Nexus One UI is now the default experience for all Nexus Repository users, changing how developers, AppSec engineers, and administrators navigate repositories, search content, and manage administration work.
Nexus One is now the default UI
Teams now use Nexus One by default for navigation, searching and browsing content, and repository administration. It adds clearer repository information, streamlined navigation, and system health status in the global header. Users can return to the Classic UI through UI Settings or Switch to Classic UI.
Community Edition has more time to restore telemetry
Community Edition now allows 30 days, rather than 10 days, to restore required telemetry reporting after a failure. Nexus Repository switches to read-only mode after that grace period.
Repository Firewall improves identification and scanning
Repository Firewall improves identification of Python and Java packages, including CVE reporting for Python packages with Red Hat backported security fixes. Detection also expands for Go and APK packages, while scans are more accurate for Red Hat hardened and OpenShift container images. Red Hat UBI scans now identify platform-specific Python variants, removing false positives that needed manual investigation.
Bug fixes
Version 3.98.0 changes audit handling: audit event persistence and the Audit page are off by default and can be enabled with nexus.previewui.audit.enabled=true. Default retention changes from 90 to 30 days. Asset downloads, attribute changes, and proxy metadata refreshes remain in audit.log but are excluded from audit_events.
Other corrections cover NuGet V2 proxy events, package downloads, duplicate uploads, and OData dependency responses; Cargo pubtime; Conda uploads and URL errors; Maven deletion; Docker anonymous-pull enforcement; and npm metadata fields. HA fixes address fsGroup ephemeral logging, cache indexes, node-restart task handling, and ARM64 session timeouts. Data Repair logs add planned-action details, and Conan and Terraform metadata rebuilds work after blob restoration. Metrics endpoints work for service accounts with nx-metrics-all; Malware findings remain active across runs; the nonfunctional Enable Quarantine on All Proxies button is removed. Additional fixes cover Alpine forms, cron validation, repository status displays, group search, staging promotions, Sift logging, and JWT dependencies.
What this means for your team
Developers and AppSec engineers can review repositories in Nexus One and triage Firewall results with improved package and container identification. Teams using affected NuGet, Cargo, Conda, Docker, or HA workflows receive corrected behavior. CISOs and audit managers should account for the revised audit-event defaults, 30-day retention, and audit.log coverage.
Based on the official Sonatype release notes.
How Merito helps
Merito can help teams plan and validate a self-managed move through implementation services.
Merito is an authorized Sonatype reseller and services partner. Our Sonatype Nexus Repository team can scope licensing, sizing, and rollout for 98, and our enterprise upgrade services help you plan and validate the upgrade with minimal disruption to release schedules.