Sonatype Nexus Repository 95: Broader package control and measurable supply-chain protection
Sonatype Nexus Repository 95 adds hosted and group repositories for Composer, plus Chocolatey registry and Microsoft Symbol Server support through NuGet repositories. The release also extends cleanup policies across major package formats, improves private PyPI and Hugging Face client compatibility, supports temporary AWS credentials for ECR proxies, and introduces Firewall Success Metrics reporting. Enterprise teams should assess documented upgrade changes affecting Ansible Galaxy responses, content selectors, search indexes, and Preview UI customizations before deployment.
Composer hosted and group repositories in Nexus Repository 95 let release owners govern internal PHP packages and upstream dependencies through defined repository endpoints. That closes a practical control gap for organizations that need PHP artifacts handled under the same access, retention, and audit model as other package formats.
Package ecosystem coverage expands
Release 95 adds native Composer hosted and group repository support. Teams can publish internal Composer packages, combine hosted and proxy sources into a group, and provide developers with a controlled endpoint for PHP dependency consumption.
The NuGet capability set also expands in two important areas:
NuGet hosted, proxy, and group repositories can support Chocolatey registries.
NuGet repositories can store and serve .snupkg symbol packages using the Microsoft Symbol Server Protocol.
Supported debuggers can retrieve Portable PDB files on demand from hosted, proxy, or group repositories.
For release engineering teams, this reduces the number of unmanaged distribution paths for Windows packages and debugging symbols. It also gives repository administrators a clearer basis for setting permissions, retention, and provenance expectations across application packages and their diagnostic assets.
Python and AI dependency workflows gain compatibility
PyPI proxy repositories now support repository-specific URL encoding behavior and preemptive authentication. This matters for private registries that do not return an authentication challenge, including GitLab.com-hosted PyPI repositories, and for repositories using PEP 440 local version identifiers.
August 6, 2026By Chris CarpenterSonatypeNexusSDLC
The change lets teams accommodate exceptional upstream behavior without applying URL encoding changes globally. Existing global settings continue to operate unchanged, so current deployments do not require action.
Hugging Face proxy repositories now support the /tree/ API endpoint and inbound Bearer token authentication used by current huggingface_hub clients. The update restores expected operation for snapshot_download() and hf download workflows in client versions 1.0 and later, including versions that require /tree/ for larger repositories.
These updates are relevant to teams building AI-enabled products under controlled dependency policies. They reduce pressure to bypass approved proxy paths when client behavior changes.
Storage controls become more consistent
The retain-last-N-versions cleanup policy is now available for versioned formats with version semantics, including:
Apt, Docker, Go, Helm, Maven, npm, and NuGet
Pub, PyPI, RubyGems, Swift, and Terraform
Yum
This gives platform teams a more uniform way to limit repository growth in high-volume CI/CD environments. Rather than maintaining format-specific scripts, administrators can define retention intent through repository policy.
Cleanup administration also improves operational control:
Assign one cleanup policy to multiple repositories from the policy configuration.
See repositories associated with a policy in one view.
Preview cleanup behavior across those repositories before changing settings.
Run targeted cleanup through REST APIs, including synchronous dry runs and asynchronous execution with status tracking.
A dry run provides evidence before deletion. That is useful when storage controls must be reviewed by platform owners, application teams, or audit stakeholders.
Firewall reporting supports measurable governance
Repository Firewall adds a Firewall Success Metrics dashboard in Enterprise Reporting. The dashboard brings together component evaluations, quarantines, malicious component detections, waivers, and quarantine response times.
This supports a more useful leadership discussion than blocked-component totals alone. Teams can examine whether policies are identifying meaningful risk, whether quarantine reviews are timely, and whether waiver patterns indicate policy exceptions that need attention.
Security, platform, and engineering leaders can use the reporting to:
Track quarantine and waiver trends over time.
Identify queues that slow developer delivery or risk review.
Tune policies using operational evidence.
Show how repository controls contribute to supply-chain risk management.
For Docker workflows, Firewall download timeout is now configurable through nexus.firewall.container.download.timeout.minutes, up to 240 minutes. This helps maintain evaluation coverage where legitimate network inspection or large image layers exceed the prior fixed ten-minute limit.
Cloud authentication and administrator workflows improve
Amazon ECR proxy repositories now accept temporary AWS credentials through an optional session token. Teams using AWS STS or IAM Identity Center can configure short-lived credentials without reverting to long-lived access keys. Existing access-key configurations remain supported.
