<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="4">
<package pkgid="5e61bcc696d3c2a00865cea0c3cf393fb202bdbc3b90370da623cb2ecccd1988" name="nexus" arch="src">
  <version epoch="0" ver="2.14.21.02" rel="1.el8.3"/>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.5.02-1" date="1514462400">- Start using Fedora/RHEL release conventions
- Fix problems on RPM removals
- Require Java 1.8.0
- Fix source
- Make the package compatible with SUSE and openSUSE</changelog>
  <changelog author="Anton Patsev &lt;patsev.anton@gmail.com&gt; - 2.14.5.02-2" date="1514635200">- Stop requiring sysvinit compatibility for systemd
- Add systemd service</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.6.02-1" date="1520683200">- Update to 2.14.6-02</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.7.01-1" date="1520683201">- Update to 2.14.7-01
- Compatibility with Java 1.7.0 is restored</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.8.01-1" date="1520683202">- Update to 2.14.8-01</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.9.01-1" date="1542974400">- Update to 2.14.9-01</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.10.01-1" date="1542974401">- Update to 2.14.10-01</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.11.01-1" date="1542974402">- Update to 2.14.11-01
- Require Java 1.8.0</changelog>
  <changelog author="Julio Gonzalez &lt;packages@juliogonzalez.es&gt; - 2.14.11.01-2" date="1548504000">- Do not replace modified config files</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.12.02-1" date="1552392000">- Update to 2.14.12-02</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.13.01-1" date="1556280000">- Update to 2.14.13-01</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.14.01-1" date="1565956800">- Update to 2.14.14-01</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.15.01-1" date="1571313600">- Update to 2.14.15-01
- Bugfixes:
  * NEXUS-21044: CVE-2019-15893: Remote Code Execution vulnerability
  * NEXUS-21193: CVE-2019-16530: Remote Code Execution vulnerability
  * NEXUS-20626: CVE-2019-5475: OS Command Injection vulnerability (second part to the fix in 2.14.14)
  * NEXUS-21512: Update Apache Tika and Commons Compress libraries to resolve security vulnerabilities</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.16.01-1" date="1580126400">- License for Nexus OSS is EPL-2.0 as stated at https://blog.sonatype.com/2012/06/nexus-oss-switched-to-the-eclipse-public-license-a-clarification-and-an-observation/
  and it is since 2012. Mistake inherited from the original packages from Jens Braeuer.
- Update to 2.14.16-01
- Bugfixes:
  * NEXUS-22014: CVE-2019-15893: Remote Code Execution vulnerability
  * NEXUS-22453: Update Apache Shiro library to resolve security vulnerability
  * NEXUS-22313: Invalid content-range header returned
  * NEXUS-13306: usernames containing non URL safe characters cannot authenticate using the Crowd realm</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.16.01-2" date="1582891200">- Clean up spec and fix to build all distributions at OpenBuildService
- Enable building and installation for Amazon Linux &gt;= 2
- Enable building and installation for for openSUSE Tumbleweed/Factory</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.17.01-1" date="1587124800">- Update to 2.14.17-01
- Bugfixes:
  * NEXUS-23556: CVE-2020-11415: LDAP system credentials can be exposed by admin user</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.18.01-1" date="1601640000">- Update to 2.14.18-01
- Bugfixes:
  * NEXUS-21802: Maven metadata sha256/sha512 checksum in staging repositories</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.19.01-1" date="1601640001">- Update to 2.14.19-01
- Bugfixes:
  * Minor security fixes.</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.20-02-1" date="1609848000">- Update to 2.14.20-02
- Bugfixes:
  * NEXUS-26224: CVE-2020-13920: Apache ActiveMQ JMX is vulnerable to a MITM attack
  * NEXUS-25956: Signatures with ECC algorithm not being recognized</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.21-02-1" date="1639828800">- Update to 2.14.21-02
- Bugfixes:
  * logback library update to fix a low/moderate vulnerability, as a precautionary
    measure. No known exploit of Nexus Repository via logback at this time.</changelog>
</package>
<package pkgid="040df04bb975f5f1e688601c747e7c9a58aa4c1ab1c765d696acfd477c738948" name="nexus" arch="x86_64">
  <version epoch="0" ver="2.14.21.02" rel="1.el8.3"/>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.5.02-1" date="1514462400">- Start using Fedora/RHEL release conventions
- Fix problems on RPM removals
- Require Java 1.8.0
- Fix source
- Make the package compatible with SUSE and openSUSE</changelog>
  <changelog author="Anton Patsev &lt;patsev.anton@gmail.com&gt; - 2.14.5.02-2" date="1514635200">- Stop requiring sysvinit compatibility for systemd
- Add systemd service</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.6.02-1" date="1520683200">- Update to 2.14.6-02</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.7.01-1" date="1520683201">- Update to 2.14.7-01
- Compatibility with Java 1.7.0 is restored</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.8.01-1" date="1520683202">- Update to 2.14.8-01</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.9.01-1" date="1542974400">- Update to 2.14.9-01</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.10.01-1" date="1542974401">- Update to 2.14.10-01</changelog>
  <changelog author="Julio Gonzalez &lt;git@juliogonzalez.es&gt; - 2.14.11.01-1" date="1542974402">- Update to 2.14.11-01
- Require Java 1.8.0</changelog>
  <changelog author="Julio Gonzalez &lt;packages@juliogonzalez.es&gt; - 2.14.11.01-2" date="1548504000">- Do not replace modified config files</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.12.02-1" date="1552392000">- Update to 2.14.12-02</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.13.01-1" date="1556280000">- Update to 2.14.13-01</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.14.01-1" date="1565956800">- Update to 2.14.14-01</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.15.01-1" date="1571313600">- Update to 2.14.15-01
- Bugfixes:
  * NEXUS-21044: CVE-2019-15893: Remote Code Execution vulnerability
  * NEXUS-21193: CVE-2019-16530: Remote Code Execution vulnerability
  * NEXUS-20626: CVE-2019-5475: OS Command Injection vulnerability (second part to the fix in 2.14.14)
  * NEXUS-21512: Update Apache Tika and Commons Compress libraries to resolve security vulnerabilities</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.16.01-1" date="1580126400">- License for Nexus OSS is EPL-2.0 as stated at https://blog.sonatype.com/2012/06/nexus-oss-switched-to-the-eclipse-public-license-a-clarification-and-an-observation/
  and it is since 2012. Mistake inherited from the original packages from Jens Braeuer.
- Update to 2.14.16-01
- Bugfixes:
  * NEXUS-22014: CVE-2019-15893: Remote Code Execution vulnerability
  * NEXUS-22453: Update Apache Shiro library to resolve security vulnerability
  * NEXUS-22313: Invalid content-range header returned
  * NEXUS-13306: usernames containing non URL safe characters cannot authenticate using the Crowd realm</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.16.01-2" date="1582891200">- Clean up spec and fix to build all distributions at OpenBuildService
- Enable building and installation for Amazon Linux &gt;= 2
- Enable building and installation for for openSUSE Tumbleweed/Factory</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.17.01-1" date="1587124800">- Update to 2.14.17-01
- Bugfixes:
  * NEXUS-23556: CVE-2020-11415: LDAP system credentials can be exposed by admin user</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.18.01-1" date="1601640000">- Update to 2.14.18-01
- Bugfixes:
  * NEXUS-21802: Maven metadata sha256/sha512 checksum in staging repositories</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.19.01-1" date="1601640001">- Update to 2.14.19-01
- Bugfixes:
  * Minor security fixes.</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.20-02-1" date="1609848000">- Update to 2.14.20-02
- Bugfixes:
  * NEXUS-26224: CVE-2020-13920: Apache ActiveMQ JMX is vulnerable to a MITM attack
  * NEXUS-25956: Signatures with ECC algorithm not being recognized</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.21-02-1" date="1639828800">- Update to 2.14.21-02
- Bugfixes:
  * logback library update to fix a low/moderate vulnerability, as a precautionary
    measure. No known exploit of Nexus Repository via logback at this time.</changelog>
</package>
<package pkgid="7b5c2a3bdb713c887e114645cc97bb73302cd540b4531aeeded56e37c0db1147" name="nexus3" arch="src">
  <version epoch="0" ver="3.38.0.01" rel="1.el8.1"/>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.28.1.01-1" date="1603886400">- Update to Nexus 3.28.1-01
- Bugfixes:
  * NEXUS-25507: Fixed an issue that caused the Change repository blob store task
                 to spawn too many threads.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.0.02-1" date="1607169600">- Update to Nexus 3.29.0-02
- Bugfixes:
  * NEXUS-16575: Raw repo url returns Error 404
  * NEXUS-19840: /service/metrics/healthcheck returns 500 status code if
                 a single healthcheck fails. It is deprecated now and
                 scheduled for removal.  It is recommended to use the
                 alternative endpoint /service/rest/v1/status/check which has a
                 near equivalent JSON response, except it does not return 500
                 status when one or more system status checks fail
  * NEXUS-23733: Creating more than one file based blobstore using the same
                 root path is not prevented
  * NEXUS-23827: PACKAGES.gz cannot be updated if repository doesn't allow
                 redeploy
  * NEXUS-24331: deployment of rpm to a single directory causes metadata
                 rebuild for entire repository
  * NEXUS-24913: npm audit caching prevents policy updates
  * NEXUS-25105: HTTP 500 response when attempting to delete LDAP user via
                 REST API
  * NEXUS-25116: Getting Metadata hashes via a Maven group returns 404
                 Not found
  * NEXUS-25147: Rebuild metadata task leaves sha256 and sha512 files untouched
                 for metadata files
  * NEXUS-25158: HeaderPatternFilter may reject implicit Host value due to
                 certain combinations of X-Forwarded headers
  * NEXUS-25186: possible that requests abruptly terminating will not appear in
                 request.log
  * NEXUS-25291: NuGet V3 Proxy can be configured only using a specific remote
                 in UI field
  * NEXUS-25292: Bad blob file reference breaks repository export
  * NEXUS-25304: Health check details can fail with NPE if IQ server is setup
                 but disabled
  * NEXUS-25357: NuGet Proxy does not work with some third-party V3
                 repositories
  * NEXUS-25420: NXRM to NXRM Nuget v3 proxying still results in direct
                 requests to nuget.org
  * NEXUS-25464: Blob reference not updated in asset after change repository
  * NEXUS-25478: Nuget V3 Group packages incorrectly sorted in page causing
                 some installs to fail
  * NEXUS-25502: yum metadata is rebuilt after downloading it which can cause
                 build failures
  * NEXUS-25510: Error Response Code 429 (Rate Limiting) does not autoblock
  * NEXUS-25521: Encoded proxy URL causes startup failure
  * NEXUS-25527: Crowd "Verify connection" button deletes all inputted values
  * NEXUS-25529: Security management: Users API does not show "externalRoles"
                 for Crowd
  * NEXUS-25575: Password Validator Message not shown when changing your
                 password.
