<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="4">
<package pkgid="44f6d8fe50d2ca4d6fd54ea3281544119fbb8d7eda456b5cc94f7156c59fda3a" name="nexus" arch="src">
  <version epoch="0" ver="2.14.21.02" rel="1.fc30.1"/>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.16.01-1" date="1580126400">- License for Nexus OSS is EPL-2.0 as stated at https://blog.sonatype.com/2012/06/nexus-oss-switched-to-the-eclipse-public-license-a-clarification-and-an-observation/
  and it is since 2012. Mistake inherited from the original packages from Jens Braeuer.
- Update to 2.14.16-01
- Bugfixes:
  * NEXUS-22014: CVE-2019-15893: Remote Code Execution vulnerability
  * NEXUS-22453: Update Apache Shiro library to resolve security vulnerability
  * NEXUS-22313: Invalid content-range header returned
  * NEXUS-13306: usernames containing non URL safe characters cannot authenticate using the Crowd realm</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.16.01-2" date="1582891200">- Clean up spec and fix to build all distributions at OpenBuildService
- Enable building and installation for Amazon Linux &gt;= 2
- Enable building and installation for for openSUSE Tumbleweed/Factory</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.17.01-1" date="1587124800">- Update to 2.14.17-01
- Bugfixes:
  * NEXUS-23556: CVE-2020-11415: LDAP system credentials can be exposed by admin user</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.18.01-1" date="1601640000">- Update to 2.14.18-01
- Bugfixes:
  * NEXUS-21802: Maven metadata sha256/sha512 checksum in staging repositories</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.19.01-1" date="1601640001">- Update to 2.14.19-01
- Bugfixes:
  * Minor security fixes.</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.20-02-1" date="1609848000">- Update to 2.14.20-02
- Bugfixes:
  * NEXUS-26224: CVE-2020-13920: Apache ActiveMQ JMX is vulnerable to a MITM attack
  * NEXUS-25956: Signatures with ECC algorithm not being recognized</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.21-02-1" date="1639828800">- Update to 2.14.21-02
- Bugfixes:
  * logback library update to fix a low/moderate vulnerability, as a precautionary
    measure. No known exploit of Nexus Repository via logback at this time.</changelog>
</package>
<package pkgid="ba751fed7b1c7d25d8df09c90b6583c321e9b066ccf2b963385a4c395126c028" name="nexus" arch="x86_64">
  <version epoch="0" ver="2.14.21.02" rel="1.fc30.1"/>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.16.01-1" date="1580126400">- License for Nexus OSS is EPL-2.0 as stated at https://blog.sonatype.com/2012/06/nexus-oss-switched-to-the-eclipse-public-license-a-clarification-and-an-observation/
  and it is since 2012. Mistake inherited from the original packages from Jens Braeuer.
- Update to 2.14.16-01
- Bugfixes:
  * NEXUS-22014: CVE-2019-15893: Remote Code Execution vulnerability
  * NEXUS-22453: Update Apache Shiro library to resolve security vulnerability
  * NEXUS-22313: Invalid content-range header returned
  * NEXUS-13306: usernames containing non URL safe characters cannot authenticate using the Crowd realm</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.16.01-2" date="1582891200">- Clean up spec and fix to build all distributions at OpenBuildService
- Enable building and installation for Amazon Linux &gt;= 2
- Enable building and installation for for openSUSE Tumbleweed/Factory</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.17.01-1" date="1587124800">- Update to 2.14.17-01
- Bugfixes:
  * NEXUS-23556: CVE-2020-11415: LDAP system credentials can be exposed by admin user</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.18.01-1" date="1601640000">- Update to 2.14.18-01
- Bugfixes:
  * NEXUS-21802: Maven metadata sha256/sha512 checksum in staging repositories</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.19.01-1" date="1601640001">- Update to 2.14.19-01
- Bugfixes:
  * Minor security fixes.</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.20-02-1" date="1609848000">- Update to 2.14.20-02
- Bugfixes:
  * NEXUS-26224: CVE-2020-13920: Apache ActiveMQ JMX is vulnerable to a MITM attack
  * NEXUS-25956: Signatures with ECC algorithm not being recognized</changelog>
  <changelog author="Julio Gonzalez Gil &lt;packages@juliogonzalez.es&gt; - 2.14.21-02-1" date="1639828800">- Update to 2.14.21-02
- Bugfixes:
  * logback library update to fix a low/moderate vulnerability, as a precautionary
    measure. No known exploit of Nexus Repository via logback at this time.</changelog>
</package>
<package pkgid="438a3cc229f38005ac92d8f6bc17fc53e2d850ceebba8249e7a23c6fdae9db16" name="nexus3" arch="src">
  <version epoch="0" ver="3.37.1.01" rel="1.fc30.1"/>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.26.1.02-1" date="1597579200">- Update to Nexus 3.26.1.04-1
- Bugfixes:
  * NEXUS-24867: Fix an issue starting server when multiple SSL certificates are present in the configured keystore.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.27.0.03-1" date="1599307200">- Update to Nexus 3.27.0-03
- Bugfixes:
  * NEXUS-24298: Yum proxy needs to be more lenient about gzip encoding
  * NEXUS-24464: NuGet Signature validation goes out to https://api.nuget.org
  * NEXUS-24691: OCI annotations result in errors
  * NEXUS-24802: Spurious warnings logged when running reconcile task against group blob store
  * NEXUS-24837: Metadata query cache age and Maximum metadata age timeouts are ignored for metadata requests
  * NEXUS-24869: Moving away from the Logging page asks "Unsaved changes"
  * NEXUS-24901: some rpms in a yum hosted repo are not added to a rebuilt hosted repo primary.xml metadata file
  * NEXUS-24917: npm audit fails for packages that are not all lowercase
  * NEXUS-24925: Unneeded JSESSIONID cookies returned
  * NEXUS-24988: Snapshot remover deletes GAV level maven-metadata.xml files, resulting in 404 responses
  * NEXUS-25019: CVE-2020-24622: S3 secret key can be exposed by admin user
- Improvements:
  * NEXUS-10471: Allow deployment to Docker group repositories (PRO only)
  * NEXUS-21118: remove reference to deprecated Jetty socket linger time soLingerTime
  * NEXUS-25098: REST API for Conda repositories</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.28.0.01-1" date="1601640000">- Update to Nexus 3.28.0-01
- Bugfixes:
  * NEXUS-21107: Raw repo folders with special characters created using UI
                 cannot be deleted
  * NEXUS-23968: PyPiHostedFacet does not delete TempBlob on getIndex
  * NEXUS-23977: Large docker image upload does not work well with slow inbound network
  * NEXUS-24227: archetype-catalog.xml is imported by import task to a maven repository
  * NEXUS-24682: Helm repositories require the packages to be relative to the index.yaml
  * NEXUS-24718: Running "docker delete unused manifests and images" task when
                 blob storage is not available deletes all layers
  * NEXUS-24830: npm audit error with quarantined components
  * NEXUS-24833: After doing "Export assets" task then "Import external files"
                 does not preserve lastBlobUpdated (last_updated)
  * NEXUS-24846: Wrong Timezone used for Apt Release file
  * NEXUS-24868: Group does not export semver2 endpoints
                 `RegistrationsBaseUrl/Versioned` when used as NuGet V3
  * NEXUS-24916: SAML configuration error root causes are swallowed and not
                 logged at default levels
  * NEXUS-24918: npm audit should not fail if package.json contains a
                 dependency that can't be found
  * NEXUS-24998: Continuation token fails intermittently with 406 response but
                then eventually works.
  * NEXUS-24999: query params for yum related db query not logged
  * NEXUS-25036: repositories with version policy of RELEASE should avoid
                 processing any SNAPSHOT related requests
  * NEXUS-25039: Download of docker tags from hosted repository can fail with
                 400 response
  * NEXUS-25156: Npm Audit doesn't fail fast when no IQ server is configured
  * NEXUS-25190: Newly deployed RPM files do not always appear in yum metadata files
  * NEXUS-25294: DockerFacetUtils.findAssetByContentDigest NXRM 3.0.0-M7
                 backwards compatibility code is non-performant under load
  * NEXUS-25296: 502 error if a nuget-v3 group contains a proxy with different
                 nuget version
  * NEXUS-25340: IllegalArgumentException: Invalid range for Docker Pushes
  * NEXUS-25347: org.eclipse.jetty loggers do not log messages if levels are edited
  * NEXUS-25378: docker PUT and PATCH requests may write to the same blob
                 causing docker pushes to fail due to InvalidContentException:
                Content type could not be determined
- Improvements:
  * NEXUS-24842: Slow performance pushing large images to S3 based blobstore
  * NEXUS-12016: Moving repositories between blob stores (PRO only)
  * NEXUS-14448: Include IQ link in Maven output when a component blocked by Firewall
  * NEXUS-18283: Ability to Add Custom AWS S3 Regions to Blobstore Configuration
  * NEXUS-19858: Confirmation when promoting a blob store
  * NEXUS-24904: nxrm 3.26.0 introduces new ERROR level log messages from org.eclipse.jetty.util.log.StdErrLog
  * NEXUS-25099: Group deployment for NPM (PRO only)
  * NEXUS-25117: add configurability to how S3 temporary blobs are deleted
  * NEXUS-19572: Go specific search
- Other:
  * NEXUS-25336: Replace Google (Guava) Supplier with Java Supplier, people
                 consuming or implementing them will need to update those
                 usages to java.util.function.Supplier.
