GJgjvc·Jan 18, 2025
This is a show-stopper of a bug if you use YUM repositories.
3.76.0 should be considered toxic.
see also https://github.com/sonatype/nexus-public/issues/551
In Nexus OSS 3.76.0, YUM repository indexing brokensonatype
nexus-public
Java2018–2025
sonatype / nexus-public
nexus-public
Sonatype Nexus Repository Open-source codebase mirror
3Distinct people
4Mentions
0Explicit recommenders
2.7KGitHub stars
What to know before exploring
What it is
Sonatype Nexus Repository Open-source codebase mirror
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year4 dated mentions
Observed mentions: 2018-07-12 23:36:45 UTC to 2025-01-18 14:33:29 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 1 | 1 |
What Hacker News says
4 sourcesNexus OSS 3.76.0, YUM repository indexing broken
2 points · Open discussionSetup a caching repository proxy like nexus: https://github.com/sonatype/nexus-public
This is a little server you run locally and point your package managers like Gradle, pip, npm, etc. at it and it will grab dependencies from their upstream and cache them locally to be available offline later. Once you get it setup go wild adding every dependency you can think of using so it preloads the cache with good stuff. Unfortunately offline caching for package managers is really hit or miss and rarely a priority to support, so expect some pain getting it all setup. Good luck.
Also if you haven't already consider installing and learning languages with a good standard library so you can install them once and do a lot of stuff. Python, go, and deno are really good options with capable standard libraries out of the box. Avoid nodejs or similar mi
Read the rest
nimal/no standard library languages. Rust is surprisingly bad/hard to use offline in my experience too (cargo constantly wants to hit the internet and needs a lot of handholding to play nicely).
The source code is at https://github.com/sonatype/nexus-public.
Not sure if Maven Central is running on the closed-source version, though.
> If someone has a contact at Sonatype, I'd love to talk to them about fixing this.
Contact them by email, they're quite responsive.
In Postmortem for Malicious Packages Published on July 12th, 2018