  * NEXUS-25604: Some newly deployed rpm files not showing up in
                 primary.xml.gz, despite logging saying they are being added
  * NEXUS-25605: Proxy repositories to github package registry can fail query
                 requests when accessed in a group repository
  * NEXUS-25609: Exception processing payloads for a single NuGet group member
                 repository can stop all group member processing
  * NEXUS-25628: yum metadata missing provides entries when multiple versions
                 are provided by a package
  * NEXUS-25650: Nexus-3-0 Develop Violations - 10/29/20 12:15 AM
  * NEXUS-25775: WARN messages WebResourceServiceImpl - Overlapping resources
                 on path /static/img/sonatype-logo-with-hexagon.png
  * NEXUS-25829: CVE-2020-29436: Fixes an XXE Vulnerability
  * NEXUS-25830: ClassCastException Long cannot be cast to Date for NuGet v3
                 registrations index
  * NEXUS-25928: Nexus-3-0 Develop Violations - 11/19/20 12:14 AM
- Improvements:
  * NEXUS-14631: Add more attributes to REST resource for asset
  * NEXUS-19021: Nothing is logged at default levels when roles are added or
                 removed
  * NEXUS-20267: only allow the most secure cipher suites and TLS protocol
                 versions for inbound HTTPS connections by default. See also
                 NEXUS-25786 below.
  * NEXUS-25307: Protect against deletion of related blob stores while the
                 Change Repo Blob Store task is executing
  * NEXUS-23331: Add the support of helm push plugin
  * NEXUS-25423: Add caching of catalog dates for npm component queries to IQ
  * NEXUS-25424: Add configuration for Orient's "network.binary.maxLength"
  * NEXUS-25506: change the Remote URL of the default nuget.org-proxy proxy
                 repository to api version 3 compatible https://api.nuget.org/v3/index.json.
                 Applies only to new installations. Upgrading will not modify
                 any existing remote URLs, although users are encouraged to
                 start migrating away from using NuGet V2 API URLs such as the
                 previous default (https://www.nuget.org/api/v2/).
  * NEXUS-25774: upgrade Eclipse Jetty to 9.4.33.v20201020
  * NEXUS-25786: explicitly disable TLS 1.0 and 1.1 for inbound HTTPS
                 connections by default. Only applies to Eclipse Jetty-based
                 direct inbound HTTPS connections (no reverse proxy).
                 You are encouraged to use the new settings, but if for some
                 reason you still the new TLS versions or cipher suites, check
                 https://support.sonatype.com/hc/en-us/articles/213465098</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.1.01-1" date="1608897600">- Update to Nexus 3.29.1-01
- Bugfixes:
  * NEXUS-24391: 'Destination already contains component' error when using
                 staging API
  * NEXUS-25504: Unable to pull images from hosted docker repo after move to
                 new blobstore
  * NEXUS-25600: Repository Import Ignores Validation
  * NEXUS-25611: Installing via helm proxy errors if not using official remote
  * NEXUS-25801: Group repository registration API requests may fail
  * NEXUS-25902: Source blob store is not logged in repository move task
  * NEXUS-25903: Repository blob store set incorrectly after error in "admin -
                 change repository blob store" task
  * NEXUS-25936: npm audit fails with 500 response using group and anonymous</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.2.02-1" date="1610107200">- Update to Nexus 3.29.2-02
- Bugfixes:
  * NEXUS-26251: Interface for Cleanup Policies erroneously interprets and
                 persists values as seconds instead of days. If you installed
                 3.29.1 and modified or created a cleanup policy you must
                 confirm that these fields have the intended values.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.30.0.01-1" date="1614945600">- Update to Nexus 3.30.0-01
- Bugfixes:
  * NEXUS-12022: Allow configuring HTTPS Maven proxy repositories with
                 pre-emptive authentication
  * NEXUS-18610: Raw proxy errors on URL encoded space and plus (+) characters
  * NEXUS-19181: staging NullPointerException when moving docker assets via
                 DockerComponentDirector.maybeCopyAssets
  * NEXUS-23750: Does not support npm GitHub Package Registry
  * NEXUS-24485: Docker Manifest generation is incorrect for Redeploy Disabled
                 repositories.
  * NEXUS-25148: Incremental yum rebuilds with only COMPS files are ignored
  * NEXUS-25501: Logout with anonymous off fires JS error, can malform page
  * NEXUS-25626: Docker redeploy on the latest tag fails when more than one tag
                 exists for the image
  * NEXUS-25733: NuGet v3 repository index.json generation
  * NEXUS-25783: Browse of NuGet packages from visual studio fails if user
                 doesn't have browse privileges to all group members
  * NEXUS-25784: Browse request to NuGet v3 search URL in group fails
                 completely if one of the group's members has DNS lookup
                 failure
  * NEXUS-25868: Podman push of new image tag fails when docker cli push
                 succeeds for the same actions
  * NEXUS-25904: The "admin - change repository blob store" task should not
                 allow selection of a promoted blob store
  * NEXUS-25908: nuget restore does not resolve inbound normalized package
                 versions to unnormalized published versions using NuGet v3
  * NEXUS-25924: If the remote of a NuGet v3 proxy is not reachable it breaks
                 requests to a NuGet group
  * NEXUS-25985: "Docker - Delete unused manifests and images" task deletes
                 digest manifests referenced by other manifests
  * NEXUS-26003: Helm proxy : difference between helm index file and real
                 artifact url
  * NEXUS-26036: wrong issuer displayed for trusted SSL certificates
  * NEXUS-26093: Create proxy repository in API UI fails due to password
                 missing from Authentication JSON
  * NEXUS-26099: No way to set "useTrustStore" in proxy repository REST API
  * NEXUS-26118: pip search does not work *via* NXRM PyPI proxy to NXRM PyPI
                 repository and authentication is required
  * NEXUS-26129: Promoting a nested blob store causes it to be removed entirely
  * NEXUS-26132: upgrade of NXRM 2 to NXRM 3 maven assets fails due to
                 IllegalStateException: Missing {attributes:checksum} sha256
  * NEXUS-26315: Cleanup Policy List shows Error 500 after Upgrade 3.28.0
                 to 3.29.2
  * NEXUS-26355: sha512 or sha256 hashes are processed by expensive repository
                 content validation
  * NEXUS-26379: DockerFacetUtils.findAssetByContentDigest() causes poor
                 performance under load
  * NEXUS-26453: saving the s3 blobstore config can break async tmp blob
                deletes by not restarting the async delete thread pool
  * NEXUS-26473: Thread cooperation does not work when recovering from missing
                 blobs in proxy repositories
  * NEXUS-26483: Nexus UI causes Uncaught TypeError when the username contains
                 'api' string with privilege 'nx-api-reader'
  * NEXUS-26504: Newly created compact blob store task has "multinode=true"
  * NEXUS-26605: Rebuild metadata fails to rebuild corrupt metadata files
  * NEXUS-26611: conda proxy repositories do not support inbound conditional
                 HTTP GET HEAD
  * NEXUS-26676: IllegalOperationException: Repair - Rebuild Maven repository
                 metadata
- Improvements:
  * NEXUS-24446: Add Azure Blob Storage support to NXRM blob store
  * NEXUS-25275: improve docker repository human readable error response
                 messages
  * NEXUS-25623: Provide a different status than Quarantined for components
                 Pending Quarantine
  * NEXUS-25909: Protect inbound HTTPS connections against Weak Diffie-Hellman
                 Keys and Logjam by default
  * NEXUS-26196: Allow enabling truststore with Repository Management REST API
  * NEXUS-26319: remove reference to sonatype-public-grid from pom files
  * NEXUS-26606: Upgrade Eclipse Jetty to 9.4.38.v20210224</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.30.1.01-1" date="1619179200">- Update to Nexus 3.30.1-01
- Bugfixes:
  * Security fix for CVE-2021-30635 (Information Disclosure).