  * NEXUS-25209: Use DB-agnostic TempBlob where possible. Any scripts or third
                 party plugins using org.sonatype.nexus.repository.storage.TempBlob
                 will need to change to use of
                 org.sonatype.nexus.repository.view.payloads.TempBlob.

  * NEXUS-25162: Consolidate implementations of WritePolicy.
                 org.sonatype.nexus.repository.storage.WritePolicy has been
                 moved to org.sonatype.nexus.repository.config.WritePolicy.
                 This will impact any groovy scripts
                 using the org.sonatype.nexus.script.plugin.RepositoryApi to
                 create repositories.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.28.1.01-1" date="1603886400">- Update to Nexus 3.28.1-01
- Bugfixes:
  * NEXUS-25507: Fixed an issue that caused the Change repository blob store task
                 to spawn too many threads.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.0.02-1" date="1607169600">- Update to Nexus 3.29.0-02
- Bugfixes:
  * NEXUS-16575: Raw repo url returns Error 404
  * NEXUS-19840: /service/metrics/healthcheck returns 500 status code if
                 a single healthcheck fails. It is deprecated now and
                 scheduled for removal.  It is recommended to use the
                 alternative endpoint /service/rest/v1/status/check which has a
                 near equivalent JSON response, except it does not return 500
                 status when one or more system status checks fail
  * NEXUS-23733: Creating more than one file based blobstore using the same
                 root path is not prevented
  * NEXUS-23827: PACKAGES.gz cannot be updated if repository doesn't allow
                 redeploy
  * NEXUS-24331: deployment of rpm to a single directory causes metadata
                 rebuild for entire repository
  * NEXUS-24913: npm audit caching prevents policy updates
  * NEXUS-25105: HTTP 500 response when attempting to delete LDAP user via
                 REST API
  * NEXUS-25116: Getting Metadata hashes via a Maven group returns 404
                 Not found
  * NEXUS-25147: Rebuild metadata task leaves sha256 and sha512 files untouched
                 for metadata files
  * NEXUS-25158: HeaderPatternFilter may reject implicit Host value due to
                 certain combinations of X-Forwarded headers
  * NEXUS-25186: possible that requests abruptly terminating will not appear in
                 request.log
  * NEXUS-25291: NuGet V3 Proxy can be configured only using a specific remote
                 in UI field
  * NEXUS-25292: Bad blob file reference breaks repository export
  * NEXUS-25304: Health check details can fail with NPE if IQ server is setup
                 but disabled
  * NEXUS-25357: NuGet Proxy does not work with some third-party V3
                 repositories
  * NEXUS-25420: NXRM to NXRM Nuget v3 proxying still results in direct
                 requests to nuget.org
  * NEXUS-25464: Blob reference not updated in asset after change repository
  * NEXUS-25478: Nuget V3 Group packages incorrectly sorted in page causing
                 some installs to fail
  * NEXUS-25502: yum metadata is rebuilt after downloading it which can cause
                 build failures
  * NEXUS-25510: Error Response Code 429 (Rate Limiting) does not autoblock
  * NEXUS-25521: Encoded proxy URL causes startup failure
  * NEXUS-25527: Crowd "Verify connection" button deletes all inputted values
  * NEXUS-25529: Security management: Users API does not show "externalRoles"
                 for Crowd
  * NEXUS-25575: Password Validator Message not shown when changing your
                 password.
  * NEXUS-25604: Some newly deployed rpm files not showing up in
                 primary.xml.gz, despite logging saying they are being added
  * NEXUS-25605: Proxy repositories to github package registry can fail query
                 requests when accessed in a group repository
  * NEXUS-25609: Exception processing payloads for a single NuGet group member
                 repository can stop all group member processing
  * NEXUS-25628: yum metadata missing provides entries when multiple versions
                 are provided by a package
  * NEXUS-25650: Nexus-3-0 Develop Violations - 10/29/20 12:15 AM
  * NEXUS-25775: WARN messages WebResourceServiceImpl - Overlapping resources
                 on path /static/img/sonatype-logo-with-hexagon.png
  * NEXUS-25829: CVE-2020-29436: Fixes an XXE Vulnerability
  * NEXUS-25830: ClassCastException Long cannot be cast to Date for NuGet v3
                 registrations index
  * NEXUS-25928: Nexus-3-0 Develop Violations - 11/19/20 12:14 AM
- Improvements:
  * NEXUS-14631: Add more attributes to REST resource for asset
  * NEXUS-19021: Nothing is logged at default levels when roles are added or
                 removed
  * NEXUS-20267: only allow the most secure cipher suites and TLS protocol
                 versions for inbound HTTPS connections by default. See also
                 NEXUS-25786 below.
  * NEXUS-25307: Protect against deletion of related blob stores while the
                 Change Repo Blob Store task is executing
  * NEXUS-23331: Add the support of helm push plugin
  * NEXUS-25423: Add caching of catalog dates for npm component queries to IQ
  * NEXUS-25424: Add configuration for Orient's "network.binary.maxLength"
  * NEXUS-25506: change the Remote URL of the default nuget.org-proxy proxy
                 repository to api version 3 compatible https://api.nuget.org/v3/index.json.
                 Applies only to new installations. Upgrading will not modify
                 any existing remote URLs, although users are encouraged to
                 start migrating away from using NuGet V2 API URLs such as the
                 previous default (https://www.nuget.org/api/v2/).
  * NEXUS-25774: upgrade Eclipse Jetty to 9.4.33.v20201020
  * NEXUS-25786: explicitly disable TLS 1.0 and 1.1 for inbound HTTPS
                 connections by default. Only applies to Eclipse Jetty-based
                 direct inbound HTTPS connections (no reverse proxy).
                 You are encouraged to use the new settings, but if for some
                 reason you still the new TLS versions or cipher suites, check
                 https://support.sonatype.com/hc/en-us/articles/213465098</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.1.01-1" date="1608897600">- Update to Nexus 3.29.1-01
- Bugfixes:
  * NEXUS-24391: 'Destination already contains component' error when using
                 staging API
  * NEXUS-25504: Unable to pull images from hosted docker repo after move to
                 new blobstore
  * NEXUS-25600: Repository Import Ignores Validation
  * NEXUS-25611: Installing via helm proxy errors if not using official remote
  * NEXUS-25801: Group repository registration API requests may fail
  * NEXUS-25902: Source blob store is not logged in repository move task
  * NEXUS-25903: Repository blob store set incorrectly after error in "admin -
                 change repository blob store" task
  * NEXUS-25936: npm audit fails with 500 response using group and anonymous</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.2.02-1" date="1610107200">- Update to Nexus 3.29.2-02
- Bugfixes:
  * NEXUS-26251: Interface for Cleanup Policies erroneously interprets and
                 persists values as seconds instead of days. If you installed
                 3.29.1 and modified or created a cleanup policy you must
                 confirm that these fields have the intended values.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.30.0.01-1" date="1614945600">- Update to Nexus 3.30.0-01
- Bugfixes:
  * NEXUS-12022: Allow configuring HTTPS Maven proxy repositories with
                 pre-emptive authentication
  * NEXUS-18610: Raw proxy errors on URL encoded space and plus (+) characters
  * NEXUS-19181: staging NullPointerException when moving docker assets via
                 DockerComponentDirector.maybeCopyAssets
  * NEXUS-23750: Does not support npm GitHub Package Registry
  * NEXUS-24485: Docker Manifest generation is incorrect for Redeploy Disabled
                 repositories.
