Sonatype Nexus Repository 3.88.0 Release Notes
Sonatype Nexus Repository 3.88.0 Release Notes
The Sonatype Nexus Repository 3.88.x release line includes exciting new features, enhancements, and bug fixes. Learn more in the sections below!
Released January 13, 2026
Ready to Upgrade?
Before upgrading, see the Known Issues & Upgrade Guidance section at the end of these release notes to determine whether any known issues or upgrade recommendations apply to your environment.
What’s New and Noteworthy in This Release?
Support for Proxy Terraform Repositories
Sonatype Nexus Repository now supports proxy repositories for Terraform, enabling users to cache Terraform providers and modules from registry.terraform.io for improved performance, reliability, and governance.
This allows organizations to streamline infrastructure-as-code workflows by hosting provider binaries, checksums, signatures, and module archives directly within Nexus Repository. By rewriting upstream metadata, all download URLs point to your Nexus Repository instance, ensuring consistent access and control over Terraform content across all environments.
Terraform currently requires user token-based authentication, which requires a paid Nexus Repository Pro or Nexus Repository Cloud license. This means that, at the moment, Community Edition users are unable to authenticate for Terraform repositories. Anonymous access is not currently available for Terraform proxy repositories, though that will be enabled shortly.
Nexus Repository is compatible with the Terraform CLI version 0.13 and later, including all 1.x releases. To get started, see our Terraform repository help documentation.
Search Now Powered by SQL Instead of Elasticsearch
Starting in Nexus Repository 3.88.0, all search operations are now executed directly against the underlying SQL database, replacing Elasticsearch across all repository formats and editions.
This change improves consistency and simplifies deployment by using your configured database (i.e., PostgreSQL or H2) for search indexing and queries. While search functionality, API endpoints, and query syntax remain unchanged, some behavior may differ slightly, particularly around wildcard support, fuzzy matching, and relevance ranking.
PostgreSQL is recommended for production environments and supports relevance-based search; H2 is intended for development and may yield reduced performance on large datasets.
For full details, see our SQL Search help documentation.
Trigram Module Required for PostgreSQL
Reminder that it is required to have the pg_trgm (trigram) module installed when using a PostgreSQL database. This module may not be installed with PostgreSQL by default on all Linux distributions, which will result in an exception when attempting to upgrade.
See our installing the trigram module documentation.
New API to Retrieve Capability Types and Metadata
This release adds a new GET /v1/capabilities/types API endpoint that allows you to programmatically retrieve all available capability types along with their metadata, such as form fields, descriptions, and configuration requirements. This is useful for automating or dynamically generating capability-related configurations in external tools or custom UIs.
For full details, see the Capabilities API help documentation.
New Capability and Task for Managing Browse Tree Cleanup
Sonatype Nexus Repository 3.88.0 introduces a new Repository: Browse Trim capability and a Repair - Repository trim browse tree task to give administrators more control over cleaning up empty browse nodes (folders) after component deletion.
Automatic trimming is always enabled for H2 databases but disabled by default for PostgreSQL. For PostgreSQL users who prefer to keep automatic trimming disabled, the new repair task offers a manual alternative to clean up empty nodes on demand.
Learn more in the capability and task documentation.
Configurable Iteration Settings for Password and Secret Encryption
Sonatype Nexus Repository 3.88.0 adds support for two new properties (nexus.security.password.iterations and nexus.security.secrets.iterations) that allow administrators to configure the number of PBKDF2 iterations used when encrypting user passwords and sensitive secrets like API keys and tokens.
These properties, set in the nexus.properties file, provide greater control over encryption strength and support seamless migration to updated security configurations.
See our Re-encryption in Nexus Repository help documentation for full details.
New URL Validation to Protect Against Private Network Access
Sonatype Nexus Repository 3.88.0 introduces optional URL validation to help protect against Server-Side Request Forgery (SSRF) by blocking outbound connections to private network addresses, localhost, or cloud metadata endpoints.
