2007–2026
547 posts
2026 27
October 2026
- Shadow AI Across Government: It's Three Problems, Not One
- How Maven Central Builds Trust Into Dependency Delivery
- A Protected Browser Doesn't Mean Your Enterprise Is Remediated
- The Limits of Fingerprint Blocklists: A Reproducible Java Certificate Bypass
- eMudhra CA Incident: Sonatype's Assessment and Guidance
- PHP2Shell Makes PHP Inventory and Patch Ownership Urgent
- The New Release Metric: Less Cleanup Per Release
- AI Noise Is the New Development Bottleneck
- Trust What Ships: Your Repository Is Now Your First Defense
- Hijacked TensorLake npm Turned Install Into Credential Risk
- Q3 2026 Open Source Malware Index: When Compromise Compounds
- What Are the New Rules for Secure Open Source Consumption?
- Your Agents Are Choosing Dependencies. DoWI 8430.01 Says You Own the Result.
September 2026
August 2026
- Managing Air-Gapped Environments: Ensuring Security and Efficiency
- Key Takeaways from Black Hat 2026: AI, CVSS, and Security Basics
- Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads
June 2026
May 2026
- Your Outdated Repository Still Works, But It May Not Be Safe
- How to Build a Software Supply Chain Security Playbook
April 2026
March 2026
- Critical Java Vulnerability in pac4j: CVE-2026-29000 Explained
- OMB's Rollback on Software Security Increases Risks
- The Evolution of OSS Index in the Age of AI | Sonatype
February 2026
January 2026
2025 11
December 2025
September 2025
- npm Software Supply Chain Attack Highlights New Risks
- AI Risk Management Framework for Federal Security | Sonatype
August 2025
- SBOM Manager New Features Accelerate Compliance and Security
- The Unchanging Laws of Software in the Age of AI | Sonatype
July 2025
- Scaling InnerSource with Automation for Secure Development
- Q2 Open Source Malware Index 2025: Data Exfiltration Threats
June 2025
April 2025
February 2025
2024 12
October 2024
September 2024
July 2024
May 2024
April 2024
- How DevOps Pioneers Lead Organizational Transformation
- Automate and Maintain SBOMs for Better Software Security
March 2024
- Comparing and Converting SBOM Formats: CycloneDX vs. SPDX
- Secure Software Development Attestation Form | Sonatype
- What Are SBOM Standards and Formats? | Sonatype
February 2024
- Unlock the Power of Binary Repositories: A Guide for DevOps
- From DevOps to DevSecOps: Integrating Security into SDLC
January 2024
2023 5
December 2023
June 2023
May 2023
April 2023
February 2023
2022 10
December 2022
October 2022
- Best Practices for Managing Software Supply Chain Security
- This Week in Malware - Nearly 40 Packages Discovered | Sonatype
September 2022
July 2022
April 2022
- Malware Wrap-up: npm Backdoors, Bugs, Mystery Placeholders
- Wicked Good Development Episode 6: The Logic of Code Quality
February 2022
- Roblox and Fortnite Spam Floods PyPI, NuGet, and npm
- Sonatype Celebrates February 3, 2022 as World Open Source Day
January 2022
2021 3
September 2021
May 2021
March 2021
2020 14
November 2020
July 2020
June 2020
- ZeroTrustOps: Securing at Scale
- Enhancing CI/CD Pipelines with Sonatype and Bitbucket Code
- Optimizing Platform Health with Synthetic Monitoring
- Enhance Your Code Quality with Sonatype and Atlassian Integrations
- Publishing Docker Images on Sonatype Nexus Repository with Maven
May 2020
April 2020
- Optimizing Software Supply Chains with Nexus Repository
- Sonatype-2020-0196: Protect Bitcoin From Malicious RubyGems
- Transforming DevOpsSec into DevSecOps: Lessons from Breaking Bad
March 2020
February 2020
January 2020
2019 20
December 2019
- Critical Vulnerability in Bouncy Castle: CVE-2018-5382
- New in Nexus Repository: R Format and VS Code Support
October 2019
September 2019
- Sonatype Intelligence CVE-2019-15753: OpenStack (os-vif)
- The Dot Zero Conundrum: A New Frontier of Secure Open Source
- Building a Secure Web: Insights from Global AppSec DC 2019
- Micro Focus + Sonatype Partnership Enables Enhanced AppSec
- Improving DevSecOps at the GSA | Sonatype Blog
August 2019
June 2019
- Developers Must Embrace DevSecOps for a Secure Digital Future
- Implementing DevSecOps: Building Security into Your DevOps Pipeline
- The Neuroscience Behind Effective DevOps Culture Transformation
- DevOps Tools, Not Rules | Sonatype
May 2019
April 2019
- Washington Magazine Ranks Sonatype on Best Places to Work
- CVE-2019-0232: Apache Tomcat Remote Code Execution
- Malicious Attacks on Open Source Are Going to Get Worse
- Explore DevSecOps Reference Architectures | Sonatype
January 2019
2018 10
November 2018
- Security by Press Release Risks: Lessons from jQuery Vulnerability
- Welcome back to nexus intelligence insights
October 2018
September 2018
- Three Days of DevSecOps: Lessons From Equifax | Sonatype
- Improving Security Pipelines with Simple Yet Brilliant Solutions
May 2018
April 2018
March 2018
February 2018
January 2018
2017 5
December 2017
September 2017
March 2017
2016 5
April 2016
February 2016
January 2016
2015 19
December 2015
November 2015
- Qa running docker in production
- Software supply chains devops lessons learned from southwest airlines
- Why nexus rocketed beyond 60000 installs
- Improving container security docker and more
- Nexus firewall quality at velocity
- Java deserialization vulnerability
September 2015
August 2015
July 2015
June 2015
- Rework is choking software 2015 state of the software supply chain report