  * NEXUS-25148: Incremental yum rebuilds with only COMPS files are ignored
  * NEXUS-25501: Logout with anonymous off fires JS error, can malform page
  * NEXUS-25626: Docker redeploy on the latest tag fails when more than one tag
                 exists for the image
  * NEXUS-25733: NuGet v3 repository index.json generation
  * NEXUS-25783: Browse of NuGet packages from visual studio fails if user
                 doesn't have browse privileges to all group members
  * NEXUS-25784: Browse request to NuGet v3 search URL in group fails
                 completely if one of the group's members has DNS lookup
                 failure
  * NEXUS-25868: Podman push of new image tag fails when docker cli push
                 succeeds for the same actions
  * NEXUS-25904: The "admin - change repository blob store" task should not
                 allow selection of a promoted blob store
  * NEXUS-25908: nuget restore does not resolve inbound normalized package
                 versions to unnormalized published versions using NuGet v3
  * NEXUS-25924: If the remote of a NuGet v3 proxy is not reachable it breaks
                 requests to a NuGet group
  * NEXUS-25985: "Docker - Delete unused manifests and images" task deletes
                 digest manifests referenced by other manifests
  * NEXUS-26003: Helm proxy : difference between helm index file and real
                 artifact url
  * NEXUS-26036: wrong issuer displayed for trusted SSL certificates
  * NEXUS-26093: Create proxy repository in API UI fails due to password
                 missing from Authentication JSON
  * NEXUS-26099: No way to set "useTrustStore" in proxy repository REST API
  * NEXUS-26118: pip search does not work *via* NXRM PyPI proxy to NXRM PyPI
                 repository and authentication is required
  * NEXUS-26129: Promoting a nested blob store causes it to be removed entirely
  * NEXUS-26132: upgrade of NXRM 2 to NXRM 3 maven assets fails due to
                 IllegalStateException: Missing {attributes:checksum} sha256
  * NEXUS-26315: Cleanup Policy List shows Error 500 after Upgrade 3.28.0
                 to 3.29.2
  * NEXUS-26355: sha512 or sha256 hashes are processed by expensive repository
                 content validation
  * NEXUS-26379: DockerFacetUtils.findAssetByContentDigest() causes poor
                 performance under load
  * NEXUS-26453: saving the s3 blobstore config can break async tmp blob
                deletes by not restarting the async delete thread pool
  * NEXUS-26473: Thread cooperation does not work when recovering from missing
                 blobs in proxy repositories
  * NEXUS-26483: Nexus UI causes Uncaught TypeError when the username contains
                 'api' string with privilege 'nx-api-reader'
  * NEXUS-26504: Newly created compact blob store task has "multinode=true"
  * NEXUS-26605: Rebuild metadata fails to rebuild corrupt metadata files
  * NEXUS-26611: conda proxy repositories do not support inbound conditional
                 HTTP GET HEAD
  * NEXUS-26676: IllegalOperationException: Repair - Rebuild Maven repository
                 metadata
- Improvements:
  * NEXUS-24446: Add Azure Blob Storage support to NXRM blob store
  * NEXUS-25275: improve docker repository human readable error response
                 messages
  * NEXUS-25623: Provide a different status than Quarantined for components
                 Pending Quarantine
  * NEXUS-25909: Protect inbound HTTPS connections against Weak Diffie-Hellman
                 Keys and Logjam by default
  * NEXUS-26196: Allow enabling truststore with Repository Management REST API
  * NEXUS-26319: remove reference to sonatype-public-grid from pom files
  * NEXUS-26606: Upgrade Eclipse Jetty to 9.4.38.v20210224</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.30.1.01-1" date="1619179200">- Update to Nexus 3.30.1-01
- Bugfixes:
  * Security fix for CVE-2021-30635 (Information Disclosure).
    See https://support.sonatype.com/hc/en-us/articles/1500006879561 for
    details.
  * Security fix for CVE-2021-29159 (XSS vulnerability).
    See https://support.sonatype.com/hc/en-us/articles/1500005031082 for
    details.
  * Security fix for CVE-2021-29158 (Sensitive Information Disclosure).
    See https://support.sonatype.com/hc/en-us/articles/1500006126462 for
    details.
  * NEXUS-27384: Upgrade Eclipse Jetty to 9.4.40.v20210413
  * NEXUS-26789: Performance improvement to rebuilding GA maven-metadata.xml
  * NEXUS-26501: Package content is out of specification when downloading from NuGet hosted
  * NEXUS-27013: Raw proxy is encoding slashes for outbound requests
  * NEXUS-26855: Non-indexed raw proxy repositories cannot be browsed</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.31.0.01-1" date="1623931200">- Update to Nexus 3.31.0-01
- Bugfixes:
  * NEXUS-26177: Deleting an npm repository or invalidating the cache breaks
                 npm audit.
  * NEXUS-26312: "Last downloaded" not updating consistently in NuGet.
  * NEXUS-26358: WARN messages from SupportRestorer Can't find file to
                 restore data
  * NEXUS-27614: PyPI can swallow errors when the simple index is being
                 re-written.
  * NEXUS-26683: "Remove a member from a blob store group" task can't remove a
                 blob store if one bytes file is missing
  * NEXUS-26732: Race Condition in Docker format can cause assets to be
                 mistakenly deleted.
  * NEXUS-26737: Deleting manifest with Docker API does not delete all tags.
  * NEXUS-26829: Copy and config links incorrect for nuget V3 proxy repos
  * NEXUS-26845: HTTP error status code not logged on proxy repository
                automatic blocking
  * NEXUS-26938: Use HEAD request to determine whether remote content has changed
                 instead of conditional GET to avoid hitting DockerHub rate
                 limit prematurely.
  * NEXUS-26971: Incorrect results can be returned when using npm show with
                 group repositories.
  * NEXUS-27014: Cleanup policies and tasks do not fully consider Docker layers
                 can be referenced by manifests in other repositories.
  * NEXUS-27015: IllegalArgumentException on Publish Maven Index task.
  * NEXUS-27130: GA maven-metadata.xml fails to refresh if a GAV is deleted via
                 Browse's "Delete Folder" button
  * NEXUS-27182: Blob paths traversal
  * NEXUS-27427: Blank values for NuGet attributes.
  * NEXUS-27436: npm metadata rebuild failing due to NPE.
  * NEXUS-27563: S3 connection pool exhaustion when merging repomd.xml in group
                 repositories.
  * NEXUS-27564: Yum Group repomd.xml merge connection pool exhaustion causes
                 problems.
- Improvements:
  * NEXUS-20252: Support Staging with PyPI format.
  * NEXUS-23959: Define BlobStoreApiSoftQuota type allowableValues
  * NEXUS-24311: Added hardlinks to import/export.
  * NEXUS-26617: Upgrade karaf to 4.3.0
  * NEXUS-26931: Added UI validation to ensure container name is all lower case
                 alphanumeric.
  * NEXUS-27597: Add ability to run `Repair - Reconcile component database from
                 blob store` against a subset by time
  * NEXUS-27683: StorageFacetCleanupTaskManager should remove &amp; schedule task.
  * NEXUS-27953: Upgrade Eclipse Jetty to 9.4.42.v20210604.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.31.1.01-1" date="1624622400">- Update to Nexus 3.31.1-01
- Bugfixes:
  * CVE-2021-34553: Information disclosure vulnerability fixed. Sonatype Nexus
                    Repository 3 up to 3.31.0 allows a remote authenticated
                    attacker to get a list of blob files and read the content
                    of a blob file (via a crafted GET request) without having
                    been granted access.