This validation applies to Remote Storage URLs for proxy repositories and Endpoint URLs for Amazon S3 blob stores. By default, private network access remains allowed, but administrators can restrict it by setting nexus.proxy.allowPrivateNetworks=false in the nexus.properties file or using environment variables.
For full details, see Securing Nexus Repository.
Important Change Coming in 3.90.0
Starting in version 3.90.0, private network access will be blocked by default.
Updated SAML Library for Improved Security and Compatibility
Sonatype Nexus Repository now uses a new library for handling SAML authentication. This update aligns with our ongoing efforts to improve security and maintain compatibility with modern identity providers (IdPs). We have tested this change internally with a range of IdPs, but we recommend validating your SAML configuration in a test environment before deploying to production.
Note
If your IdP includes an entityId in its SAML response, it must match the entityId configured in Nexus Repository for authentication to succeed. This behavior may differ from previous versions.
Repair - Execute Data Repair Plan Task Disabled by Default
To prevent potential data loss caused by a known issue impacting Sonatype Nexus Repository 3.83.0 and later, the Repair - Execute Data Repair Plan task is now disabled by default starting in version 3.88.0.
Attempting to run this task in 3.88.0 will result in a failure and an error in the logs. The task remains visible in the UI, and any existing instances of this task will not be removed. However, execution is blocked by default.
While it is possible to manually re-enable this task by setting the nexus.reconcile.task.enabled property to true, it is important that you not do so until you are using a release that restores support.
Bug Fixes
This release delivers a wide range of fixes and improvements focused on stability, accuracy, and operational reliability. For better readability, we’ve organized these improvements into logical sections below.
Note
Common Vulnerabilities and Exposures Fix
Sonatype Nexus Repository 3.88.0 fixes a reflected cross-site scripting (XSS) vulnerability (CVE-2026-0601) that impacts Sonatype Nexus Repository versions 3.82.0 through 3.87.1.
The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in a victim’s browser, which could lead to privilege escalation or unauthorized configuration changes.
See our CVE-2026-0601 Knowledge Base article for details.
Repository Formats and Package Management
This release includes a broad set of improvements across supported repository formats. Updates improve how package metadata is generated, cached, rebuilt, and displayed. These changes help ensure packages are indexed accurately, metadata stays up to date, and clients interact reliably with repositories even in edge cases involving redeployments, caching behavior, or format-specific nuances.
| Issue ID | Description |
|---|---|
| NEXUS-49893 | Cargo group repositories now correctly generate and serve package metadata, allowing cargo build commands to succeed when resolving dependencies through a group instead of requiring direct access to individual proxy repositories. |
| NEXUS-49789 | Importing a previously exported Raw hosted repository on Windows now correctly preserves the original directory structure instead of merging it into the asset name. |
| NEXUS-49331 | Export assets tasks now correctly export npm packages from hosted and proxy repositories by properly registering the required filter component, ensuring assets are written without directory structure errors. |
| NEXUS-49225 | Helm chart uploads now correctly extract the chart name and version from the Chart.yaml file inside the .tgz package, ensuring charts are indexed and retrievable even when the uploaded filename does not match the metadata. |
| NEXUS-49134 | License information is now correctly extracted from the License-Expression field in PyPI packages using Metadata-Version 2.4, ensuring accurate license display for Python components retrieved through proxy repositories. |
| NEXUS-49114 | R proxy repositories now correctly respect the metadataMaxAge setting by using the appropriate cache controller for metadata assets, ensuring timely refresh of files like PACKAGES without requiring manual cache invalidation. |
| NEXUS-48893 & NEXUS-49913 | Yum repositories with a deploy-once policy now correctly treat RPMs with the same name and version but different architectures as separate components, allowing uploads of multiple architecture variants without conflict. |
| NEXUS-48245 | YUM group repositories now support .zst-compressed metadata files. |
| NEXUS-48163 | The index.yaml file in hosted Helm repositories now consistently appears as a file instead of a folder in the UI. |
| NEXUS-48088 | Cargo proxy repositories now correctly honor all specified settings when created via API. |
| NEXUS-47508 | Conan package versions that include pre-release tags now display correctly in the browse tree. |