    See https://support.sonatype.com/hc/en-us/articles/1500006879561 for
    details.
  * Security fix for CVE-2021-29159 (XSS vulnerability).
    See https://support.sonatype.com/hc/en-us/articles/1500005031082 for
    details.
  * Security fix for CVE-2021-29158 (Sensitive Information Disclosure).
    See https://support.sonatype.com/hc/en-us/articles/1500006126462 for
    details.
  * NEXUS-27384: Upgrade Eclipse Jetty to 9.4.40.v20210413
  * NEXUS-26789: Performance improvement to rebuilding GA maven-metadata.xml
  * NEXUS-26501: Package content is out of specification when downloading from NuGet hosted
  * NEXUS-27013: Raw proxy is encoding slashes for outbound requests
  * NEXUS-26855: Non-indexed raw proxy repositories cannot be browsed</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.31.0.01-1" date="1623931200">- Update to Nexus 3.31.0-01
- Bugfixes:
  * NEXUS-26177: Deleting an npm repository or invalidating the cache breaks
                 npm audit.
  * NEXUS-26312: "Last downloaded" not updating consistently in NuGet.
  * NEXUS-26358: WARN messages from SupportRestorer Can't find file to
                 restore data
  * NEXUS-27614: PyPI can swallow errors when the simple index is being
                 re-written.
  * NEXUS-26683: "Remove a member from a blob store group" task can't remove a
                 blob store if one bytes file is missing
  * NEXUS-26732: Race Condition in Docker format can cause assets to be
                 mistakenly deleted.
  * NEXUS-26737: Deleting manifest with Docker API does not delete all tags.
  * NEXUS-26829: Copy and config links incorrect for nuget V3 proxy repos
  * NEXUS-26845: HTTP error status code not logged on proxy repository
                automatic blocking
  * NEXUS-26938: Use HEAD request to determine whether remote content has changed
                 instead of conditional GET to avoid hitting DockerHub rate
                 limit prematurely.
  * NEXUS-26971: Incorrect results can be returned when using npm show with
                 group repositories.
  * NEXUS-27014: Cleanup policies and tasks do not fully consider Docker layers
                 can be referenced by manifests in other repositories.
  * NEXUS-27015: IllegalArgumentException on Publish Maven Index task.
  * NEXUS-27130: GA maven-metadata.xml fails to refresh if a GAV is deleted via
                 Browse's "Delete Folder" button
  * NEXUS-27182: Blob paths traversal
  * NEXUS-27427: Blank values for NuGet attributes.
  * NEXUS-27436: npm metadata rebuild failing due to NPE.
  * NEXUS-27563: S3 connection pool exhaustion when merging repomd.xml in group
                 repositories.
  * NEXUS-27564: Yum Group repomd.xml merge connection pool exhaustion causes
                 problems.
- Improvements:
  * NEXUS-20252: Support Staging with PyPI format.
  * NEXUS-23959: Define BlobStoreApiSoftQuota type allowableValues
  * NEXUS-24311: Added hardlinks to import/export.
  * NEXUS-26617: Upgrade karaf to 4.3.0
  * NEXUS-26931: Added UI validation to ensure container name is all lower case
                 alphanumeric.
  * NEXUS-27597: Add ability to run `Repair - Reconcile component database from
                 blob store` against a subset by time
  * NEXUS-27683: StorageFacetCleanupTaskManager should remove &amp; schedule task.
  * NEXUS-27953: Upgrade Eclipse Jetty to 9.4.42.v20210604.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.31.1.01-1" date="1624622400">- Update to Nexus 3.31.1-01
- Bugfixes:
  * CVE-2021-34553: Information disclosure vulnerability fixed. Sonatype Nexus
                    Repository 3 up to 3.31.0 allows a remote authenticated
                    attacker to get a list of blob files and read the content
                    of a blob file (via a crafted GET request) without having
                    been granted access.
  * NEXUS-28078: Docker - Delete unused manifests and images task may delete
                 referenced layers if the database query to select components
                 encounters limits</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.32.0.03-1" date="1625832000">- Update to Nexus 3.32.0-03
- Bugfixes:
  * NEXUS-27469: Using AzureBlobStore causes docker image upload failure with
                 'digest invalid' error
  * NEXUS-27617: Unable to configure SAML on docker image due to bug in
                 included OpenJDK
  * NEXUS-27753: The latest package version doesn't change in package root
                 after component deleting
  * NEXUS-28247: Docker GC Task incorrectly removing manifests and layers
- Improvements:
  * NEXUS-28203: Replication (Product Preview, PRO only)
  * NEXUS-28205: APT Format support in PostgreSQL</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.33.0.01-1" date="1628164800">- Update to Nexus 3.33.0-01
- Bugfixes:
  * NEXUS-27428: redundant download count attribute for NuGet v3
  * NEXUS-28277: Fetching group npm package metadata concurrently can cause
                 OConcurrentModificationException
  * NEXUS-28362: slow request processing due to group trying to locate blobs in
                 the wrong blobstore
  * NEXUS-28381: Webhook ConnectionPoolTimeoutException: Timeout waiting for
                 connection from pool after sending 20 requests
  * NEXUS-28442: XSS injection
- Improvements:
  * NEXUS-28543: Conda Format support in Postgres (PRO only)
  * NEXUS-28544: Git LFS Format support in Postgres (PRO only
  * NEXUS-28545: R Format support in Postgres (PRO only
  * NEXUS-28561: Conan Format support in Postgres (PRO only
  * NEXUS-28562: npm format support in Postgres (PRO only
  * Improvements to Resilient Nexus Repository Deployment Architecture</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.33.1.01-1" date="1630670400">- Update to Nexus 3.33.1-01
- Bugfixes:
  * NEXUS-28081: Nexus 2 migration to Nexus 3 fails due to permissions of
                 unsupported formats on PostgreSQL databases
- Improvements:
  * Updated Eclipse Jetty Version to 9.4.43.v20210629
  * Changes to Cloud Resiliency Architecture Example: remove the dependency on
    Amazon Elastic File System (EFS). The improved example provides new YAML
    files to help you set up Fluent Bit and CloudWatch in order to externalize
    your logs. This will allow you to capture comprehensive logs even if Nexus
    Repository runs on separate nodes within the same day.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.34.0.01-1" date="1630843200">- Update to Nexus 3.34.0-01
- Bugfixes:
  * NEXUS-27932: "Manifest invalid" message when running the Docker GC task.
  * NEXUS-28394: Last downloaded field not properly updating when installing
                 or downloading through R proxy
  * NEXUS-28458: logged ERROR LastShutdownTimeServiceImpl 'Failed to process
                 file - Assuming no previous start time' on startup
  * NEXUS-28620: Nexus Database Migrator fails when symlink is used for data
                 directory or data directory not in standard location
  * NEXUS-28807: Nexus-3-0 Stage-release Violations - 08/27/21 12:19 AM
  * NEXUS-28808: Policy violation of com.thoughtworks.xstream : xstream: 1.4.17
  * NEXUS-28853: This release includes a security fix for an HTTP header
                 injection. See the CVE-2021-40143 advisory for full details.