  * NEXUS-28078: Docker - Delete unused manifests and images task may delete
                 referenced layers if the database query to select components
                 encounters limits</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.32.0.03-1" date="1625832000">- Update to Nexus 3.32.0-03
- Bugfixes:
  * NEXUS-27469: Using AzureBlobStore causes docker image upload failure with
                 'digest invalid' error
  * NEXUS-27617: Unable to configure SAML on docker image due to bug in
                 included OpenJDK
  * NEXUS-27753: The latest package version doesn't change in package root
                 after component deleting
  * NEXUS-28247: Docker GC Task incorrectly removing manifests and layers
- Improvements:
  * NEXUS-28203: Replication (Product Preview, PRO only)
  * NEXUS-28205: APT Format support in PostgreSQL</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.33.0.01-1" date="1628164800">- Update to Nexus 3.33.0-01
- Bugfixes:
  * NEXUS-27428: redundant download count attribute for NuGet v3
  * NEXUS-28277: Fetching group npm package metadata concurrently can cause
                 OConcurrentModificationException
  * NEXUS-28362: slow request processing due to group trying to locate blobs in
                 the wrong blobstore
  * NEXUS-28381: Webhook ConnectionPoolTimeoutException: Timeout waiting for
                 connection from pool after sending 20 requests
  * NEXUS-28442: XSS injection
- Improvements:
  * NEXUS-28543: Conda Format support in Postgres (PRO only)
  * NEXUS-28544: Git LFS Format support in Postgres (PRO only
  * NEXUS-28545: R Format support in Postgres (PRO only
  * NEXUS-28561: Conan Format support in Postgres (PRO only
  * NEXUS-28562: npm format support in Postgres (PRO only
  * Improvements to Resilient Nexus Repository Deployment Architecture</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.33.1.01-1" date="1630670400">- Update to Nexus 3.33.1-01
- Bugfixes:
  * NEXUS-28081: Nexus 2 migration to Nexus 3 fails due to permissions of
                 unsupported formats on PostgreSQL databases
- Improvements:
  * Updated Eclipse Jetty Version to 9.4.43.v20210629
  * Changes to Cloud Resiliency Architecture Example: remove the dependency on
    Amazon Elastic File System (EFS). The improved example provides new YAML
    files to help you set up Fluent Bit and CloudWatch in order to externalize
    your logs. This will allow you to capture comprehensive logs even if Nexus
    Repository runs on separate nodes within the same day.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.34.0.01-1" date="1630843200">- Update to Nexus 3.34.0-01
- Bugfixes:
  * NEXUS-27932: "Manifest invalid" message when running the Docker GC task.
  * NEXUS-28394: Last downloaded field not properly updating when installing
                 or downloading through R proxy
  * NEXUS-28458: logged ERROR LastShutdownTimeServiceImpl 'Failed to process
                 file - Assuming no previous start time' on startup
  * NEXUS-28620: Nexus Database Migrator fails when symlink is used for data
                 directory or data directory not in standard location
  * NEXUS-28807: Nexus-3-0 Stage-release Violations - 08/27/21 12:19 AM
  * NEXUS-28808: Policy violation of com.thoughtworks.xstream : xstream: 1.4.17
  * NEXUS-28853: This release includes a security fix for an HTTP header
                 injection. See the CVE-2021-40143 advisory for full details.
                 If you are using an earlier version, you should upgrade to
                 this release immediately
- Improvements:
  * NEXUS-28266: make S3 Connection Time to Live (TTL) setting configurable to
                 help avoid socket connect timeouts
  * Repository Replication (PRO only)
  * NEXUS-28780: New Formats Supported for PostgreSQL and H2 Databases
                 (PRO only):
    &gt; NEXUS-28677: CocoaPods Format support in Postgres (PRO only)
    &gt; NEXUS-28678: Go Format support in Postgres (PRO only)
    &gt; NEXUS-28781: Rubygems Format support in Postgres (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.34.1.01-1" date="1632657600">- Update to Nexus 3.34.1-01
- Bugfixes:
  * NEXUS-28768: To facilitate migrating from Nexus Repository 2 to Nexus
                 Repository 3, the npm package.json author field can now accept 
                 both map and string values
  * NEXUS-28815: NullPointerException at
                 com.sonatype.nexus.migration.repository.migrators.datastore.NpmRepositoryMigrator.recordMetadata
  * NEXUS-28821: org.sonatype.nexus.datastore.api.DuplicateKeyException in
                 org.sonatype.nexus.repository.content.browse.store.BrowseNodeStore.mergeBrowseNode
- Improvements:
  * NEXUS-28522: change the default location for storing import task metadata
  * NEXUS-28819: log in repo 3 application log the 2 to 3 migration state to 
                 make it easy to determine why migration cannot be ended gracefully</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.35.0.02-1" date="1634212800">- Update to Nexus 3.35.0-02
- Bugfixes:
  * NEXUS-20284: Default content type for raw repositories is now "text/plain"
  * NEXUS-26313: WWW-AUTHENTICATE header does not include needed scope of
                 token
  * NEXUS-26642: A removed docker asset at a remote will cause an already
                 cached docker asset to be removed from a proxy repository when
                 component age expires
  * NEXUS-27125: npm proxy repo audit requests may trigger
                 IllegalStateException Missing
                 org.sonatype.nexus.repository.view.matchers.token.TokenMatcher$State
                 while getting cached content
  * NEXUS-27318: Maven - Publish Maven Indexer files task leaks inputstream
  * NEXUS-27372: Delete of npm package tarball silently fails if the version
                 isn't in package root metadata
  * NEXUS-27628: Application id is not logged at any level when provided by npm
                 audit command
  * NEXUS-28166: Yum metadata not refreshed because of relying on
                 "metadata_generation_time"
  * NEXUS-28621: Nexus DB Migrator 3.33.0 fails with
                 java.lang.StringIndexOutOfBoundsException error
  * NEXUS-28805: Migrator attempts to migrate tagged components before tags
                 have been processed resulting in NullPointerException
                 executing step processComponentStep
  * NEXUS-28842: Github npm package registry does not work with Nexus Repo 3
  * NEXUS-28898: Contention rebuilding Maven hosted archetype-catalog.xml
                 during repository 2 to 3 migration
  * NEXUS-28908: Stuck RUNNABLE postgresql queries on
                 SocketInputStream.socketRead0(Native Method)
  * NEXUS-28922: Azure Blobstore creation fails with using Nexus 3.34.0-01 with
                 PostgresDB
- Improvements:
  * NEXUS-16580: Migrate nx2 artifact information to nx3 during migration
  * NEXUS-28686: Provide an option to not migrate repository content for
                 repositories that are selected for migration from repo 2 to
                 repo 3
  * NEXUS-28891: Avoid building browse feature information during repository 2
                 to 3 migration to improve migration performance
  * NEXUS-28924: Option to force the migration process to end without abort
                 before all content is migrated
  * Firewall Integration Improvement: Policy-Compliant Component Selection
    for npm
  * Faster Imports with Hardlink Support for All Formats
  * Improvements to Repository Replication (PRO only):
    &gt; Replicator Now Supports Docker and npm Formats
    &gt; Replicator Now Runs Continuously by Default
    &gt; New Replication Administrator Role
  * Updated Database Migrator for Easier Migration Between PostgreSQL and H2
    Databases (PRO only)
  * Conan Hosted Support for PostgreSQL and H2 Databases (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.36.0.01-1" date="1636459200">- Update to Nexus 3.36.0-01
- Bugfixes:
  * NEXUS-29088: Running the replication backfill blob attributes task will now
                 process all blobs as expected.
  * NEXUS-29319: This release includes a security fix for an incorrect access
                 control. See the CVE-2021-42568 for full details.
  * NEXUS-29407: This release includes a security fix for a server side request
                 forgery vulnerability. See CVE-2021-43293 for full details.
  * NEXUS-21814: Repair - Reconcile component database from blobstore may not
                 process PyPI assets correctly
  * NEXUS-27629: logging is too verbose when the submitted application id from
                 npm audit is not found in the connected IQ server
  * NEXUS-28714: Content validation does not work properly for OCI
  * NEXUS-28717: "Docker - Delete unused manifests and images" task attempts to
                 read files from the wrong Blob Store.
  * NEXUS-28779: Use cases for name and type properties for datastores can be
                  confusing
  * NEXUS-29338: Image push after Nexus Repository upgrade not possible
- Improvements:
  * NEXUS-24332: Optimized How Yum Metadata is Rebuilt
  * Faster Migration from Nexus Repository 2 to Nexus Repository 3
  * Replication Improvement: Use Truststore Certificates for Replication
    Connection (PRO only)
  * Improvements to Database Migration to H2 or PostgreSQL (PRO only)
    &gt; Added OrientDB Health Check to Database Migration (PRO only)
    &gt; NEXUS-28789: Added Nexus Repository Database Version Check PRO (PRO only)
  * Documentation Improvement: New Resiliency Example Using Azure  (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.0.01-1" date="1637928000">- Update to Nexus 3.37.0-01
- Bugfixes:
  * NEXUS-17624: YUM repomd.xml not deleted from empty level-1 hosted
                 repository
  * NEXUS-19089: large set of dirs/files under directpath/nexus-repository-docker
                  dir
  * NEXUS-21878: failing to start one docker connector on startup prevents all
                  other not started docker connectors from starting
  * NEXUS-22125: Unable to query image tags via Registry API for proxied gcr.io
  * NEXUS-26970: Docker proxy repository returns 502 when remote returns 401
  * NEXUS-27033: Deploy of newly tagged multiarch manifest not permitted when
                 redeploy is disabled
  * NEXUS-27631: Download of docker manifest via UI fails if there is no
                 history in the manifest
  * NEXUS-27674: Unable to download conda component that was released from
                 quarantine
  * NEXUS-27788: "Docker - Delete incomplete uploads" task blocks all docker
                 uploads
  * NEXUS-28717: "Docker - Delete unused manifests and images" task attempts to
                 read files from the wrong Blob Store.