| NEXUS-44812 | Hosted R repositories now correctly generate the required PACKAGES index file, ensuring full compatibility with tools like Azur. |
| NEXUS-46876 | Group npm repositories now support a configurable TTL for metadata caching, ensuring package metadata stays up to date and preventing stale data from blocking access to valid package versions. |
| NEXUS-48739 | npm proxy repositories now correctly update package metadata when a cached package is deleted locally. |
| NEXUS-49127 | The Repair - Rebuild npm metadata task now fully regenerates metadata from existing package versions, removing references to deleted packages. |
| NEXUS-47646 | The Repair - Rebuild Maven repository metadata task is properly triggered when necessary, even if the initial move operation encounters errors. |
| NEXUS-40005 | Improved npm search index handling to prevent creation of excessive and redundant assets. |
| NEXUS-39468 | npm audit requests made to group repositories now correctly track and associate the responding proxy repository. |
| NEXUS-39514 | Pagination using the from parameter in the npm /v1/search endpoint works correctly. |
| NEXUS-36868 | Helm proxy repositories now correctly preserve string values like appVersion from index.yaml. |
Search, Indexing, and Metadata Accuracy
This release refines search and indexing behavior to improve result accuracy, consistency, and resilience. Fixes address incorrect matches, case-sensitivity issues, pagination limits, and failures caused by orphaned or inconsistent data. Together, these changes make search results more predictable across APIs and the UI, improve cleanup and rebuild operations, and reduce the likelihood of errors caused by stale or malformed index data.
| Issue ID | Description |
|---|---|
| NEXUS-49742 | Staging move operations on PostgreSQL now perform faster and clean up empty browse nodes more efficiently. |
| NEXUS-48260 | Content selector expressions using negative patterns now correctly enforce permissions during download and browse actions. |
| NEXUS-49502 & NEXUS-49606 | Component search and the /v1/search/assets API now return results correctly for group IDs containing uppercase letters in non-HA environments. |
| NEXUS-49613 | Component searches in High Availability environments now return only exact matches when no wildcards are used. |
| NEXUS-48992 | Search results from the /rest/v1/search/assets API are no longer silently truncated at 10,000 items, as the removal of Elasticsearch eliminates the underlying limitation that caused incomplete responses without indication. |
| NEXUS-48393 | Cleanup policies using regex patterns with quantifiers now produce consistent and accurate results between preview and execution. |
| NEXUS-44316 | Search API requests that previously failed with a 500 error due to orphaned records in the search_components table are now handled gracefully. An upgrade task removes these invalid entries to restore search functionality without manual intervention. |
| NEXUS-40516 | UI searches performed by non-admin users now correctly display and navigate to the expected components and assets within group repositories. |
| NEXUS-48504 | The Search API now correctly returns blobCreated and blobStoreName values for assets. |
| NEXUS-43451 | The /rest/v1/search/assets API consistently returns results based solely on asset-level content selector permissions. |
| NEXUS-34513 | Asset paths in the Browse and Search views now display with a leading slash. |
High Availability, Clustering, and Concurrency
Several fixes in this release target stability and accuracy in high availability deployments, particularly under concurrent load. Improvements address race conditions, deadlocks, case-handling inconsistencies, and startup issues related to shared resources such as blob stores. These changes help ensure reliable behavior across nodes during searches, downloads, background processing, and upgrades in clustered environments.
| Issue ID | Description |
|---|---|
| NEXUS-48982 | Concurrent requests to the same asset across High Availability nodes no longer result in errors. |
| NEXUS-49714 | Tag-based searches and staging move operations in High Availability environments now correctly handle tag names in a case-insensitive manner. |
| NEXUS-49651 | Resolved a deadlock condition that was sometimes occurring during remote event processing in high-availability deployments. |
| NEXUS-49901 | Group blob stores in a high-availability deployment now start correctly after an upgrade. |
| NEXUS-49902 | The Verify and Repair Data Consistency tasks now correctly handle group blob stores. |
Blob Stores, Storage, and Data Integrity
This release improves the accuracy, reliability, and observability of blob store operations. Fixes address incorrect size reporting, upgrade edge cases, concurrency handling, and data repair behavior across different storage backends. Additional improvements ensure diagnostic artifacts and logs more accurately reflect the state of stored data, helping administrators better understand and maintain storage health.