                 If you are using an earlier version, you should upgrade to
                 this release immediately
- Improvements:
  * NEXUS-28266: make S3 Connection Time to Live (TTL) setting configurable to
                 help avoid socket connect timeouts
  * Repository Replication (PRO only)
  * NEXUS-28780: New Formats Supported for PostgreSQL and H2 Databases
                 (PRO only):
    &gt; NEXUS-28677: CocoaPods Format support in Postgres (PRO only)
    &gt; NEXUS-28678: Go Format support in Postgres (PRO only)
    &gt; NEXUS-28781: Rubygems Format support in Postgres (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.34.1.01-1" date="1632657600">- Update to Nexus 3.34.1-01
- Bugfixes:
  * NEXUS-28768: To facilitate migrating from Nexus Repository 2 to Nexus
                 Repository 3, the npm package.json author field can now accept 
                 both map and string values
  * NEXUS-28815: NullPointerException at
                 com.sonatype.nexus.migration.repository.migrators.datastore.NpmRepositoryMigrator.recordMetadata
  * NEXUS-28821: org.sonatype.nexus.datastore.api.DuplicateKeyException in
                 org.sonatype.nexus.repository.content.browse.store.BrowseNodeStore.mergeBrowseNode
- Improvements:
  * NEXUS-28522: change the default location for storing import task metadata
  * NEXUS-28819: log in repo 3 application log the 2 to 3 migration state to 
                 make it easy to determine why migration cannot be ended gracefully</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.35.0.02-1" date="1634212800">- Update to Nexus 3.35.0-02
- Bugfixes:
  * NEXUS-20284: Default content type for raw repositories is now "text/plain"
  * NEXUS-26313: WWW-AUTHENTICATE header does not include needed scope of
                 token
  * NEXUS-26642: A removed docker asset at a remote will cause an already
                 cached docker asset to be removed from a proxy repository when
                 component age expires
  * NEXUS-27125: npm proxy repo audit requests may trigger
                 IllegalStateException Missing
                 org.sonatype.nexus.repository.view.matchers.token.TokenMatcher$State
                 while getting cached content
  * NEXUS-27318: Maven - Publish Maven Indexer files task leaks inputstream
  * NEXUS-27372: Delete of npm package tarball silently fails if the version
                 isn't in package root metadata
  * NEXUS-27628: Application id is not logged at any level when provided by npm
                 audit command
  * NEXUS-28166: Yum metadata not refreshed because of relying on
                 "metadata_generation_time"
  * NEXUS-28621: Nexus DB Migrator 3.33.0 fails with
                 java.lang.StringIndexOutOfBoundsException error
  * NEXUS-28805: Migrator attempts to migrate tagged components before tags
                 have been processed resulting in NullPointerException
                 executing step processComponentStep
  * NEXUS-28842: Github npm package registry does not work with Nexus Repo 3
  * NEXUS-28898: Contention rebuilding Maven hosted archetype-catalog.xml
                 during repository 2 to 3 migration
  * NEXUS-28908: Stuck RUNNABLE postgresql queries on
                 SocketInputStream.socketRead0(Native Method)
  * NEXUS-28922: Azure Blobstore creation fails with using Nexus 3.34.0-01 with
                 PostgresDB
- Improvements:
  * NEXUS-16580: Migrate nx2 artifact information to nx3 during migration
  * NEXUS-28686: Provide an option to not migrate repository content for
                 repositories that are selected for migration from repo 2 to
                 repo 3
  * NEXUS-28891: Avoid building browse feature information during repository 2
                 to 3 migration to improve migration performance
  * NEXUS-28924: Option to force the migration process to end without abort
                 before all content is migrated
  * Firewall Integration Improvement: Policy-Compliant Component Selection
    for npm
  * Faster Imports with Hardlink Support for All Formats
  * Improvements to Repository Replication (PRO only):
    &gt; Replicator Now Supports Docker and npm Formats
    &gt; Replicator Now Runs Continuously by Default
    &gt; New Replication Administrator Role
  * Updated Database Migrator for Easier Migration Between PostgreSQL and H2
    Databases (PRO only)
  * Conan Hosted Support for PostgreSQL and H2 Databases (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.36.0.01-1" date="1636459200">- Update to Nexus 3.36.0-01
- Bugfixes:
  * NEXUS-29088: Running the replication backfill blob attributes task will now
                 process all blobs as expected.
  * NEXUS-29319: This release includes a security fix for an incorrect access
                 control. See the CVE-2021-42568 for full details.
  * NEXUS-29407: This release includes a security fix for a server side request
                 forgery vulnerability. See CVE-2021-43293 for full details.
  * NEXUS-21814: Repair - Reconcile component database from blobstore may not
                 process PyPI assets correctly
  * NEXUS-27629: logging is too verbose when the submitted application id from
                 npm audit is not found in the connected IQ server
  * NEXUS-28714: Content validation does not work properly for OCI
  * NEXUS-28717: "Docker - Delete unused manifests and images" task attempts to
                 read files from the wrong Blob Store.
  * NEXUS-28779: Use cases for name and type properties for datastores can be
                 confusing
  * NEXUS-29338: Image push after Nexus Repository upgrade not possible
- Improvements:
  * NEXUS-24332: Optimized How Yum Metadata is Rebuilt
  * Faster Migration from Nexus Repository 2 to Nexus Repository 3
  * Replication Improvement: Use Truststore Certificates for Replication
    Connection (PRO only)
  * Improvements to Database Migration to H2 or PostgreSQL (PRO only)
    &gt; Added OrientDB Health Check to Database Migration (PRO only)
    &gt; NEXUS-28789: Added Nexus Repository Database Version Check PRO (PRO only)
  * Documentation Improvement: New Resiliency Example Using Azure  (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.0.01-1" date="1637928000">- Update to Nexus 3.37.0-01
- Bugfixes:
  * NEXUS-17624: YUM repomd.xml not deleted from empty level-1 hosted
                 repository
  * NEXUS-19089: large set of dirs/files under directpath/nexus-repository-docker
                 dir
  * NEXUS-21878: failing to start one docker connector on startup prevents all
                 other not started docker connectors from starting
  * NEXUS-22125: Unable to query image tags via Registry API for proxied gcr.io
  * NEXUS-26970: Docker proxy repository returns 502 when remote returns 401
  * NEXUS-27033: Deploy of newly tagged multiarch manifest not permitted when
                 redeploy is disabled
  * NEXUS-27631: Download of docker manifest via UI fails if there is no
                 history in the manifest
  * NEXUS-27674: Unable to download conda component that was released from
                 quarantine
  * NEXUS-27788: "Docker - Delete incomplete uploads" task blocks all docker
                 uploads
  * NEXUS-28717: "Docker - Delete unused manifests and images" task attempts to
                 read files from the wrong Blob Store.
  * NEXUS-28855: Blob store space used constraint says ?in MB? but it
                 stores in bytes
  * NEXUS-28918: Search API does not sort alpha-numeric versions correctly
  * NEXUS-28921: Browse page is empty after migrating to the New DB because
                 Rebuild repository browse tree task fails to be stored due to
                 long name
  * NEXUS-29234: java.lang.NumberFormatException for S3 blob stores on upgrade
  * NEXUS-29342: Yum generated temp files are not deleted
  * NEXUS-29343: Intermittent MissingBlobExceptions for Concurrent Requests
  * NEXUS-29380: NX3: reconcile from blob store task can generate invalid npm
                 version entries in metadata
  * NEXUS-29433: fetching identical group npm package metadata concurrently can
                 result in uncooperative threads and increased blobstore and
                 database load
- Improvements:
  * NEXUS-16580: Migrate nx2 artifact information to nx3 during migration
  * NEXUS-27145: Allow rebuild maven metadata task to fix invalid blob
                 references for maven-metadata.xml
  * NEXUS-28844: option to rebuild npm package metadata per repo or package
  * NEXUS-28896: improve INSERT performance into format specific browse_node
                 tables
  * New "Repair - Rebuild npm metadata" Task
  * The "Repair - Rebuild Maven repository metadata" Task Fixes Invalid Blob
    References for maven-metadata.xml
  * Retain Information About Assets Migrated from Nexus Repository Version 2 to
    Version 3
  * Improved S3 Blob Store Performance
  * Replication Support for NuGet and PyPI  (PRO only)
  * Improved Performance for those Migrating to Nexus Repository 3 with an
    External PostgreSQL Database (PRO only)
  * Improved Resilient Deployment Options (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.1.01-1" date="1639828800">- Update to Nexus 3.37.1-01
- Bugfixes:
  * logback library update to fix a low/moderate vulnerability, as a precautionary
    measure. No known exploit of Nexus Repository via logback at this time.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.2.02-1" date="1640865600">- Update to Nexus 3.37.2-02
- Improvements:
  * New Log4j Visualizer: In response to the recently reported vulnerability in
    Apache's "Log4j2" logging utility (CVE-2021-44228, also known as
    "log4shell"), Sonatype is providing a Log4j Visualizer for a limited time
    to all Nexus Repository OSS and Pro users. The Log4j Visualizer will
    provide insight into Maven log4j component downloads impacted by
    CVE-2021-44228 in your organization</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.3.02-1" date="1640865601">- Update to Nexus 3.37.3-02
- Bugfixes:
  * Update to the text on the Log4j Visualizer screen</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.38.0.01-1" date="1646308800">- Update to Nexus 3.38.0-01
- Bugfixes:
  * NEXUS-30443: Fix for CVE-2021-43961 (HTML injection vulnerability).
                 You should upgrade to this release immediately.