The Nexus One UI completes task-management support. Administrators can configure, schedule, run, monitor, and manage supported tasks without moving to the legacy interface. Existing task definitions remain synchronized between interfaces, which supports staged adoption rather than a forced workflow change.
The release also includes accessibility, navigation, search, dashboard, browsing, and user-management refinements. These changes matter because administration work is often performed during incident response, maintenance windows, and audit preparation, when interface consistency can reduce avoidable errors.
Reliability fixes address delivery friction
Several fixes improve common enterprise delivery paths:
Cosign signing and attestations against Docker hosted repositories complete faster when manifest counts are high.
Terraform hosted repositories support valid .tgz, .tbz2, and .txz module archives.
Terraform proxies can use preemptive authentication with upstream Nexus instances.
PyPI groups provide authoritative index entries that support consistent pip hash verification.
External-realm users with large role sets avoid repeated role-to-permission resolution during login.
High-availability nodes retain Firewall enforcement after zero-downtime upgrades.
The release also improves resilience for Azure Blob Storage and Google Cloud Storage operations, reduces unnecessary PyPI index downloads and blob writes, and moves an upgrade migration check to a background task after startup. These are operational details, but they can reduce delivery delays and maintenance risk at scale.
Upgrade decisions require targeted validation
Release 95 includes changes that should be tested in a non-production environment before rollout.
Content selectors: Mixed and/or expressions without parentheses must be rewritten with explicit parentheses.
Search visibility: Repositories that rely solely on Repository Content Selector privileges require a repository search-index rebuild after upgrade.
Ansible Galaxy automation: Duplicate collection publishing to a write-once hosted repository now returns HTTP 409 with a Galaxy-compatible body, rather than HTTP 400.
Preview UI customization: Customizations that reference earlier Firewall endpoint constants may require updates because the Firewall column now reflects actual proxy protection state.
Create an upgrade runbook that inventories selectors, API consumers, CI publishing logic, and UI extensions. Test rollback assumptions too; upgrade readiness is not only a version check.
How Merito helps
Merito helps enterprise teams plan and govern Nexus Repository 95 adoption across repository architecture, identity, cleanup controls, Firewall policy, reporting, and upgrade validation.
Our practitioners can assess existing repository usage, identify affected automations and permissions, build a tested upgrade plan, and define operational measures for storage, quarantine handling, and policy exceptions. The goal is a controlled release with clear ownership after go-live.
Merito is a Sonatype partner. Our Sonatype Nexus Repository team can scope licensing, sizing, and rollout for 95, and our enterprise upgrade services help you plan and validate the upgrade with minimal disruption to release schedules.
Version 95 adds Composer hosted and group repositories, completing native Composer support beyond proxying. It also extends NuGet repositories to work with Chocolatey registries and .snupkg symbol packages through the Microsoft Symbol Server Protocol. Merito can help define repository topology, access controls, retention policies, and developer migration guidance across these ecosystems.
Review the documented breaking changes before production rollout. Mixed and/or content selector expressions now need explicit parentheses, repositories using only Repository Content Selector privileges require a search-index rebuild after upgrade, and Ansible Galaxy duplicate-publish handling changes from HTTP 400 to HTTP 409. Teams with Preview UI Firewall customizations should also review endpoint constant references.
The retain-last-N-versions cleanup capability is now available across Apt, Docker, Go, Helm, Maven, npm, NuGet, PyPI, Terraform, and other versioned formats. Administrators can assign one cleanup policy to multiple repositories, preview its effect, and execute targeted cleanup through REST APIs with dry-run counts and status tracking. Merito can help establish retention standards that balance audit needs, recovery requirements, and blob-storage cost.
The new Enterprise Reporting dashboard tracks component evaluations, quarantines, malicious component detections, waivers, and quarantine response times. Security and engineering leaders can use these measures to assess policy outcomes, identify review bottlenecks, and monitor whether waiver use is increasing exposure. Merito can help define reporting ownership, thresholds, review cadences, and evidence suitable for risk and audit discussions.
Yes. Amazon ECR proxy repositories now accept temporary AWS credentials, including session tokens issued through AWS STS and IAM Identity Center. Hugging Face proxies now support current huggingface_hub client workflows, including the /tree/ endpoint and Bearer token authentication, which supports snapshot_download() and hf download usage in newer clients. Merito can assess credential handling, proxy configuration, and policy controls for these workflows.
Keep Reading
Related Product Release Updates
Explore a few more Merito release updates that align with the themes in this article.
