GO hosted and group repositories.

• Added support for Ansible proxy, hosted, and group repositories.

• Administrators can now use a new nameCode parameter in the User Token API to identify a token's owner and authentication realm by token name code.

• Added a new nexus:uploader-metadata:read permission to allow administrators to control access to asset uploader usernames and IP addresses in the REST API and browse UI.

• Nexus Repository now temporarily rate limits authentication attempts across UI and API login endpoints after three failed login attempts to help protect against brute force attacks.

• Various bug fixes.

May 8, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Added new endpoints to the Security management: user roles API to allow administrators to programmatically get, replace, add, and remove user role assignments in cloud deployments, enabling more precise and automation-friendly permission management.

• Improved page load performance throughout Nexus Repository.

• The IP Allow List feature is now available in Sonatype Nexus Repository Pro and Cloud editions, with existing configurations preserved during upgrade.

• The Migrator CLI now blocks migrations to unsupported H2-backed Nexus Repository targets before data transfer begins, helping prevent failed or corrupted migrations.

• The Reconcile task now re-ingests blobs located in the wrong blobstore after repository move operations, ensuring blob data aligns with the repository’s configured blobstore.

• Proxy repository credentials are now cleared when the remote URL changes, preventing credentials from being reused against unintended destinations. Administrators must re-enter credentials after updating the URL.

• The Instance Migrator now supports H2 databases as a migration source.

• Refreshed the artifact upload interface with improved layout consistency, corrected visual issues, and a more polished upload experience.

• Various bug fixes.

April 29, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Preview Sonatype Nexus Repository's new user interface using the Switch to Nexus One UI toggle. Not that an administrator must enable this feature via Settings > System > Nexus One UI before the toggle will be visible (available in 3.92.0).

• PyPI proxy repositories now support the PEP 658 and PEP 691 JSON API, caching JSON responses to improve performance for modern Python tools.

• Various bug fixes.

April 22, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Swift repositories can now be migrated between Nexus Repository instances using the Instance Migrator. Package archives and manifests are transferred, while auto-generated metadata is excluded and regenerated on the target instance, enabling seamless migrations.

• Various bug fixes.

April 20, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Added support for the Dart (pub) package format.

• Added support for Conda hosted and group repositories.

• The Instance Migrator can now migrate Terraform and Conda hosted repositories between Nexus Repository instances.

• Added support for Helm group repositories, allowing aggregation of multiple Helm repositories into a single endpoint (disabled by default; configurable via system property).

• The Usage Insights dashboard now retains daily storage metrics indefinitely, aligning with the retention model used for egress metrics. This ensures a complete and continuous view of storage trends across all time periods, eliminating gaps in historical data.

• Refreshed the login experience with a unified design across both self-hosted and Cloud deployments. The updated interface aligns with Sonatype’s standard design system, delivering a more consistent and polished user experience without introducing any functional changes.

• In cloud deployments, the Users page now includes an Invite User button, replacing Create Local User. This streamlines onboarding through your identity provider and simplifies the interface by automatically filtering to OAuth2 users. Self-hosted deployments are unchanged.

• Introduced a new admin REST API (GET/PUT /v1/security/ssrf-protection) for managing SSRF protection settings dynamically without requiring a restart. This includes support for configuring allowed IPs and domains, ensures cluster-wide consistency, and permanently blocks access to cloud metadata endpoints.

• Various bug fixes.

April 8, 2026

April 1, 2026

March 25, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Introduced an Instance Migrator that allows OrientDB-based Nexus Repository 3.70.5 instances to either Nexus Repository Cloud or self-hosted Nexus Repository version 3.90.2+.

See the Instance Migrator help documentation for full requirements and migration details.

• Added an informational alert in the Historical Usage section to clarify that usage data is updated every 48 hours. This helps set expectations and explains why recent repository changes may not be immediately reflected in storage metrics.

• Yum repository migrations now automatically regenerate repository metadata, including required files such as repomd.xml and associated .xml.gz files. This ensures migrated repositories remain complete and fully functional without requiring manual intervention.

• Various bug fixes.

March 18, 2026

This Sonatype Nexus Repository Cloud release does not include any new features. Expand the section below to see included bug fixes.

Various bug fixes.

March 11, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Nexus Repository now supports Swift group repositories. This allows you to aggregate multiple Swift package sources into a single endpoint for simplified dependency management.

• Various bug fixes.

March 4, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Repository Firewall now supports global webhooks for quarantine events, automatically notifying your systems when components are quarantined or blocked due to policy violations. This enables real-time integration with your security workflows and incident response systems, allowing you to immediately track and respond to potentially risky components.

• Various bug fixes.

February 25, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Support for Swift hosted repository format.

• Support for Terraform group repository format.

• The User Token API now allows administrators to create, view, and delete user tokens. With the appropriate privileges, administrators can generate tokens for specific users and realms, retrieve token summaries (excluding sensitive fields), and manage tokens across individual or all realms, including options to include expired tokens in responses.

• Various bug fixes.

February 11, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Proxy URL validation is enabled by default to block outbound connections to private network addresses, localhost, and cloud metadata endpoints.

• Sonatype Repository Firewall now writes firewall.quarantine audit log events when components are newly quarantined or when users attempt to download already quarantined components. Note that you must be using self-hosted IQ version 201 or Sonatype Lifecycle Cloud (SaaS) for this to take effect.

• Improvements to the Sonatype Nexus Repository Cloud login page.

• Various bug fixes.

February 4, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• PyPI package metadata now includes a sonatype_filtered_versions field when versions are filtered.

• Various bug fixes.

January 28, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Support for Swift proxy repositories.

• Support for Terraform hosted repositories.

• Various bug fixes.

January 21, 2026

January 14, 2026

January 9, 2026

This Sonatype Nexus Repository Cloud release includes the following new features/enhancements:

• Added support for Terraform proxy repository format. Note that Terraform currently requires user token-based authentication, which requires a paid Nexus Repository Pro or Nexus Repository Cloud license. This means that, at the moment, Community Edition users are unable to authenticate for Terraform repositories. Anonymous access is not currently available for Terraform proxy repositories, though that will be enabled shortly.

• Various bug fixes.