  * NEXUS-28855: Blob store space used constraint says ?in MB? but it
                 stores in bytes
  * NEXUS-28918: Search API does not sort alpha-numeric versions correctly
  * NEXUS-28921: Browse page is empty after migrating to the New DB because
                 Rebuild repository browse tree task fails to be stored due to
                 long name
  * NEXUS-29234: java.lang.NumberFormatException for S3 blob stores on upgrade
  * NEXUS-29342: Yum generated temp files are not deleted
  * NEXUS-29343: Intermittent MissingBlobExceptions for Concurrent Requests
  * NEXUS-29380: NX3: reconcile from blob store task can generate invalid npm
                 version entries in metadata
  * NEXUS-29433: fetching identical group npm package metadata concurrently can
                 result in uncooperative threads and increased blobstore and
                 database load
- Improvements:
  * NEXUS-16580: Migrate nx2 artifact information to nx3 during migration
  * NEXUS-27145: Allow rebuild maven metadata task to fix invalid blob
                 references for maven-metadata.xml
  * NEXUS-28844: option to rebuild npm package metadata per repo or package
  * NEXUS-28896: improve INSERT performance into format specific browse_node
                 tables
  * New "Repair - Rebuild npm metadata" Task
  * The "Repair - Rebuild Maven repository metadata" Task Fixes Invalid Blob
    References for maven-metadata.xml
  * Retain Information About Assets Migrated from Nexus Repository Version 2 to
    Version 3
  * Improved S3 Blob Store Performance
  * Replication Support for NuGet and PyPI  (PRO only)
  * Improved Performance for those Migrating to Nexus Repository 3 with an
    External PostgreSQL Database (PRO only)
  * Improved Resilient Deployment Options (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.1.01-1" date="1639828800">- Update to Nexus 3.37.1-01
- Bugfixes:
  * logback library update to fix a low/moderate vulnerability, as a precautionary
    measure. No known exploit of Nexus Repository via logback at this time.</changelog>
</package>
<package pkgid="ea220cbf3cdb7a2e70c954a6e38b2c63c9b01840401b5e092991614d5f67afba" name="nexus3" arch="x86_64">
  <version epoch="0" ver="3.37.1.01" rel="1.fc30.1"/>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.26.1.02-1" date="1597579200">- Update to Nexus 3.26.1.04-1
- Bugfixes:
  * NEXUS-24867: Fix an issue starting server when multiple SSL certificates are present in the configured keystore.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.27.0.03-1" date="1599307200">- Update to Nexus 3.27.0-03
- Bugfixes:
  * NEXUS-24298: Yum proxy needs to be more lenient about gzip encoding
  * NEXUS-24464: NuGet Signature validation goes out to https://api.nuget.org
  * NEXUS-24691: OCI annotations result in errors
  * NEXUS-24802: Spurious warnings logged when running reconcile task against group blob store
  * NEXUS-24837: Metadata query cache age and Maximum metadata age timeouts are ignored for metadata requests
  * NEXUS-24869: Moving away from the Logging page asks "Unsaved changes"
  * NEXUS-24901: some rpms in a yum hosted repo are not added to a rebuilt hosted repo primary.xml metadata file
  * NEXUS-24917: npm audit fails for packages that are not all lowercase
  * NEXUS-24925: Unneeded JSESSIONID cookies returned
  * NEXUS-24988: Snapshot remover deletes GAV level maven-metadata.xml files, resulting in 404 responses
  * NEXUS-25019: CVE-2020-24622: S3 secret key can be exposed by admin user
- Improvements:
  * NEXUS-10471: Allow deployment to Docker group repositories (PRO only)
  * NEXUS-21118: remove reference to deprecated Jetty socket linger time soLingerTime
  * NEXUS-25098: REST API for Conda repositories</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.28.0.01-1" date="1601640000">- Update to Nexus 3.28.0-01
- Bugfixes:
  * NEXUS-21107: Raw repo folders with special characters created using UI
                 cannot be deleted
  * NEXUS-23968: PyPiHostedFacet does not delete TempBlob on getIndex
  * NEXUS-23977: Large docker image upload does not work well with slow inbound network
  * NEXUS-24227: archetype-catalog.xml is imported by import task to a maven repository
  * NEXUS-24682: Helm repositories require the packages to be relative to the index.yaml
  * NEXUS-24718: Running "docker delete unused manifests and images" task when
                 blob storage is not available deletes all layers
  * NEXUS-24830: npm audit error with quarantined components
  * NEXUS-24833: After doing "Export assets" task then "Import external files"
                 does not preserve lastBlobUpdated (last_updated)
  * NEXUS-24846: Wrong Timezone used for Apt Release file
  * NEXUS-24868: Group does not export semver2 endpoints
                 `RegistrationsBaseUrl/Versioned` when used as NuGet V3
  * NEXUS-24916: SAML configuration error root causes are swallowed and not
                 logged at default levels
  * NEXUS-24918: npm audit should not fail if package.json contains a
                 dependency that can't be found
  * NEXUS-24998: Continuation token fails intermittently with 406 response but
                then eventually works.
  * NEXUS-24999: query params for yum related db query not logged
  * NEXUS-25036: repositories with version policy of RELEASE should avoid
                 processing any SNAPSHOT related requests
  * NEXUS-25039: Download of docker tags from hosted repository can fail with
                 400 response
  * NEXUS-25156: Npm Audit doesn't fail fast when no IQ server is configured
  * NEXUS-25190: Newly deployed RPM files do not always appear in yum metadata files
  * NEXUS-25294: DockerFacetUtils.findAssetByContentDigest NXRM 3.0.0-M7
                 backwards compatibility code is non-performant under load
  * NEXUS-25296: 502 error if a nuget-v3 group contains a proxy with different
                 nuget version
  * NEXUS-25340: IllegalArgumentException: Invalid range for Docker Pushes
  * NEXUS-25347: org.eclipse.jetty loggers do not log messages if levels are edited
  * NEXUS-25378: docker PUT and PATCH requests may write to the same blob
                 causing docker pushes to fail due to InvalidContentException:
                Content type could not be determined
- Improvements:
  * NEXUS-24842: Slow performance pushing large images to S3 based blobstore
  * NEXUS-12016: Moving repositories between blob stores (PRO only)
  * NEXUS-14448: Include IQ link in Maven output when a component blocked by Firewall
  * NEXUS-18283: Ability to Add Custom AWS S3 Regions to Blobstore Configuration
  * NEXUS-19858: Confirmation when promoting a blob store
  * NEXUS-24904: nxrm 3.26.0 introduces new ERROR level log messages from org.eclipse.jetty.util.log.StdErrLog
  * NEXUS-25099: Group deployment for NPM (PRO only)
  * NEXUS-25117: add configurability to how S3 temporary blobs are deleted
  * NEXUS-19572: Go specific search
- Other:
  * NEXUS-25336: Replace Google (Guava) Supplier with Java Supplier, people
                 consuming or implementing them will need to update those
                 usages to java.util.function.Supplier.
  * NEXUS-25209: Use DB-agnostic TempBlob where possible. Any scripts or third
                 party plugins using org.sonatype.nexus.repository.storage.TempBlob
                 will need to change to use of
                 org.sonatype.nexus.repository.view.payloads.TempBlob.

  * NEXUS-25162: Consolidate implementations of WritePolicy.
                 org.sonatype.nexus.repository.storage.WritePolicy has been
                 moved to org.sonatype.nexus.repository.config.WritePolicy.