  * NEXUS-20683: API: Searching requires permissions from role that can view
                 every artifact returned in results (admin)
  * NEXUS-24232: npm package metadata does not get updated when a package
                 tarball is deleted
  * NEXUS-24787: an anonymous docker pull while anonymous user is configured
                 to use docker bearer token realm will permanently break all
                 future anonymous docker logins
  * NEXUS-25925: Cleanup policy criteria error if you enter a decimal rather
                 than validate/disallow
  * NEXUS-25927: Switching format errors on save if unapplicable criteria
                 are applied
  * NEXUS-26134: Password Validator Message not shown when changing
                 your password
  * NEXUS-26406: Cleanup Preview should inform the user results are a sample
  * NEXUS-26799: Entering newlines in content selector expression text area
  * NEXUS-27035: Cannot delete untouched Routing Rule matchers
  * NEXUS-27512: Log spam when processing non-timestamped snapshots during
                 metadata rebuild
  * NEXUS-28009: Admin - Remove a member from a blob store group processes
                 docker partial uploads
  * NEXUS-28166: Yum metadata not refreshed because of relying on
                 "metadata_generation_time"
  * NEXUS-28446: Maven proxy repository will return 502 response instead of
                 404 when manually blocked for content not yet cached
  * NEXUS-28555: Upgrade from 2 -&gt; 3 can migrate user email addresses that
                 Nexus Repository 3 considers not valid
  * NEXUS-28889: Some Debian Packages fail to upload (control.tar.zst)
  * NEXUS-29151: IQ policy violations column displays "Loading" for
                 non-admin user
  * NEXUS-29227: WARN PoolBase Failed to validate connection
                 org.postgresql.jdbc.PgConnection (This connection has
                 been closed.). Possibly consider using a shorter
                 maxLifetime value
  * NEXUS-29408: npm group REST API missing when using Postgres/H2 database
  * NEXUS-29410: DB migrator NotEnoughDiskSpaceException does not mention
                 which location
  * NEXUS-29417: Nexus DB migrator fails if asset name is not set/empty
  * NEXUS-29465: Go-group returns 404 for all existing/proxied
                 components (regression)
  * NEXUS-29467: replication performance impacts due to frequent database
                 transactions
  * NEXUS-29477: deleting the current "latest" tgz version from an NPM hosted
                 repo removes the latest tag instead of replacing it with
                 newest published version
  * NEXUS-29738: Maven checksum files should be able to be rebuilt even if
                 repository disables redeploy
  * NEXUS-30043: Yum hosted metadata cleanup causes IllegalStateException
                 Missing entity-metadata when there are at least two
                 hosted repositories
  * NEXUS-30109: Repair - Reconcile component database from blob store task
                 does not restore blobs created while running a different
                 database type
  * NEXUS-30153: Nexus Repository 3 may not be installable / upgradable if it
                 uses PostgreSQL with non "public" schema
  * NEXUS-30366: Routing rules not taking effect for docker when running with
                 external db
  * NEXUS-30448: Rebuilding maven-metadata.xml on slower PostgreSQL could take
                 extremely long time
  * NEXUS-30534: Docker Proxy S3 - Exception pulling pulling an image which
                 has the same checksum as an existing image
  * NEXUS-30687: Blob storage management screen no longer shows if blob store
                 is in use
  * NEXUS-30694: Sorting Maven components with Version returns unpredictable
                 order in some cases
  * NEXUS-30807: Nexus Repository fails to create user-token record when using
                 PostgresDB for some users
  * NEXUS-30834: Log4j Visualizer: log4j-core-2.16.0 is counted even though it
                 doesn't have CVE-2021-44228
  * NEXUS-30845: request log scanner for log4j visualizer may discard IO
                 exceptions instead of logging them
  * NEXUS-30847: Statistics - Recalculate vulnerabilities statistics task is
                 scheduled to run at midnight which conflicts with
                 log rotation
  * NEXUS-30898: System - Repository Health Check task not deleted when the
                 associated repository is deleted
  * NEXUS-30911: 401 response from a remote docker registry will cause an
                 already cached docker asset to be reported as 404 not found
  * NEXUS-30912: Database upgrade to upgrade replication_connection schema
                 does not trigger
  * NEXUS-30934: Setting "NEXUS_SEARCH_INDEX_REBUILD_ON_STARTUP" environment
                 variable does not rebuild indexes
  * NEXUS-30978: Partial metadata generated for empty yum folder/path
  * NEXUS-31035: Database Migrator health check reports "Cluster consistency
                 error: null"
  * NEXUS-31057: Pypi simple index should be proper HTML5 document to be
                 PEP503 compliant and ready for pip version 22.2 and newer
  * NEXUS-31233: Adjustments to Read-Only View
- Improvements:
  * System Status Check for NuGet Versions (PRO ony)
  * Redesign of the replication: The current replication method will not be
    supported after the new replication is released, later in 2022 (PRO only)
  * Added GET Method to Repository Management API
  * Expanded Assets API
  * Apple M1 Chip Support for building
  * NEXUS-28833: 'GitHub Packages' based npm proxy repos causes the long
                 hashed tgz filename/path generation.
  * NEXUS-29730: support for running on apple m1 chip
  * NEXUS-30524: Yum cleanup policy support for "Asset Name Matcher" criteria
  * NEXUS-30575: Expose 'Uploader ID' in API</changelog>
</package>
<package pkgid="216440df0c20dbcff6a686571c89040449487b76f27c549b84b4d6605c866029" name="nexus3" arch="x86_64">
  <version epoch="0" ver="3.38.0.01" rel="1.el8.1"/>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.28.1.01-1" date="1603886400">- Update to Nexus 3.28.1-01
- Bugfixes:
  * NEXUS-25507: Fixed an issue that caused the Change repository blob store task
                 to spawn too many threads.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.0.02-1" date="1607169600">- Update to Nexus 3.29.0-02
- Bugfixes:
  * NEXUS-16575: Raw repo url returns Error 404
  * NEXUS-19840: /service/metrics/healthcheck returns 500 status code if
                 a single healthcheck fails. It is deprecated now and
                 scheduled for removal.  It is recommended to use the
                 alternative endpoint /service/rest/v1/status/check which has a
                 near equivalent JSON response, except it does not return 500
                 status when one or more system status checks fail
  * NEXUS-23733: Creating more than one file based blobstore using the same
                 root path is not prevented
  * NEXUS-23827: PACKAGES.gz cannot be updated if repository doesn't allow
                 redeploy
  * NEXUS-24331: deployment of rpm to a single directory causes metadata
                 rebuild for entire repository
  * NEXUS-24913: npm audit caching prevents policy updates
  * NEXUS-25105: HTTP 500 response when attempting to delete LDAP user via
                 REST API
  * NEXUS-25116: Getting Metadata hashes via a Maven group returns 404
                 Not found
  * NEXUS-25147: Rebuild metadata task leaves sha256 and sha512 files untouched
                 for metadata files
  * NEXUS-25158: HeaderPatternFilter may reject implicit Host value due to
                 certain combinations of X-Forwarded headers
  * NEXUS-25186: possible that requests abruptly terminating will not appear in
                 request.log
  * NEXUS-25291: NuGet V3 Proxy can be configured only using a specific remote
                 in UI field
  * NEXUS-25292: Bad blob file reference breaks repository export
  * NEXUS-25304: Health check details can fail with NPE if IQ server is setup
                 but disabled
  * NEXUS-25357: NuGet Proxy does not work with some third-party V3
                 repositories
  * NEXUS-25420: NXRM to NXRM Nuget v3 proxying still results in direct
                 requests to nuget.org
  * NEXUS-25464: Blob reference not updated in asset after change repository
  * NEXUS-25478: Nuget V3 Group packages incorrectly sorted in page causing
                 some installs to fail
  * NEXUS-25502: yum metadata is rebuilt after downloading it which can cause
                 build failures
  * NEXUS-25510: Error Response Code 429 (Rate Limiting) does not autoblock
  * NEXUS-25521: Encoded proxy URL causes startup failure
  * NEXUS-25527: Crowd "Verify connection" button deletes all inputted values
  * NEXUS-25529: Security management: Users API does not show "externalRoles"
                 for Crowd
  * NEXUS-25575: Password Validator Message not shown when changing your
                 password.
  * NEXUS-25604: Some newly deployed rpm files not showing up in
                 primary.xml.gz, despite logging saying they are being added
  * NEXUS-25605: Proxy repositories to github package registry can fail query
                 requests when accessed in a group repository
  * NEXUS-25609: Exception processing payloads for a single NuGet group member
                 repository can stop all group member processing
  * NEXUS-25628: yum metadata missing provides entries when multiple versions
                 are provided by a package
  * NEXUS-25650: Nexus-3-0 Develop Violations - 10/29/20 12:15 AM
  * NEXUS-25775: WARN messages WebResourceServiceImpl - Overlapping resources
                 on path /static/img/sonatype-logo-with-hexagon.png
  * NEXUS-25829: CVE-2020-29436: Fixes an XXE Vulnerability
  * NEXUS-25830: ClassCastException Long cannot be cast to Date for NuGet v3
                 registrations index
  * NEXUS-25928: Nexus-3-0 Develop Violations - 11/19/20 12:14 AM
- Improvements:
  * NEXUS-14631: Add more attributes to REST resource for asset
  * NEXUS-19021: Nothing is logged at default levels when roles are added or
                 removed
  * NEXUS-20267: only allow the most secure cipher suites and TLS protocol
                 versions for inbound HTTPS connections by default. See also
                 NEXUS-25786 below.
  * NEXUS-25307: Protect against deletion of related blob stores while the
                 Change Repo Blob Store task is executing
  * NEXUS-23331: Add the support of helm push plugin
  * NEXUS-25423: Add caching of catalog dates for npm component queries to IQ
  * NEXUS-25424: Add configuration for Orient's "network.binary.maxLength"
  * NEXUS-25506: change the Remote URL of the default nuget.org-proxy proxy
                 repository to api version 3 compatible https://api.nuget.org/v3/index.json.
                 Applies only to new installations. Upgrading will not modify
                 any existing remote URLs, although users are encouraged to
                 start migrating away from using NuGet V2 API URLs such as the
                 previous default (https://www.nuget.org/api/v2/).
  * NEXUS-25774: upgrade Eclipse Jetty to 9.4.33.v20201020
  * NEXUS-25786: explicitly disable TLS 1.0 and 1.1 for inbound HTTPS
                 connections by default. Only applies to Eclipse Jetty-based
                 direct inbound HTTPS connections (no reverse proxy).
