Native OCI hosted, proxy, and group repositories in Nexus Repository 94 give release owners one controlled distribution point for container images, Helm charts, SBOMs, signatures, and attestations. That matters when release evidence and deployable artifacts are spread across separate registries with different access, retention, and audit controls.
Released July 9, 2026, Nexus Repository 3.94.0 expands repository format coverage while adding practical Repository Firewall governance controls. The release also carries several upgrade items that platform teams should assess before production rollout.
Consolidate OCI artifact management
OCI is now a native Nexus Repository format for hosted, proxy, and group repositories. Teams can proxy external OCI registries, publish internally produced artifacts, and present several repositories through a single endpoint.
This supports standard OCI-compatible tools, including:
- Docker and Podman
- Helm and ORAS
- Cosign and Syft
- Crane and Skopeo
For enterprise delivery organizations, the value is broader than image storage. OCI can become a common distribution model for artifacts that need to travel with a release: images, charts, software bills of materials, signatures, and attestations. Centralizing those artifacts improves traceability between build outputs, release approvals, and deployment inputs.
Architecture teams should define which artifact classes belong in OCI repositories, who may publish them, and how group repositories will be exposed to developers and pipelines. Especially for distributed platform teams.
Proxy private Amazon ECR registries through Docker repositories
Nexus Repository 94 can proxy private Amazon Elastic Container Registry registries through Docker proxy repositories. Administrators configure the ECR registry URL and AWS IAM credentials; Nexus retrieves and caches the ECR authorization token when an image is first pulled.
This gives CI/CD environments a consistent internal registry endpoint while reducing repeated authorization calls to ECR. It can also reduce external transfer costs when frequently used images are cached locally.
The implementation should be governed as an AWS identity and network design decision, not only a repository configuration task:
- Apply least-privilege IAM permissions to ECR access credentials.
- Separate production, non-production, and third-party image sources where policy requires it.
- Define cache behavior and availability expectations for critical build images.
- Audit which pipelines and teams can consume private upstream content.
Improve Python and infrastructure dependency workflows
PyPI repositories now support Simple API v1.1 under PEP 700, supplying richer metadata to modern clients such as pip and uv. Clients can use package size, upload time, and version information to make better dependency-resolution decisions, reducing requests and installation time.
Backward compatibility remains for legacy PEP 503 HTML behavior. However, modern tools including pip 23+, uv, and Poetry 2.x may automatically receive PEP 691/700 JSON responses after upgrade. Teams with custom package installers, dependency scanners, or parsing scripts should test them before deployment.
Release 94 also advances other engineering ecosystems:
- New Conan proxy repositories default to Protocol Version V2.
- Terraform proxies support additional compliant registries, including OpenTofu and registry.coder.com.
- Raw proxy URL encoding behavior is controlled at repository level through the Preserve Encoded Characters setting.
- PyPI group and nested group metadata behavior has been corrected to reduce manual cache invalidation.
These changes reduce friction, but they also change assumptions embedded in scripts and internal tooling. Treat compatibility validation as part of the release gate.
Bring Firewall exceptions into an accountable workflow
Repository Firewall adds an in-product waiver workflow for requesting, reviewing, approving, rejecting, renewing, and monitoring policy exceptions. Developers can initiate requests from a policy violation, and administrators manage the full exception lifecycle through a centralized Waivers dashboard.
This is important for governance because exceptions are often the weakest point in software supply-chain policy. Informal approvals in chat, email, or tickets are difficult to audit and easy to leave active beyond their intended date.
New expiration notifications allow administrators to configure several reminder thresholds and notify individuals or role-based groups. The operational outcome is fewer surprise quarantines caused by expired exceptions, with clearer accountability for renewal or removal decisions.
Firewall webhooks now include Violation Alert and Waiver Request events. Organizations can route these into ticketing systems, security operations workflows, or engineering collaboration channels. The goal should be defined response ownership, not simply more notifications.
Expand supply-chain visibility and access control
Repository Firewall now supports conda-forge as an upstream for conda proxy repositories. Organizations using the widely adopted community conda channel can apply the same policy evaluation and quarantine controls used for other supported ecosystems before components reach development environments.
Enterprise Reporting also gains the Malware Threat Landscape dashboard. It combines ecosystem-wide malware trends with Firewall prevention activity and supports filtering by ecosystem, threat type, attack vector, and time period.
For security leaders, this creates better evidence for risk discussions:
- Track malware activity affecting relevant package ecosystems.
- Compare external threat trends with internal prevention activity.
- Identify where policy and developer guidance need attention.
- Report Firewall value using operational data rather than anecdotes.
Repository-scoped Firewall dashboard access further supports delegated operations. Users with read access to a proxy repository can view only the Firewall data for repositories they are authorized to see, allowing product teams to monitor their exposure without revealing organization-wide repository activity.
Strengthen platform and credential controls
Nexus Repository 94 moves underlying servlet infrastructure to Java EE 10 and updates key components such as Jetty, RESTEasy, and OpenAPI support. This improves alignment with current Java platform standards, but custom plugins, integrations, and tooling using javax.servlet must migrate to jakarta.servlet before upgrade.
The release also immediately invalidates all active user sessions after a password change. This reduces the window in which an existing browser or device session can remain active after credentials are reset.
New NuGet, npm, Docker, and Conan API keys use UUID v4 generation for stronger randomness and uniqueness. Existing keys continue to work, but Sonatype recommends regeneration. Security teams should plan key rotation carefully, identify pipeline dependencies, and retain evidence of credential replacement.
A related logging fix redacts common sensitive authentication headers at write time, reducing the risk that support ZIP files contain plaintext credentials. That is a meaningful improvement for incident handling and vendor-support processes.
Plan the upgrade as a controlled change
Several release items need targeted validation:
- Migrate custom
javax.servletextensions tojakarta.servlet. - Test Groovy scripts under Groovy 5.0.6; stricter sandbox rules can block indirect imports.
- Validate custom Python tooling against modern JSON Simple API responses.
- Regenerate hosted Yum repository metadata when source RPMs were uploaded before the fix.
- Review raw proxy repositories using Preserve Encoded Characters, because URI normalization behavior is now controlled by that setting.
- Note the 3.94.0 NuGet proxy UI issue: the optional Symbol Server URL field is visible but not functional.
Looking ahead, Groovy scripting reaches end of life in December 2026. Organizations still relying on scripts should move automation to supported UI and REST API capabilities. Before the expected 3.95.0 release, rename blob stores that contain HTML special characters to avoid an upgrade blocker.
How Merito helps
Merito helps enterprise teams turn Nexus Repository upgrades into governed delivery improvements. We assess plugin and automation compatibility, design OCI and ECR repository patterns, define Firewall waiver controls, and validate CI/CD behavior through a staged rollout.
Our work focuses on decisions that hold up under audit: repository ownership, access boundaries, credential rotation, policy exception evidence, and measurable release-readiness criteria.
Merito is an authorized Sonatype reseller and services partner. Our Sonatype Nexus Repository team can scope licensing, sizing, and rollout for 94, and our enterprise upgrade services help you plan and validate the upgrade with minimal disruption to release schedules.