| Issue ID | Description |
|---|---|
| NEXUS-50152 | The blob attribute loading process no longer deletes properties files on transient I/O errors or unhandled exceptions. |
| NEXUS-49991 | Updating an S3 blob store's Access Key no longer triggers an invalid state error when the blob store is already running, preventing it from entering a failed state and avoiding unnecessary instance restarts. |
| NEXUS-48329 | The Total Size reported for Azure blob stores now accurately reflects actual storage usage. |
| NEXUS-48851 | S3 blob store secrets containing special characters are now correctly handled during upgrade. |
| NEXUS-47174 | Compact Blob Store tasks can now run concurrently across different blob stores. |
| NEXUS-35061 | Support zips generated on PostgreSQL and H2 now correctly include the key_store_data table. |
| NEXUS-49883 | Regenerated .properties files during data repair now correctly restore the original @BlobStore.blob-name value instead of using the internal blob path. |
| NEXUS-49424 | The Verify and Repair Data Consistency task now accurately reports elapsed time in logs. |
Cleanup, Maintenance, and Background Tasks
Cleanup and maintenance tasks are now more reliable, predictable, and easier to troubleshoot. Enhancements improve how cleanup policies are evaluated and executed, how background tasks handle large datasets, and how errors and warnings are logged. These changes reduce operational friction and help ensure long-running or automated maintenance tasks complete successfully without unnecessary failures or noise.
| Issue ID | Description |
|---|---|
| NEXUS-40930 & NEXUS-48460 | Cleanup Policy Preview now correctly handles regular expressions containing special characters. |
| NEXUS-45399 | Modifying a Docker cleanup policy using the REST API no longer causes the UI to hang when editing the policy. |
| NEXUS-49536 | Cleanup policies using both Retain criteria and Asset Name Matcher now correctly process all matching components, even in large component sets that exceed the batch limit, for both preview and actual cleanup execution. |
| NEXUS-44903 | Only one Docker garbage collection task can run at a time on a repository. |
| NEXUS-41564 | Docker Garbage Collection task logs now include more detailed information about deleted and retained assets. |
| NEXUS-39789 | The Docker garbage collection task now logs detailed reasons when a V2 manifest is invalid. |
| NEXUS-26593 | The Docker - Delete incomplete uploads task no longer logs unnecessary WARN messages when encountering already soft-deleted blobs. |
Security, Authentication, and Authorization
Security-related updates focus on improving authentication flows, authorization checks, and administrative clarity. Changes include performance improvements for permission evaluation, clearer licensing behavior, more predictable login handling, and better support for LDAP and SAML configurations.
| Issue ID | Description |
|---|---|
| NEXUS-49940 | SAML SSO in the UI now correctly redirects to the identity provider when using a custom context path. |
| NEXUS-49805 | The login screen no longer displays the instructions for resetting the initial admin password after it has already been reset. |
| NEXUS-49718 | UI load times have been improved for users with a large number of assigned privileges by optimizing permission calculation during login. |
| NEXUS-49142 | The login process now uses a dynamic timeout based on UI settings. |
| NEXUS-49041 | LDAP group searches are now capped to a configurable maximum number of results, with a default limit of 1,000 results. |
| NEXUS-46700 | The /beta/system/information API endpoint is only accessible in Nexus Repository Pro. |
| NEXUS-46163 | Repository target privileges migrated from Nexus Repository 2 are correctly transformed and visible in the Roles UI. |
| NEXUS-41229 | Repository content selector privileges can now be created and updated via the REST API using format-specific wildcards like *-maven2. |
| NEXUS-35782 | The Roles REST API now returns all directly contained roles and privileges for SAML-based roles. |
UI, Usability, and API Behavior
This release refines the Nexus Repository user interface and REST APIs to improve usability, accuracy, and consistency. Updates address UI display issues, missing or misleading controls, trimming and validation of user input, and more reliable API responses. These improvements help reduce confusion, prevent common errors, and ensure the UI and APIs reflect the actual system state.