                 This will impact any groovy scripts
                 using the org.sonatype.nexus.script.plugin.RepositoryApi to
                 create repositories.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.28.1.01-1" date="1603886400">- Update to Nexus 3.28.1-01
- Bugfixes:
  * NEXUS-25507: Fixed an issue that caused the Change repository blob store task
                 to spawn too many threads.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.0.02-1" date="1607169600">- Update to Nexus 3.29.0-02
- Bugfixes:
  * NEXUS-16575: Raw repo url returns Error 404
  * NEXUS-19840: /service/metrics/healthcheck returns 500 status code if
                 a single healthcheck fails. It is deprecated now and
                 scheduled for removal.  It is recommended to use the
                 alternative endpoint /service/rest/v1/status/check which has a
                 near equivalent JSON response, except it does not return 500
                 status when one or more system status checks fail
  * NEXUS-23733: Creating more than one file based blobstore using the same
                 root path is not prevented
  * NEXUS-23827: PACKAGES.gz cannot be updated if repository doesn't allow
                 redeploy
  * NEXUS-24331: deployment of rpm to a single directory causes metadata
                 rebuild for entire repository
  * NEXUS-24913: npm audit caching prevents policy updates
  * NEXUS-25105: HTTP 500 response when attempting to delete LDAP user via
                 REST API
  * NEXUS-25116: Getting Metadata hashes via a Maven group returns 404
                 Not found
  * NEXUS-25147: Rebuild metadata task leaves sha256 and sha512 files untouched
                 for metadata files
  * NEXUS-25158: HeaderPatternFilter may reject implicit Host value due to
                 certain combinations of X-Forwarded headers
  * NEXUS-25186: possible that requests abruptly terminating will not appear in
                 request.log
  * NEXUS-25291: NuGet V3 Proxy can be configured only using a specific remote
                 in UI field
  * NEXUS-25292: Bad blob file reference breaks repository export
  * NEXUS-25304: Health check details can fail with NPE if IQ server is setup
                 but disabled
  * NEXUS-25357: NuGet Proxy does not work with some third-party V3
                 repositories
  * NEXUS-25420: NXRM to NXRM Nuget v3 proxying still results in direct
                 requests to nuget.org
  * NEXUS-25464: Blob reference not updated in asset after change repository
  * NEXUS-25478: Nuget V3 Group packages incorrectly sorted in page causing
                 some installs to fail
  * NEXUS-25502: yum metadata is rebuilt after downloading it which can cause
                 build failures
  * NEXUS-25510: Error Response Code 429 (Rate Limiting) does not autoblock
  * NEXUS-25521: Encoded proxy URL causes startup failure
  * NEXUS-25527: Crowd "Verify connection" button deletes all inputted values
  * NEXUS-25529: Security management: Users API does not show "externalRoles"
                 for Crowd
  * NEXUS-25575: Password Validator Message not shown when changing your
                 password.
  * NEXUS-25604: Some newly deployed rpm files not showing up in
                 primary.xml.gz, despite logging saying they are being added
  * NEXUS-25605: Proxy repositories to github package registry can fail query
                 requests when accessed in a group repository
  * NEXUS-25609: Exception processing payloads for a single NuGet group member
                 repository can stop all group member processing
  * NEXUS-25628: yum metadata missing provides entries when multiple versions
                 are provided by a package
  * NEXUS-25650: Nexus-3-0 Develop Violations - 10/29/20 12:15 AM
  * NEXUS-25775: WARN messages WebResourceServiceImpl - Overlapping resources
                 on path /static/img/sonatype-logo-with-hexagon.png
  * NEXUS-25829: CVE-2020-29436: Fixes an XXE Vulnerability
  * NEXUS-25830: ClassCastException Long cannot be cast to Date for NuGet v3
                 registrations index
  * NEXUS-25928: Nexus-3-0 Develop Violations - 11/19/20 12:14 AM
- Improvements:
  * NEXUS-14631: Add more attributes to REST resource for asset
  * NEXUS-19021: Nothing is logged at default levels when roles are added or
                 removed
  * NEXUS-20267: only allow the most secure cipher suites and TLS protocol
                 versions for inbound HTTPS connections by default. See also
                 NEXUS-25786 below.
  * NEXUS-25307: Protect against deletion of related blob stores while the
                 Change Repo Blob Store task is executing
  * NEXUS-23331: Add the support of helm push plugin
  * NEXUS-25423: Add caching of catalog dates for npm component queries to IQ
  * NEXUS-25424: Add configuration for Orient's "network.binary.maxLength"
  * NEXUS-25506: change the Remote URL of the default nuget.org-proxy proxy
                 repository to api version 3 compatible https://api.nuget.org/v3/index.json.
                 Applies only to new installations. Upgrading will not modify
                 any existing remote URLs, although users are encouraged to
                 start migrating away from using NuGet V2 API URLs such as the
                 previous default (https://www.nuget.org/api/v2/).
  * NEXUS-25774: upgrade Eclipse Jetty to 9.4.33.v20201020
  * NEXUS-25786: explicitly disable TLS 1.0 and 1.1 for inbound HTTPS
                 connections by default. Only applies to Eclipse Jetty-based
                 direct inbound HTTPS connections (no reverse proxy).
                 You are encouraged to use the new settings, but if for some
                 reason you still the new TLS versions or cipher suites, check
                 https://support.sonatype.com/hc/en-us/articles/213465098</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.1.01-1" date="1608897600">- Update to Nexus 3.29.1-01
- Bugfixes:
  * NEXUS-24391: 'Destination already contains component' error when using
                 staging API
  * NEXUS-25504: Unable to pull images from hosted docker repo after move to
                 new blobstore
  * NEXUS-25600: Repository Import Ignores Validation
  * NEXUS-25611: Installing via helm proxy errors if not using official remote
  * NEXUS-25801: Group repository registration API requests may fail
  * NEXUS-25902: Source blob store is not logged in repository move task
  * NEXUS-25903: Repository blob store set incorrectly after error in "admin -
                 change repository blob store" task
  * NEXUS-25936: npm audit fails with 500 response using group and anonymous</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.29.2.02-1" date="1610107200">- Update to Nexus 3.29.2-02
- Bugfixes:
  * NEXUS-26251: Interface for Cleanup Policies erroneously interprets and
                 persists values as seconds instead of days. If you installed
                 3.29.1 and modified or created a cleanup policy you must
                 confirm that these fields have the intended values.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.30.0.01-1" date="1614945600">- Update to Nexus 3.30.0-01
- Bugfixes:
  * NEXUS-12022: Allow configuring HTTPS Maven proxy repositories with
                 pre-emptive authentication
  * NEXUS-18610: Raw proxy errors on URL encoded space and plus (+) characters
  * NEXUS-19181: staging NullPointerException when moving docker assets via
                 DockerComponentDirector.maybeCopyAssets
  * NEXUS-23750: Does not support npm GitHub Package Registry
  * NEXUS-24485: Docker Manifest generation is incorrect for Redeploy Disabled
                 repositories.
  * NEXUS-25148: Incremental yum rebuilds with only COMPS files are ignored
  * NEXUS-25501: Logout with anonymous off fires JS error, can malform page
  * NEXUS-25626: Docker redeploy on the latest tag fails when more than one tag
                 exists for the image
  * NEXUS-25733: NuGet v3 repository index.json generation
  * NEXUS-25783: Browse of NuGet packages from visual studio fails if user
                 doesn't have browse privileges to all group members
  * NEXUS-25784: Browse request to NuGet v3 search URL in group fails
                 completely if one of the group's members has DNS lookup
                 failure
  * NEXUS-25868: Podman push of new image tag fails when docker cli push
                 succeeds for the same actions
  * NEXUS-25904: The "admin - change repository blob store" task should not
                 allow selection of a promoted blob store
  * NEXUS-25908: nuget restore does not resolve inbound normalized package
                 versions to unnormalized published versions using NuGet v3
  * NEXUS-25924: If the remote of a NuGet v3 proxy is not reachable it breaks
                 requests to a NuGet group
  * NEXUS-25985: "Docker - Delete unused manifests and images" task deletes
                 digest manifests referenced by other manifests
  * NEXUS-26003: Helm proxy : difference between helm index file and real
                 artifact url
  * NEXUS-26036: wrong issuer displayed for trusted SSL certificates
  * NEXUS-26093: Create proxy repository in API UI fails due to password
                 missing from Authentication JSON
  * NEXUS-26099: No way to set "useTrustStore" in proxy repository REST API
  * NEXUS-26118: pip search does not work *via* NXRM PyPI proxy to NXRM PyPI
                 repository and authentication is required
  * NEXUS-26129: Promoting a nested blob store causes it to be removed entirely
  * NEXUS-26132: upgrade of NXRM 2 to NXRM 3 maven assets fails due to
                 IllegalStateException: Missing {attributes:checksum} sha256
  * NEXUS-26315: Cleanup Policy List shows Error 500 after Upgrade 3.28.0
                 to 3.29.2
  * NEXUS-26355: sha512 or sha256 hashes are processed by expensive repository
                 content validation
  * NEXUS-26379: DockerFacetUtils.findAssetByContentDigest() causes poor
                 performance under load
  * NEXUS-26453: saving the s3 blobstore config can break async tmp blob
                deletes by not restarting the async delete thread pool
  * NEXUS-26473: Thread cooperation does not work when recovering from missing
                 blobs in proxy repositories
  * NEXUS-26483: Nexus UI causes Uncaught TypeError when the username contains
                 'api' string with privilege 'nx-api-reader'
  * NEXUS-26504: Newly created compact blob store task has "multinode=true"
  * NEXUS-26605: Rebuild metadata fails to rebuild corrupt metadata files
  * NEXUS-26611: conda proxy repositories do not support inbound conditional
                 HTTP GET HEAD
  * NEXUS-26676: IllegalOperationException: Repair - Rebuild Maven repository
                 metadata
- Improvements:
  * NEXUS-24446: Add Azure Blob Storage support to NXRM blob store
  * NEXUS-25275: improve docker repository human readable error response
                 messages
  * NEXUS-25623: Provide a different status than Quarantined for components
                 Pending Quarantine
  * NEXUS-25909: Protect inbound HTTPS connections against Weak Diffie-Hellman
                 Keys and Logjam by default
  * NEXUS-26196: Allow enabling truststore with Repository Management REST API
  * NEXUS-26319: remove reference to sonatype-public-grid from pom files
  * NEXUS-26606: Upgrade Eclipse Jetty to 9.4.38.v20210224</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.30.1.01-1" date="1619179200">- Update to Nexus 3.30.1-01
- Bugfixes:
  * Security fix for CVE-2021-30635 (Information Disclosure).
