Sonatype release updates

Sonatype IQ Server 207.1, released September 9, 2026, resolves two critical upgrade concerns from version 207: embedded H2 schema incompatibilities that could block policy evaluations and oversized SAML authentication cookies that could prevent SP-initiated SSO logins. It also restores policy evaluation for components with incomplete Maven coordinates and corrects claimed-component package URL reporting. Organizations upgrading from 207 should review Sonatype's known-issues guidance and validate H2, SAML, and policy workflows in a controlled environment before production rollout.

• SBOM
• Open Source Security
• AI

Sonatype Nexus Repository 96 enables Pro customers to redirect Azure Blob Store artifact downloads through short-lived SAS URLs, reducing load on Nexus Repository servers while preserving client workflows through automatic fallback. The release adds persistent audit event storage and an Audit Log page in Nexus One UI, alongside modern UI management for OAuth2, SSL certificates, LDAP, Crowd, users, and roles. It also reduces npm metadata payloads by up to 89% for supported clients and improves chained proxy behavior across OCI, Terraform, Conda, Hugging Face, and other formats.

• Sonatype
• Nexus
• SDLC

Sonatype Nexus Repository 95 adds hosted and group repositories for Composer, plus Chocolatey registry and Microsoft Symbol Server support through NuGet repositories. The release also extends cleanup policies across major package formats, improves private PyPI and Hugging Face client compatibility, supports temporary AWS credentials for ECR proxies, and introduces Firewall Success Metrics reporting. Enterprise teams should assess documented upgrade changes affecting Ansible Galaxy responses, content selectors, search indexes, and Preview UI customizations before deployment.

• Sonatype
• Nexus
• SDLC

Sonatype IQ Server 205.3, released July 31, 2026, improves reliability during LDAP disruptions and sustained failed-login attempts by preventing excessive CPU consumption. The release also ensures SBOM scan artifacts, policy reports, and file descriptors are cleaned up after deletion, reducing avoidable storage consumption. It addresses CVE-2026-54291 affecting PostgreSQL connection security and CVE-2026-49844 affecting Log4j JSON output.

• SBOM
• Open Source Security
• AI

Sonatype Nexus Repository 3.94.0, released July 9, 2026, introduces native OCI hosted, proxy, and group repositories for container images, Helm charts, SBOMs, signatures, and attestations. It adds private Amazon ECR proxy support, PyPI Simple API v1.1 support, and expanded Repository Firewall controls for conda-forge, waivers, webhooks, and repository-scoped reporting. Enterprises should assess Java plugin compatibility, Groovy script changes, and PyPI client behavior before upgrading.

• Sonatype
• Nexus
• SDLC

Learn how Sonatype IQ Server 203.2 improves SBOM governance, Repository Firewall automation, and enterprise DevSecOps workflows.

• IQ Server
• DevSecOps
• SBOM
• QA

Nexus Repository 3.87.x strengthens Java 21, S3 storage, NuGet security, configuration-as-code, and HA reliability, reducing SDLC risk and improving enterprise supply chain governance with Merito guidance.

• Sonatype
• Nexus
• SDLC