                 You are encouraged to use the new settings, but if for some
                 reason you still the new TLS versions or cipher suites, check
                 https://support.sonatype.com/hc/en-us/articles/213465098</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.1.01-1" date="1608897600">- Update to Nexus 3.29.1-01
- Bugfixes:
  * NEXUS-24391: 'Destination already contains component' error when using
                 staging API
  * NEXUS-25504: Unable to pull images from hosted docker repo after move to
                 new blobstore
  * NEXUS-25600: Repository Import Ignores Validation
  * NEXUS-25611: Installing via helm proxy errors if not using official remote
  * NEXUS-25801: Group repository registration API requests may fail
  * NEXUS-25902: Source blob store is not logged in repository move task
  * NEXUS-25903: Repository blob store set incorrectly after error in "admin -
                 change repository blob store" task
  * NEXUS-25936: npm audit fails with 500 response using group and anonymous</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.2.02-1" date="1610107200">- Update to Nexus 3.29.2-02
- Bugfixes:
  * NEXUS-26251: Interface for Cleanup Policies erroneously interprets and
                 persists values as seconds instead of days. If you installed
                 3.29.1 and modified or created a cleanup policy you must
                 confirm that these fields have the intended values.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.30.0.01-1" date="1614945600">- Update to Nexus 3.30.0-01
- Bugfixes:
  * NEXUS-12022: Allow configuring HTTPS Maven proxy repositories with
                 pre-emptive authentication
  * NEXUS-18610: Raw proxy errors on URL encoded space and plus (+) characters
  * NEXUS-19181: staging NullPointerException when moving docker assets via
                 DockerComponentDirector.maybeCopyAssets
  * NEXUS-23750: Does not support npm GitHub Package Registry
  * NEXUS-24485: Docker Manifest generation is incorrect for Redeploy Disabled
                 repositories.
  * NEXUS-25148: Incremental yum rebuilds with only COMPS files are ignored
  * NEXUS-25501: Logout with anonymous off fires JS error, can malform page
  * NEXUS-25626: Docker redeploy on the latest tag fails when more than one tag
                 exists for the image
  * NEXUS-25733: NuGet v3 repository index.json generation
  * NEXUS-25783: Browse of NuGet packages from visual studio fails if user
                 doesn't have browse privileges to all group members
  * NEXUS-25784: Browse request to NuGet v3 search URL in group fails
                 completely if one of the group's members has DNS lookup
                 failure
  * NEXUS-25868: Podman push of new image tag fails when docker cli push
                 succeeds for the same actions
  * NEXUS-25904: The "admin - change repository blob store" task should not
                 allow selection of a promoted blob store
  * NEXUS-25908: nuget restore does not resolve inbound normalized package
                 versions to unnormalized published versions using NuGet v3
  * NEXUS-25924: If the remote of a NuGet v3 proxy is not reachable it breaks
                 requests to a NuGet group
  * NEXUS-25985: "Docker - Delete unused manifests and images" task deletes
                 digest manifests referenced by other manifests
  * NEXUS-26003: Helm proxy : difference between helm index file and real
                 artifact url
  * NEXUS-26036: wrong issuer displayed for trusted SSL certificates
  * NEXUS-26093: Create proxy repository in API UI fails due to password
                 missing from Authentication JSON
  * NEXUS-26099: No way to set "useTrustStore" in proxy repository REST API
  * NEXUS-26118: pip search does not work *via* NXRM PyPI proxy to NXRM PyPI
                 repository and authentication is required
  * NEXUS-26129: Promoting a nested blob store causes it to be removed entirely
  * NEXUS-26132: upgrade of NXRM 2 to NXRM 3 maven assets fails due to
                 IllegalStateException: Missing {attributes:checksum} sha256
  * NEXUS-26315: Cleanup Policy List shows Error 500 after Upgrade 3.28.0
                 to 3.29.2
  * NEXUS-26355: sha512 or sha256 hashes are processed by expensive repository
                 content validation
  * NEXUS-26379: DockerFacetUtils.findAssetByContentDigest() causes poor
                 performance under load
  * NEXUS-26453: saving the s3 blobstore config can break async tmp blob
                deletes by not restarting the async delete thread pool
  * NEXUS-26473: Thread cooperation does not work when recovering from missing
                 blobs in proxy repositories
  * NEXUS-26483: Nexus UI causes Uncaught TypeError when the username contains
                 'api' string with privilege 'nx-api-reader'
  * NEXUS-26504: Newly created compact blob store task has "multinode=true"
  * NEXUS-26605: Rebuild metadata fails to rebuild corrupt metadata files
  * NEXUS-26611: conda proxy repositories do not support inbound conditional
                 HTTP GET HEAD
  * NEXUS-26676: IllegalOperationException: Repair - Rebuild Maven repository
                 metadata
- Improvements:
  * NEXUS-24446: Add Azure Blob Storage support to NXRM blob store
  * NEXUS-25275: improve docker repository human readable error response
                 messages
  * NEXUS-25623: Provide a different status than Quarantined for components
                 Pending Quarantine
  * NEXUS-25909: Protect inbound HTTPS connections against Weak Diffie-Hellman
                 Keys and Logjam by default
  * NEXUS-26196: Allow enabling truststore with Repository Management REST API
  * NEXUS-26319: remove reference to sonatype-public-grid from pom files
  * NEXUS-26606: Upgrade Eclipse Jetty to 9.4.38.v20210224</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.30.1.01-1" date="1619179200">- Update to Nexus 3.30.1-01
- Bugfixes:
  * Security fix for CVE-2021-30635 (Information Disclosure).
    See https://support.sonatype.com/hc/en-us/articles/1500006879561 for
    details.
  * Security fix for CVE-2021-29159 (XSS vulnerability).
    See https://support.sonatype.com/hc/en-us/articles/1500005031082 for
    details.
  * Security fix for CVE-2021-29158 (Sensitive Information Disclosure).
    See https://support.sonatype.com/hc/en-us/articles/1500006126462 for
    details.
  * NEXUS-27384: Upgrade Eclipse Jetty to 9.4.40.v20210413
  * NEXUS-26789: Performance improvement to rebuilding GA maven-metadata.xml
  * NEXUS-26501: Package content is out of specification when downloading from NuGet hosted
  * NEXUS-27013: Raw proxy is encoding slashes for outbound requests
  * NEXUS-26855: Non-indexed raw proxy repositories cannot be browsed</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.31.0.01-1" date="1623931200">- Update to Nexus 3.31.0-01
- Bugfixes:
  * NEXUS-26177: Deleting an npm repository or invalidating the cache breaks
                 npm audit.
  * NEXUS-26312: "Last downloaded" not updating consistently in NuGet.
  * NEXUS-26358: WARN messages from SupportRestorer Can't find file to
                 restore data
  * NEXUS-27614: PyPI can swallow errors when the simple index is being
                 re-written.
  * NEXUS-26683: "Remove a member from a blob store group" task can't remove a
                 blob store if one bytes file is missing
  * NEXUS-26732: Race Condition in Docker format can cause assets to be
                 mistakenly deleted.
  * NEXUS-26737: Deleting manifest with Docker API does not delete all tags.
  * NEXUS-26829: Copy and config links incorrect for nuget V3 proxy repos
  * NEXUS-26845: HTTP error status code not logged on proxy repository
                automatic blocking
  * NEXUS-26938: Use HEAD request to determine whether remote content has changed
                 instead of conditional GET to avoid hitting DockerHub rate
                 limit prematurely.
  * NEXUS-26971: Incorrect results can be returned when using npm show with
                 group repositories.
  * NEXUS-27014: Cleanup policies and tasks do not fully consider Docker layers
                 can be referenced by manifests in other repositories.
  * NEXUS-27015: IllegalArgumentException on Publish Maven Index task.
  * NEXUS-27130: GA maven-metadata.xml fails to refresh if a GAV is deleted via
                 Browse's "Delete Folder" button
  * NEXUS-27182: Blob paths traversal
  * NEXUS-27427: Blank values for NuGet attributes.
  * NEXUS-27436: npm metadata rebuild failing due to NPE.
  * NEXUS-27563: S3 connection pool exhaustion when merging repomd.xml in group
                 repositories.
  * NEXUS-27564: Yum Group repomd.xml merge connection pool exhaustion causes
                 problems.
- Improvements:
  * NEXUS-20252: Support Staging with PyPI format.
  * NEXUS-23959: Define BlobStoreApiSoftQuota type allowableValues
  * NEXUS-24311: Added hardlinks to import/export.
  * NEXUS-26617: Upgrade karaf to 4.3.0
  * NEXUS-26931: Added UI validation to ensure container name is all lower case
                 alphanumeric.
  * NEXUS-27597: Add ability to run `Repair - Reconcile component database from
                 blob store` against a subset by time
  * NEXUS-27683: StorageFacetCleanupTaskManager should remove &amp; schedule task.
  * NEXUS-27953: Upgrade Eclipse Jetty to 9.4.42.v20210604.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.31.1.01-1" date="1624622400">- Update to Nexus 3.31.1-01
- Bugfixes:
  * CVE-2021-34553: Information disclosure vulnerability fixed. Sonatype Nexus
                    Repository 3 up to 3.31.0 allows a remote authenticated
                    attacker to get a list of blob files and read the content
                    of a blob file (via a crafted GET request) without having
                    been granted access.