    See https://support.sonatype.com/hc/en-us/articles/1500006879561 for
    details.
  * Security fix for CVE-2021-29159 (XSS vulnerability).
    See https://support.sonatype.com/hc/en-us/articles/1500005031082 for
    details.
  * Security fix for CVE-2021-29158 (Sensitive Information Disclosure).
    See https://support.sonatype.com/hc/en-us/articles/1500006126462 for
    details.
  * NEXUS-27384: Upgrade Eclipse Jetty to 9.4.40.v20210413
  * NEXUS-26789: Performance improvement to rebuilding GA maven-metadata.xml
  * NEXUS-26501: Package content is out of specification when downloading from NuGet hosted
  * NEXUS-27013: Raw proxy is encoding slashes for outbound requests
  * NEXUS-26855: Non-indexed raw proxy repositories cannot be browsed</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.31.0.01-1" date="1623931200">- Update to Nexus 3.31.0-01
- Bugfixes:
  * NEXUS-26177: Deleting an npm repository or invalidating the cache breaks
                 npm audit.
  * NEXUS-26312: "Last downloaded" not updating consistently in NuGet.
  * NEXUS-26358: WARN messages from SupportRestorer Can't find file to
                 restore data
  * NEXUS-27614: PyPI can swallow errors when the simple index is being
                 re-written.
  * NEXUS-26683: "Remove a member from a blob store group" task can't remove a
                 blob store if one bytes file is missing
  * NEXUS-26732: Race Condition in Docker format can cause assets to be
                 mistakenly deleted.
  * NEXUS-26737: Deleting manifest with Docker API does not delete all tags.
  * NEXUS-26829: Copy and config links incorrect for nuget V3 proxy repos
  * NEXUS-26845: HTTP error status code not logged on proxy repository
                automatic blocking
  * NEXUS-26938: Use HEAD request to determine whether remote content has changed
                 instead of conditional GET to avoid hitting DockerHub rate
                 limit prematurely.
  * NEXUS-26971: Incorrect results can be returned when using npm show with
                 group repositories.
  * NEXUS-27014: Cleanup policies and tasks do not fully consider Docker layers
                 can be referenced by manifests in other repositories.
  * NEXUS-27015: IllegalArgumentException on Publish Maven Index task.
  * NEXUS-27130: GA maven-metadata.xml fails to refresh if a GAV is deleted via
                 Browse's "Delete Folder" button
  * NEXUS-27182: Blob paths traversal
  * NEXUS-27427: Blank values for NuGet attributes.
  * NEXUS-27436: npm metadata rebuild failing due to NPE.
  * NEXUS-27563: S3 connection pool exhaustion when merging repomd.xml in group
                 repositories.
  * NEXUS-27564: Yum Group repomd.xml merge connection pool exhaustion causes
                 problems.
- Improvements:
  * NEXUS-20252: Support Staging with PyPI format.
  * NEXUS-23959: Define BlobStoreApiSoftQuota type allowableValues
  * NEXUS-24311: Added hardlinks to import/export.
  * NEXUS-26617: Upgrade karaf to 4.3.0
  * NEXUS-26931: Added UI validation to ensure container name is all lower case
                 alphanumeric.
  * NEXUS-27597: Add ability to run `Repair - Reconcile component database from
                 blob store` against a subset by time
  * NEXUS-27683: StorageFacetCleanupTaskManager should remove &amp; schedule task.
  * NEXUS-27953: Upgrade Eclipse Jetty to 9.4.42.v20210604.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.31.1.01-1" date="1624622400">- Update to Nexus 3.31.1-01
- Bugfixes:
  * CVE-2021-34553: Information disclosure vulnerability fixed. Sonatype Nexus
                    Repository 3 up to 3.31.0 allows a remote authenticated
                    attacker to get a list of blob files and read the content
                    of a blob file (via a crafted GET request) without having
                    been granted access.
  * NEXUS-28078: Docker - Delete unused manifests and images task may delete
                 referenced layers if the database query to select components
                 encounters limits</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.32.0.03-1" date="1625832000">- Update to Nexus 3.32.0-03
- Bugfixes:
  * NEXUS-27469: Using AzureBlobStore causes docker image upload failure with
                 'digest invalid' error
  * NEXUS-27617: Unable to configure SAML on docker image due to bug in
                 included OpenJDK
  * NEXUS-27753: The latest package version doesn't change in package root
                 after component deleting
  * NEXUS-28247: Docker GC Task incorrectly removing manifests and layers
- Improvements:
  * NEXUS-28203: Replication (Product Preview, PRO only)
  * NEXUS-28205: APT Format support in PostgreSQL</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.33.0.01-1" date="1628164800">- Update to Nexus 3.33.0-01
- Bugfixes:
  * NEXUS-27428: redundant download count attribute for NuGet v3
  * NEXUS-28277: Fetching group npm package metadata concurrently can cause
                 OConcurrentModificationException
  * NEXUS-28362: slow request processing due to group trying to locate blobs in
                 the wrong blobstore
  * NEXUS-28381: Webhook ConnectionPoolTimeoutException: Timeout waiting for
                 connection from pool after sending 20 requests
  * NEXUS-28442: XSS injection
- Improvements:
  * NEXUS-28543: Conda Format support in Postgres (PRO only)
  * NEXUS-28544: Git LFS Format support in Postgres (PRO only
  * NEXUS-28545: R Format support in Postgres (PRO only
  * NEXUS-28561: Conan Format support in Postgres (PRO only
  * NEXUS-28562: npm format support in Postgres (PRO only
  * Improvements to Resilient Nexus Repository Deployment Architecture</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.33.1.01-1" date="1630670400">- Update to Nexus 3.33.1-01
- Bugfixes:
  * NEXUS-28081: Nexus 2 migration to Nexus 3 fails due to permissions of
                 unsupported formats on PostgreSQL databases
- Improvements:
  * Updated Eclipse Jetty Version to 9.4.43.v20210629
  * Changes to Cloud Resiliency Architecture Example: remove the dependency on
    Amazon Elastic File System (EFS). The improved example provides new YAML
    files to help you set up Fluent Bit and CloudWatch in order to externalize
    your logs. This will allow you to capture comprehensive logs even if Nexus
    Repository runs on separate nodes within the same day.</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.34.0.01-1" date="1630843200">- Update to Nexus 3.34.0-01
- Bugfixes:
  * NEXUS-27932: "Manifest invalid" message when running the Docker GC task.
  * NEXUS-28394: Last downloaded field not properly updating when installing
                 or downloading through R proxy
  * NEXUS-28458: logged ERROR LastShutdownTimeServiceImpl 'Failed to process
                 file - Assuming no previous start time' on startup
  * NEXUS-28620: Nexus Database Migrator fails when symlink is used for data
                 directory or data directory not in standard location
  * NEXUS-28807: Nexus-3-0 Stage-release Violations - 08/27/21 12:19 AM
  * NEXUS-28808: Policy violation of com.thoughtworks.xstream : xstream: 1.4.17
  * NEXUS-28853: This release includes a security fix for an HTTP header
                 injection. See the CVE-2021-40143 advisory for full details.