| Issue ID | Description |
|---|---|
| NEXUS-49472 | The UI now allows uploading assets to directory paths that include uppercase letters. |
| NEXUS-49369 | The frontend REST API now returns only active Nexus modules. |
| NEXUS-49226 | Refreshing a task log using the UI refresh icon now correctly loads the log without triggering a 404 error. |
| NEXUS-49156 | The Repositories page now displays the Size column as long as at least one repository format has completed the blob size copy task. |
| NEXUS-45478 | Disabled capabilities can now be edited and saved successfully. |
| NEXUS-44434 | Session timeouts in one browser tab no longer log out other active tabs. |
| NEXUS-44810 | Updating a proxy repository with an invalid remote URL works as expected. |
| NEXUS-46969 | The misleading Upgrade Pending banner no longer appears when enabling high availability and rolling upgrades without any actual upgrade occurring. |
Platform, Deployment, and Operations
Operational and deployment-related improvements focus on stability, configurability, and smoother upgrades. Fixes address Docker and container workflows, Helm and Kubernetes deployments, logging behavior, startup edge cases, and operator behavior. These changes help ensure Nexus Repository runs more reliably across diverse deployment environments and integrates more cleanly into modern infrastructure workflows.
| Issue ID | Description |
|---|---|
| NEXUS-49176 | The H2 to Postgres migration process now fails with a clear error when insufficient temporary disk space is detected, preventing silent partial migrations. |
| NEXUS-48680 | Containerd clients can now successfully push to Docker repositories with path-based routing enabled. |
| NEXUS-47784 | Database migration errors now include full query parameters in the logs. |
| NEXUS-43675 | Temporary files generated during Docker content validation are now properly managed to prevent uncontrolled disk usage. |
| NEXUS-46878 | Removed default memory-related JAVA_OPTS values from the Docker image. |
| NEXUS-46839 | Helm hosted repositories now correctly block redeployment of .prov files when the disable redeploy policy is enabled. |
| NEXUS-45941 | The REST API for creating Maven group repositories now correctly honors the specified versionPolicy. |
| NEXUS-45234 | Repository content selector privileges created via the REST API with the ALL action are now correctly displayed in the UI with all actions selected. |
| NEXUS-31898 | Warnings caused by expected BypassHttpErrorException conditions during Docker proxy operations are now logged at the DEBUG level instead of WARN. |
| NEXUS-25286 | Nexus Repository now starts successfully even if a Docker repository is configured to use the same port as the main application connector. |
| NEXUS-49035 | The Nexus Repository Operator no longer includes the chart version in StatefulSet names, ensuring PersistentVolumeClaims retain consistent names across upgrades and allowing reuse of existing storage. |
| NEXUS-48905 & NEXUS-48839 | Docker Bearer Token authentication now uses the correct token URL when anonymous pull is enabled. |
Known Issues & Upgrade Guidance
This section captures known issues in the 3.88.x line as well as upgrade guidance.
Resolved Known Issues
| Impacted Version(s) | Version in which Issue is Resolved | Description |
|---|---|---|
| 3.83.0 – 3..89.1 | 3.90.0 | There is an issue in Sonatype Nexus Repository 3.83.0 - 3.89.1 where running the Verify and Repair or Data Repair Plan tasks can incorrectly delete valid assets, leading to potential data loss.This issue is fixed in Nexus Repository 3.90.0. Upgrade to version 3.90.0 before running the_Verify and Repair_or Data Repair Plan tasks. |
| 3.88.0 | 3.89.0 | Sonatype is aware of an issue in Sonatype Nexus Repository 3.88.0 where NuGet client search requests fail when the application is running on the embedded H2 database. |