  * NEXUS-28078: Docker - Delete unused manifests and images task may delete
                 referenced layers if the database query to select components
                 encounters limits</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.32.0.03-1" date="1625832000">- Update to Nexus 3.32.0-03
- Bugfixes:
  * NEXUS-27469: Using AzureBlobStore causes docker image upload failure with
                 'digest invalid' error
  * NEXUS-27617: Unable to configure SAML on docker image due to bug in
                 included OpenJDK
  * NEXUS-27753: The latest package version doesn't change in package root
                 after component deleting
  * NEXUS-28247: Docker GC Task incorrectly removing manifests and layers
- Improvements:
  * NEXUS-28203: Replication (Product Preview, PRO only)
  * NEXUS-28205: APT Format support in PostgreSQL</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.33.0.01-1" date="1628164800">- Update to Nexus 3.33.0-01
- Bugfixes:
  * NEXUS-27428: redundant download count attribute for NuGet v3
  * NEXUS-28277: Fetching group npm package metadata concurrently can cause
                 OConcurrentModificationException
  * NEXUS-28362: slow request processing due to group trying to locate blobs in
                 the wrong blobstore
  * NEXUS-28381: Webhook ConnectionPoolTimeoutException: Timeout waiting for
                 connection from pool after sending 20 requests
  * NEXUS-28442: XSS injection
- Improvements:
  * NEXUS-28543: Conda Format support in Postgres (PRO only)
  * NEXUS-28544: Git LFS Format support in Postgres (PRO only
  * NEXUS-28545: R Format support in Postgres (PRO only
  * NEXUS-28561: Conan Format support in Postgres (PRO only
  * NEXUS-28562: npm format support in Postgres (PRO only
  * Improvements to Resilient Nexus Repository Deployment Architecture</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.33.1.01-1" date="1630670400">- Update to Nexus 3.33.1-01
- Bugfixes:
  * NEXUS-28081: Nexus 2 migration to Nexus 3 fails due to permissions of
                 unsupported formats on PostgreSQL databases
- Improvements:
  * Updated Eclipse Jetty Version to 9.4.43.v20210629
  * Changes to Cloud Resiliency Architecture Example: remove the dependency on
    Amazon Elastic File System (EFS). The improved example provides new YAML
    files to help you set up Fluent Bit and CloudWatch in order to externalize
    your logs. This will allow you to capture comprehensive logs even if Nexus
    Repository runs on separate nodes within the same day.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.34.0.01-1" date="1630843200">- Update to Nexus 3.34.0-01
- Bugfixes:
  * NEXUS-27932: "Manifest invalid" message when running the Docker GC task.
  * NEXUS-28394: Last downloaded field not properly updating when installing
                 or downloading through R proxy
  * NEXUS-28458: logged ERROR LastShutdownTimeServiceImpl 'Failed to process
                 file - Assuming no previous start time' on startup
  * NEXUS-28620: Nexus Database Migrator fails when symlink is used for data
                 directory or data directory not in standard location
  * NEXUS-28807: Nexus-3-0 Stage-release Violations - 08/27/21 12:19 AM
  * NEXUS-28808: Policy violation of com.thoughtworks.xstream : xstream: 1.4.17
  * NEXUS-28853: This release includes a security fix for an HTTP header
                 injection. See the CVE-2021-40143 advisory for full details.
                 If you are using an earlier version, you should upgrade to
                 this release immediately
- Improvements:
  * NEXUS-28266: make S3 Connection Time to Live (TTL) setting configurable to
                 help avoid socket connect timeouts
  * Repository Replication (PRO only)
  * NEXUS-28780: New Formats Supported for PostgreSQL and H2 Databases
                 (PRO only):
    &gt; NEXUS-28677: CocoaPods Format support in Postgres (PRO only)
    &gt; NEXUS-28678: Go Format support in Postgres (PRO only)
    &gt; NEXUS-28781: Rubygems Format support in Postgres (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.34.1.01-1" date="1632657600">- Update to Nexus 3.34.1-01
- Bugfixes:
  * NEXUS-28768: To facilitate migrating from Nexus Repository 2 to Nexus
                 Repository 3, the npm package.json author field can now accept 
                 both map and string values
  * NEXUS-28815: NullPointerException at
                 com.sonatype.nexus.migration.repository.migrators.datastore.NpmRepositoryMigrator.recordMetadata
  * NEXUS-28821: org.sonatype.nexus.datastore.api.DuplicateKeyException in
                 org.sonatype.nexus.repository.content.browse.store.BrowseNodeStore.mergeBrowseNode
- Improvements:
  * NEXUS-28522: change the default location for storing import task metadata
  * NEXUS-28819: log in repo 3 application log the 2 to 3 migration state to 
                 make it easy to determine why migration cannot be ended gracefully</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.35.0.02-1" date="1634212800">- Update to Nexus 3.35.0-02
- Bugfixes:
  * NEXUS-20284: Default content type for raw repositories is now "text/plain"
  * NEXUS-26313: WWW-AUTHENTICATE header does not include needed scope of
                 token
  * NEXUS-26642: A removed docker asset at a remote will cause an already
                 cached docker asset to be removed from a proxy repository when
                 component age expires
  * NEXUS-27125: npm proxy repo audit requests may trigger
                 IllegalStateException Missing
                 org.sonatype.nexus.repository.view.matchers.token.TokenMatcher$State
                 while getting cached content
  * NEXUS-27318: Maven - Publish Maven Indexer files task leaks inputstream
  * NEXUS-27372: Delete of npm package tarball silently fails if the version
                 isn't in package root metadata
  * NEXUS-27628: Application id is not logged at any level when provided by npm
                 audit command
  * NEXUS-28166: Yum metadata not refreshed because of relying on
                 "metadata_generation_time"
  * NEXUS-28621: Nexus DB Migrator 3.33.0 fails with
                 java.lang.StringIndexOutOfBoundsException error
  * NEXUS-28805: Migrator attempts to migrate tagged components before tags
                 have been processed resulting in NullPointerException
                 executing step processComponentStep
  * NEXUS-28842: Github npm package registry does not work with Nexus Repo 3
  * NEXUS-28898: Contention rebuilding Maven hosted archetype-catalog.xml
                 during repository 2 to 3 migration
  * NEXUS-28908: Stuck RUNNABLE postgresql queries on
                 SocketInputStream.socketRead0(Native Method)
  * NEXUS-28922: Azure Blobstore creation fails with using Nexus 3.34.0-01 with
                 PostgresDB
- Improvements:
  * NEXUS-16580: Migrate nx2 artifact information to nx3 during migration
  * NEXUS-28686: Provide an option to not migrate repository content for
                 repositories that are selected for migration from repo 2 to
                 repo 3
  * NEXUS-28891: Avoid building browse feature information during repository 2
                 to 3 migration to improve migration performance
  * NEXUS-28924: Option to force the migration process to end without abort
                 before all content is migrated
  * Firewall Integration Improvement: Policy-Compliant Component Selection
    for npm
  * Faster Imports with Hardlink Support for All Formats
  * Improvements to Repository Replication (PRO only):
    &gt; Replicator Now Supports Docker and npm Formats
    &gt; Replicator Now Runs Continuously by Default
    &gt; New Replication Administrator Role
  * Updated Database Migrator for Easier Migration Between PostgreSQL and H2
    Databases (PRO only)
  * Conan Hosted Support for PostgreSQL and H2 Databases (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.36.0.01-1" date="1636459200">- Update to Nexus 3.36.0-01
- Bugfixes:
  * NEXUS-29088: Running the replication backfill blob attributes task will now
                 process all blobs as expected.
  * NEXUS-29319: This release includes a security fix for an incorrect access
                 control. See the CVE-2021-42568 for full details.
  * NEXUS-29407: This release includes a security fix for a server side request
                 forgery vulnerability. See CVE-2021-43293 for full details.
  * NEXUS-21814: Repair - Reconcile component database from blobstore may not
                 process PyPI assets correctly
  * NEXUS-27629: logging is too verbose when the submitted application id from
                 npm audit is not found in the connected IQ server
  * NEXUS-28714: Content validation does not work properly for OCI
  * NEXUS-28717: "Docker - Delete unused manifests and images" task attempts to
                 read files from the wrong Blob Store.