                 If you are using an earlier version, you should upgrade to
                 this release immediately
- Improvements:
  * NEXUS-28266: make S3 Connection Time to Live (TTL) setting configurable to
                 help avoid socket connect timeouts
  * Repository Replication (PRO only)
  * NEXUS-28780: New Formats Supported for PostgreSQL and H2 Databases
                 (PRO only):
    &gt; NEXUS-28677: CocoaPods Format support in Postgres (PRO only)
    &gt; NEXUS-28678: Go Format support in Postgres (PRO only)
    &gt; NEXUS-28781: Rubygems Format support in Postgres (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.34.1.01-1" date="1632657600">- Update to Nexus 3.34.1-01
- Bugfixes:
  * NEXUS-28768: To facilitate migrating from Nexus Repository 2 to Nexus
                 Repository 3, the npm package.json author field can now accept 
                 both map and string values
  * NEXUS-28815: NullPointerException at
                 com.sonatype.nexus.migration.repository.migrators.datastore.NpmRepositoryMigrator.recordMetadata
  * NEXUS-28821: org.sonatype.nexus.datastore.api.DuplicateKeyException in
                 org.sonatype.nexus.repository.content.browse.store.BrowseNodeStore.mergeBrowseNode
- Improvements:
  * NEXUS-28522: change the default location for storing import task metadata
  * NEXUS-28819: log in repo 3 application log the 2 to 3 migration state to 
                 make it easy to determine why migration cannot be ended gracefully</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.35.0.02-1" date="1634212800">- Update to Nexus 3.35.0-02
- Bugfixes:
  * NEXUS-20284: Default content type for raw repositories is now "text/plain"
  * NEXUS-26313: WWW-AUTHENTICATE header does not include needed scope of
                 token
  * NEXUS-26642: A removed docker asset at a remote will cause an already
                 cached docker asset to be removed from a proxy repository when
                 component age expires
  * NEXUS-27125: npm proxy repo audit requests may trigger
                 IllegalStateException Missing
                 org.sonatype.nexus.repository.view.matchers.token.TokenMatcher$State
                 while getting cached content
  * NEXUS-27318: Maven - Publish Maven Indexer files task leaks inputstream
  * NEXUS-27372: Delete of npm package tarball silently fails if the version
                 isn't in package root metadata
  * NEXUS-27628: Application id is not logged at any level when provided by npm
                 audit command
  * NEXUS-28166: Yum metadata not refreshed because of relying on
                 "metadata_generation_time"
  * NEXUS-28621: Nexus DB Migrator 3.33.0 fails with
                 java.lang.StringIndexOutOfBoundsException error
  * NEXUS-28805: Migrator attempts to migrate tagged components before tags
                 have been processed resulting in NullPointerException
                 executing step processComponentStep
  * NEXUS-28842: Github npm package registry does not work with Nexus Repo 3
  * NEXUS-28898: Contention rebuilding Maven hosted archetype-catalog.xml
                 during repository 2 to 3 migration
  * NEXUS-28908: Stuck RUNNABLE postgresql queries on
                 SocketInputStream.socketRead0(Native Method)
  * NEXUS-28922: Azure Blobstore creation fails with using Nexus 3.34.0-01 with
                 PostgresDB
- Improvements:
  * NEXUS-16580: Migrate nx2 artifact information to nx3 during migration
  * NEXUS-28686: Provide an option to not migrate repository content for
                 repositories that are selected for migration from repo 2 to
                 repo 3
  * NEXUS-28891: Avoid building browse feature information during repository 2
                 to 3 migration to improve migration performance
  * NEXUS-28924: Option to force the migration process to end without abort
                 before all content is migrated
  * Firewall Integration Improvement: Policy-Compliant Component Selection
    for npm
  * Faster Imports with Hardlink Support for All Formats
  * Improvements to Repository Replication (PRO only):
    &gt; Replicator Now Supports Docker and npm Formats
    &gt; Replicator Now Runs Continuously by Default
    &gt; New Replication Administrator Role
  * Updated Database Migrator for Easier Migration Between PostgreSQL and H2
    Databases (PRO only)
  * Conan Hosted Support for PostgreSQL and H2 Databases (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.36.0.01-1" date="1636459200">- Update to Nexus 3.36.0-01
- Bugfixes:
  * NEXUS-29088: Running the replication backfill blob attributes task will now
                 process all blobs as expected.
  * NEXUS-29319: This release includes a security fix for an incorrect access
                 control. See the CVE-2021-42568 for full details.
  * NEXUS-29407: This release includes a security fix for a server side request
                 forgery vulnerability. See CVE-2021-43293 for full details.
  * NEXUS-21814: Repair - Reconcile component database from blobstore may not
                 process PyPI assets correctly
  * NEXUS-27629: logging is too verbose when the submitted application id from
                 npm audit is not found in the connected IQ server
  * NEXUS-28714: Content validation does not work properly for OCI
  * NEXUS-28717: "Docker - Delete unused manifests and images" task attempts to
                 read files from the wrong Blob Store.
  * NEXUS-28779: Use cases for name and type properties for datastores can be
                  confusing
  * NEXUS-29338: Image push after Nexus Repository upgrade not possible
- Improvements:
  * NEXUS-24332: Optimized How Yum Metadata is Rebuilt
  * Faster Migration from Nexus Repository 2 to Nexus Repository 3
  * Replication Improvement: Use Truststore Certificates for Replication
    Connection (PRO only)
  * Improvements to Database Migration to H2 or PostgreSQL (PRO only)
    &gt; Added OrientDB Health Check to Database Migration (PRO only)
    &gt; NEXUS-28789: Added Nexus Repository Database Version Check PRO (PRO only)
  * Documentation Improvement: New Resiliency Example Using Azure  (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.0.01-1" date="1637928000">- Update to Nexus 3.37.0-01
- Bugfixes:
  * NEXUS-17624: YUM repomd.xml not deleted from empty level-1 hosted
                 repository
  * NEXUS-19089: large set of dirs/files under directpath/nexus-repository-docker
                  dir
  * NEXUS-21878: failing to start one docker connector on startup prevents all
                  other not started docker connectors from starting
  * NEXUS-22125: Unable to query image tags via Registry API for proxied gcr.io
  * NEXUS-26970: Docker proxy repository returns 502 when remote returns 401
  * NEXUS-27033: Deploy of newly tagged multiarch manifest not permitted when
                 redeploy is disabled
  * NEXUS-27631: Download of docker manifest via UI fails if there is no
                 history in the manifest
  * NEXUS-27674: Unable to download conda component that was released from
                 quarantine
  * NEXUS-27788: "Docker - Delete incomplete uploads" task blocks all docker
                 uploads
  * NEXUS-28717: "Docker - Delete unused manifests and images" task attempts to
                 read files from the wrong Blob Store.
  * NEXUS-28855: Blob store space used constraint says ?in MB? but it
                 stores in bytes
  * NEXUS-28918: Search API does not sort alpha-numeric versions correctly
  * NEXUS-28921: Browse page is empty after migrating to the New DB because
                 Rebuild repository browse tree task fails to be stored due to
                 long name
  * NEXUS-29234: java.lang.NumberFormatException for S3 blob stores on upgrade
  * NEXUS-29342: Yum generated temp files are not deleted
  * NEXUS-29343: Intermittent MissingBlobExceptions for Concurrent Requests
  * NEXUS-29380: NX3: reconcile from blob store task can generate invalid npm
                 version entries in metadata
  * NEXUS-29433: fetching identical group npm package metadata concurrently can
                 result in uncooperative threads and increased blobstore and
                 database load
- Improvements:
  * NEXUS-16580: Migrate nx2 artifact information to nx3 during migration
  * NEXUS-27145: Allow rebuild maven metadata task to fix invalid blob
                 references for maven-metadata.xml
  * NEXUS-28844: option to rebuild npm package metadata per repo or package
  * NEXUS-28896: improve INSERT performance into format specific browse_node
                 tables
  * New "Repair - Rebuild npm metadata" Task
  * The "Repair - Rebuild Maven repository metadata" Task Fixes Invalid Blob
    References for maven-metadata.xml
  * Retain Information About Assets Migrated from Nexus Repository Version 2 to
    Version 3
  * Improved S3 Blob Store Performance
  * Replication Support for NuGet and PyPI  (PRO only)
  * Improved Performance for those Migrating to Nexus Repository 3 with an
    External PostgreSQL Database (PRO only)
  * Improved Resilient Deployment Options (PRO only)</changelog>
  <changelog author="Julio Gonz&#xE1;lez Gil &lt;packages@juliogonzalez.es&gt; - 3.37.1.01-1" date="1639828800">- Update to Nexus 3.37.1-01
- Bugfixes:
  * logback library update to fix a low/moderate vulnerability, as a precautionary
    measure. No known exploit of Nexus Repository via logback at this time.</changelog>
</package>
</otherdata>