endoflife.ai
Sonatype Nexus Repository JFrog Artifactory Exploited & Unpatchable EOL Watch

Sonatype Nexus Repository 3.79 Is Sunsetted on October 1, 2026

By Scott Bissett  ·  Published: September 14, 2026  ·  EOL Watch — deadline analysis  ·  Read at Sonatype's Nexus Repository 3 Versions Status page, its Software Support Policy and the 3.79 release notes; lifecycle dates from that status page as we serve them.

Sonatype gives every Nexus Repository 3 line eighteen months, and 3.79's eighteen months end on October 1, 2026. The company's own Nexus Repository 3 Versions Status page carries the line: 3.79.0 released on April 1, 2025, General Availability support to April 1, 2026, sunset on October 1, 2026. It has been in the middle stage, Extended Maintenance, since April. On October 1 it enters the last one.

What Sunsetted means, in Sonatype's own terms. The Sonatype Software Support Policy defines a GA Support Period of at least twelve months from a release's general availability. During Extended Maintenance the obligation shrinks to "commercially reasonable efforts to provide Error Corrections for Severity 1 Level Errors". At the end of that period the release is Sunsetted, and "Sonatype's Support obligations (including Extended Maintenance Support) under this Policy and/or the Agreement shall immediately cease." A 3.79 instance after October 1 is not a supported product with a slower fix cadence. It is a product with no fix cadence.
Quick answer: Nexus 3.96 is supported until March 1, 2028, its end-of-support date. Active support for Nexus 3.96 ends on September 1, 2027; security fixes continue until that end-of-life date. The next Nexus version to reach end of life is 3.79, on October 1, 2026. 51 of 69 tracked Nexus versions are past end of life; the most recent to reach it, 3.78, did so on September 4, 2026. Every Nexus version's release and end-of-support date is on the Nexus lifecycle page.

One line sunsets every month

Nexus Repository 3 ships a new minor roughly every month, and each one starts the same clock: twelve months of General Availability support, six of Extended Maintenance, then sunset. The consequence is a calendar with a sunset almost every month. Here is the run from the line that just sunsetted to the one due in March, from Sonatype's status page as we serve it on the Nexus Repository page:

LineFirst releaseGA support endsSunsetStage on the date of this article
3.78March 4, 2025March 4, 2026September 4, 2026Sunsetted
3.79April 1, 2025April 1, 2026October 1, 2026Extended Maintenance
3.80May 6, 2025May 6, 2026November 6, 2026Extended Maintenance
3.81June 10, 2025June 10, 2026December 10, 2026Extended Maintenance
3.82July 9, 2025July 9, 2026January 9, 2027Extended Maintenance
3.83August 12, 2025August 12, 2026February 12, 2027Extended Maintenance
3.84September 9, 2025September 9, 2026March 9, 2027Extended Maintenance

The stage column is computed from the dates, and that is deliberate. On the day this article was written, Sonatype's own status page still labelled 3.78 "Extended Maintenance" ten days after its sunset date and 3.84 "General Availability" five days after its GA support ended. The dates on that page are right; the labels beside them lag. When the two disagree, the date is the one Sonatype's policy binds it to, so the date is the one to plan on.

Running Sonatype Nexus Repository past end of life?
Extended support past the official EOL date exists for many products in this position — whether it covers Sonatype Nexus Repository is exactly what we check. Tell us where to reach you and we’ll reply with matched options and pricing guidance — or an honest “no vendor covers this.” Free, no obligation.

Free · No obligation · Independent — we track the dates, vendors don’t pay for placement · dates verified against vendor sources. See all support options →

Where a 3.79 instance goes

To the newest line, and the reason is arithmetic rather than features. Every monthly release restarts the eighteen-month clock, so the current line always has the longest runway, and the gap between "current" and "sunsetted" is fixed at eighteen months regardless of how many releases sit between them. On Sonatype's status page the newest line as we serve it:

LineFirst releaseGA support endsSunset
3.96September 1, 2026September 1, 2027March 1, 2028
3.95August 5, 2026August 5, 2027February 5, 2028
3.94July 9, 2026July 9, 2027January 9, 2028

A team that lands on 3.96 in September 2026 and does nothing else will be inside GA support until September 1, 2027 and sunsetted on March 1, 2028. A team that upgrades once a year, on any schedule it likes, never leaves GA support at all. That is the practical reading of an eighteen-month policy on a monthly release train: it is a twelve-month upgrade cadence with a six-month grace period, not a version you install and forget.

The exploitation record, for completeness

Nexus Repository has two entries in CISA's Known Exploited Vulnerabilities catalog, both old: CVE-2019-7238, incorrect access control in versions before 3.15.0, added to the catalog on December 10, 2021, and CVE-2020-10199, expression-language injection in versions before 3.21.2, added on November 3, 2021. Both were fixed within their lines years before CISA listed them. They are here because they show what an artifact repository is to an attacker: the box every build pulls from and every deployment pushes to. The next flaw of that kind will get a fix on the lines inside their eighteen months. On a sunsetted line, Sonatype's policy says there is nothing to wait for.

What to do

On 3.79: plan the upgrade to 3.96 or whichever line is newest when you schedule it, ahead of October 1, 2026. Sonatype's release notes for each line document the database and Java requirements along the path; 3.79 to 3.96 is seventeen monthly releases and the notes are where the breaking changes are listed.

On 3.78 or older: you are already past sunset. The same upgrade, sooner.

On 3.80 through 3.84: Extended Maintenance now, Severity 1 fixes only, with the sunset dates in the table above. Put them in the same change window as the 3.79 boxes.

Everyone: the Nexus Repository page carries every line with its release, GA support and sunset dates, bound to Sonatype's status page and refreshed at every build. Because a new line ships every month, the "newest" answer in this article ages faster than most; the page does not.

Frequently Asked Questions

When does Sonatype Nexus Repository 3.79 reach end of life?

Sonatype's Nexus Repository 3 Versions Status page lists 3.79.0 as released on April 1, 2025, with General Availability support ending April 1, 2026 and the sunset date of October 1, 2026. Since April 1, 2026 it has been in Extended Maintenance; from October 1, 2026 it is Sunsetted, which under Sonatype's Software Support Policy means no support obligations of any kind.

What is the difference between Extended Maintenance and Sunsetted for Nexus Repository?

Sonatype's Software Support Policy defines the GA Support Period as a minimum of twelve months from a release's general availability. For Nexus Repository 3 the company then provides six months of Extended Maintenance, during which its obligation is commercially reasonable efforts to correct Severity 1 errors only. At the end of that period the release is Sunsetted and Sonatype's support obligations, including Extended Maintenance, cease.

Which Nexus Repository 3 versions sunset next?

A line sunsets almost every month. On Sonatype's status page as we serve it: 3.78 on September 4, 2026, 3.79 on October 1, 2026, 3.80 on November 6, 2026, 3.81 on December 10, 2026, 3.82 on January 9, 2027, 3.83 on February 12, 2027 and 3.84 on March 9, 2027.

Which Nexus Repository version should a 3.79 instance upgrade to?

The newest line. 3.96.0 was released on September 1, 2026, with General Availability support to September 1, 2027 and sunset on March 1, 2028. Every monthly release restarts the eighteen-month clock, so the longest runway is always the current line, and staying inside General Availability support means upgrading at least once a year.

Related

© 2026 endoflife.ai · How we verify our dates · API · About