  * NEXUS-28779: Use cases for name and type properties for datastores can be
                 confusing
  * NEXUS-29338: Image push after Nexus Repository upgrade not possible
- Improvements:
  * NEXUS-24332: Optimized How Yum Metadata is Rebuilt
  * Faster Migration from Nexus Repository 2 to Nexus Repository 3
  * Replication Improvement: Use Truststore Certificates for Replication
    Connection (PRO only)
  * Improvements to Database Migration to H2 or PostgreSQL (PRO only)
    &gt; Added OrientDB Health Check to Database Migration (PRO only)
    &gt; NEXUS-28789: Added Nexus Repository Database Version Check PRO (PRO only)
  * Documentation Improvement: New Resiliency Example Using Azure  (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.0.01-1" date="1637928000">- Update to Nexus 3.37.0-01
- Bugfixes:
  * NEXUS-17624: YUM repomd.xml not deleted from empty level-1 hosted
                 repository
  * NEXUS-19089: large set of dirs/files under directpath/nexus-repository-docker
                 dir
  * NEXUS-21878: failing to start one docker connector on startup prevents all
                 other not started docker connectors from starting
  * NEXUS-22125: Unable to query image tags via Registry API for proxied gcr.io
  * NEXUS-26970: Docker proxy repository returns 502 when remote returns 401
  * NEXUS-27033: Deploy of newly tagged multiarch manifest not permitted when
                 redeploy is disabled
  * NEXUS-27631: Download of docker manifest via UI fails if there is no
                 history in the manifest
  * NEXUS-27674: Unable to download conda component that was released from
                 quarantine
  * NEXUS-27788: "Docker - Delete incomplete uploads" task blocks all docker
                 uploads
  * NEXUS-28717: "Docker - Delete unused manifests and images" task attempts to
                 read files from the wrong Blob Store.
  * NEXUS-28855: Blob store space used constraint says ?in MB? but it
                 stores in bytes
  * NEXUS-28918: Search API does not sort alpha-numeric versions correctly
  * NEXUS-28921: Browse page is empty after migrating to the New DB because
                 Rebuild repository browse tree task fails to be stored due to
                 long name
  * NEXUS-29234: java.lang.NumberFormatException for S3 blob stores on upgrade
  * NEXUS-29342: Yum generated temp files are not deleted
  * NEXUS-29343: Intermittent MissingBlobExceptions for Concurrent Requests
  * NEXUS-29380: NX3: reconcile from blob store task can generate invalid npm
                 version entries in metadata
  * NEXUS-29433: fetching identical group npm package metadata concurrently can
                 result in uncooperative threads and increased blobstore and
                 database load
- Improvements:
  * NEXUS-16580: Migrate nx2 artifact information to nx3 during migration
  * NEXUS-27145: Allow rebuild maven metadata task to fix invalid blob
                 references for maven-metadata.xml
  * NEXUS-28844: option to rebuild npm package metadata per repo or package
  * NEXUS-28896: improve INSERT performance into format specific browse_node
                 tables
  * New "Repair - Rebuild npm metadata" Task
  * The "Repair - Rebuild Maven repository metadata" Task Fixes Invalid Blob
    References for maven-metadata.xml
  * Retain Information About Assets Migrated from Nexus Repository Version 2 to
    Version 3
  * Improved S3 Blob Store Performance
  * Replication Support for NuGet and PyPI  (PRO only)
  * Improved Performance for those Migrating to Nexus Repository 3 with an
    External PostgreSQL Database (PRO only)
  * Improved Resilient Deployment Options (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.1.01-1" date="1639828800">- Update to Nexus 3.37.1-01
- Bugfixes:
  * logback library update to fix a low/moderate vulnerability, as a precautionary
    measure. No known exploit of Nexus Repository via logback at this time.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.2.02-1" date="1640865600">- Update to Nexus 3.37.2-02
- Improvements:
  * New Log4j Visualizer: In response to the recently reported vulnerability in
    Apache's "Log4j2" logging utility (CVE-2021-44228, also known as
    "log4shell"), Sonatype is providing a Log4j Visualizer for a limited time
    to all Nexus Repository OSS and Pro users. The Log4j Visualizer will
    provide insight into Maven log4j component downloads impacted by
    CVE-2021-44228 in your organization</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.3.02-1" date="1640865601">- Update to Nexus 3.37.3-02
- Bugfixes:
  * Update to the text on the Log4j Visualizer screen</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.38.0.01-1" date="1646308800">- Update to Nexus 3.38.0-01
- Bugfixes:
  * NEXUS-30443: Fix for CVE-2021-43961 (HTML injection vulnerability).
                 You should upgrade to this release immediately.
  * NEXUS-20683: API: Searching requires permissions from role that can view
                 every artifact returned in results (admin)
  * NEXUS-24232: npm package metadata does not get updated when a package
                 tarball is deleted
  * NEXUS-24787: an anonymous docker pull while anonymous user is configured
                 to use docker bearer token realm will permanently break all
                 future anonymous docker logins
  * NEXUS-25925: Cleanup policy criteria error if you enter a decimal rather
                 than validate/disallow
  * NEXUS-25927: Switching format errors on save if unapplicable criteria
                 are applied
  * NEXUS-26134: Password Validator Message not shown when changing
                 your password
  * NEXUS-26406: Cleanup Preview should inform the user results are a sample
  * NEXUS-26799: Entering newlines in content selector expression text area
  * NEXUS-27035: Cannot delete untouched Routing Rule matchers
  * NEXUS-27512: Log spam when processing non-timestamped snapshots during
                 metadata rebuild
  * NEXUS-28009: Admin - Remove a member from a blob store group processes
                 docker partial uploads
  * NEXUS-28166: Yum metadata not refreshed because of relying on
                 "metadata_generation_time"
  * NEXUS-28446: Maven proxy repository will return 502 response instead of
                 404 when manually blocked for content not yet cached
  * NEXUS-28555: Upgrade from 2 -&gt; 3 can migrate user email addresses that
                 Nexus Repository 3 considers not valid
  * NEXUS-28889: Some Debian Packages fail to upload (control.tar.zst)
  * NEXUS-29151: IQ policy violations column displays "Loading" for
                 non-admin user
  * NEXUS-29227: WARN PoolBase Failed to validate connection
                 org.postgresql.jdbc.PgConnection (This connection has
                 been closed.). Possibly consider using a shorter
                 maxLifetime value
  * NEXUS-29408: npm group REST API missing when using Postgres/H2 database
  * NEXUS-29410: DB migrator NotEnoughDiskSpaceException does not mention
                 which location
  * NEXUS-29417: Nexus DB migrator fails if asset name is not set/empty
  * NEXUS-29465: Go-group returns 404 for all existing/proxied
                 components (regression)
  * NEXUS-29467: replication performance impacts due to frequent database
                 transactions
  * NEXUS-29477: deleting the current "latest" tgz version from an NPM hosted
                 repo removes the latest tag instead of replacing it with
                 newest published version
  * NEXUS-29738: Maven checksum files should be able to be rebuilt even if
                 repository disables redeploy
  * NEXUS-30043: Yum hosted metadata cleanup causes IllegalStateException
                 Missing entity-metadata when there are at least two
                 hosted repositories
  * NEXUS-30109: Repair - Reconcile component database from blob store task
                 does not restore blobs created while running a different
                 database type
  * NEXUS-30153: Nexus Repository 3 may not be installable / upgradable if it
                 uses PostgreSQL with non "public" schema
  * NEXUS-30366: Routing rules not taking effect for docker when running with
                 external db
  * NEXUS-30448: Rebuilding maven-metadata.xml on slower PostgreSQL could take
                 extremely long time
  * NEXUS-30534: Docker Proxy S3 - Exception pulling pulling an image which
                 has the same checksum as an existing image
  * NEXUS-30687: Blob storage management screen no longer shows if blob store
                 is in use
  * NEXUS-30694: Sorting Maven components with Version returns unpredictable
                 order in some cases
  * NEXUS-30807: Nexus Repository fails to create user-token record when using
                 PostgresDB for some users
  * NEXUS-30834: Log4j Visualizer: log4j-core-2.16.0 is counted even though it
                 doesn't have CVE-2021-44228
  * NEXUS-30845: request log scanner for log4j visualizer may discard IO
                 exceptions instead of logging them
  * NEXUS-30847: Statistics - Recalculate vulnerabilities statistics task is
                 scheduled to run at midnight which conflicts with
                 log rotation
  * NEXUS-30898: System - Repository Health Check task not deleted when the
                 associated repository is deleted
  * NEXUS-30911: 401 response from a remote docker registry will cause an
                 already cached docker asset to be reported as 404 not found
  * NEXUS-30912: Database upgrade to upgrade replication_connection schema
                 does not trigger
  * NEXUS-30934: Setting "NEXUS_SEARCH_INDEX_REBUILD_ON_STARTUP" environment
                 variable does not rebuild indexes
  * NEXUS-30978: Partial metadata generated for empty yum folder/path
  * NEXUS-31035: Database Migrator health check reports "Cluster consistency
                 error: null"
  * NEXUS-31057: Pypi simple index should be proper HTML5 document to be
                 PEP503 compliant and ready for pip version 22.2 and newer
  * NEXUS-31233: Adjustments to Read-Only View
- Improvements:
  * System Status Check for NuGet Versions (PRO ony)
  * Redesign of the replication: The current replication method will not be
    supported after the new replication is released, later in 2022 (PRO only)
  * Added GET Method to Repository Management API
  * Expanded Assets API
  * Apple M1 Chip Support for building
  * NEXUS-28833: 'GitHub Packages' based npm proxy repos causes the long
                 hashed tgz filename/path generation.
  * NEXUS-29730: support for running on apple m1 chip
  * NEXUS-30524: Yum cleanup policy support for "Asset Name Matcher" criteria
  * NEXUS-30575: Expose 'Uploader ID' in API</changelog>
</package>
</otherdata>