- The 2015 state of the software supply chain report
April 2015
March 2015
February 2015
January 2015
2014 50
December 2014
- A Time for Cyber Supply Chain Management in Congress: Part 2
- Our promise free nexus training
- Nexus 2 11 1 why its time to upgrade
- Cyber supply chain managemnt part 3
- Nexus support rubygems
- Cyber supply chain management part1
November 2014
October 2014
September 2014
August 2014
- Maven Central Now Supports HTTPS for Enhanced Security
- Integrating Sonatype CLM with SonarQube for Code Quality
- Deploy no evil
- The best policy
- Wait wait dont pwn me from black hat 2014
- Defining policy that works
July 2014
- Lessons from Youth: Understanding Open Source Licensing
- Ssl connectivity for central
- Bad parts bad software
- How your software is like a car a closer look at todays software supply chain
- Way software is made
- Two appsec questions
- Choosing right component
June 2014
- Sonatype Nexus Leads as Top Repository Manager, Data Confirms
- 5 things you need to know about open source components
- Opening letter 2014 survey
- Rebellabs survey nexus
- Manual policies dont work
- Replace plain text username and password with a user token
- Nexus and rundeck tools for devops
May 2014
- The nexus 2 minute challenge replace the release process using the nexus staging suite
- Cheeseburger risk
- 4 open source components you need to update right now
- On the shoulders of giants influential books for software developers
- Hacking minecraft a metaphor for bleeding hearts
April 2014
- The Sonatype 2014 Engineering Summit | Sonatype Blog
- Devops application security
- Heartbleed bug
- Code snippet scanning
March 2014
February 2014
January 2014
2013 27
December 2013
November 2013
- Pci 3 0 secure payment requires secure components
- Component capable release management is key to devops
- Devops requires an optimized application delivery tool chain
October 2013
September 2013
- Agile, Component Development, and DevOps: Enhancing IT Delivery
- The Difference Between Flaws and Bugs in Software Security
- Simplified releases to the central repository with nexus
- Policy hierarchy inheritance simplified policy management
- Using your repository manager to optimize component usage
- Isc global infosec study app vulnerabilities are 1 concern
- Devops success is contingent on shifting left
August 2013
July 2013
- Announcing clm 1 5 new release simplifies policy management
- Application security needs to be redefined to stay relevant
June 2013
May 2013
- I want to write really insecure code today
- Owasp recognizes component security
- Personally i have always been a fan of bribery
- They wait until the software flaw trends on twitter
April 2013
- New webinar blowing up old thinking security at the speed of development with wendy nather 451 research
- Announcing sonatype clm component lifecycle management
March 2013
- Hacker steals 12000 worth of bitcoins in brazen dns based attack
- Not a match made in heaven zoosk asks users to reset passwords following mass leak
January 2013
2012 72
November 2012
October 2012
September 2012
- Remember when hackers ignored java those days are over fbi hacked via atomicreferencearray
- Up next nexus support for yum repositories
- The cloud is running toward bsd style licenses are you
- Dont do it wrong put that puppet in a box and use nexus for devops
- What enterprise architects and time travelers have in common
- Thats billion with a b is java having an outlook moment
- Nexus 2 1 fueled by gun toting unicorns with jet packs
August 2012
- Nexus 2 1 2 update available now minor features and fixes for both oss and pro
- Securing repository credentials with nexus pro user tokens
- Best strategy for migrating from apache ant to apache maven
- Download it all at once a maven idea
- Often you people are too smart to train
July 2012
- Component lifecycle management with your apache maven infrastructure
- Nexus pro automating staging workflow with gradle using the nexus rest apis
- We just kicked central performance and availability up a notch with edgecast
- Learning the nexus rest api read the docs or fire up a browser
- Wait you dont have a repository manager
- Insight application health check scan your application for security and licensing issues in minutes
June 2012
- How to publish artifacts to Sonatype Nexus Repository from Gradle
- How to consume and publish artifacts with nexus and apache ivy
- Nexus oss switched to the eclipse public license a clarification and an observation
- Does nexus pro support your gradle builds yes it does
- Does nexus pro support ant ivy builds yes it does
- Nexus professional 2 0 5 released its easier to evaluate awesomeness
- Reinventing wheels and opportunity cost or why you need to use nexus
- Nexus pro and nexus oss 2 0 6 now available stability and security fixes
May 2012
- Google guava shows strong growth in april
- Nexus victorious in an objective comparison of repository managers
- How does insight handle conflicting oss licenses
- When licenses meet reality the result is often confusing
- Get proactive about security with insight
- Selecting oss components three questions answered by nexus pro
April 2012
- Are you using a Leiningen repository manager | Sonatype blog
- OSS Projects Take Security Seriously: Do You? | Sonatype
- Most application vulnerabilities are forever day vulnerabilities
- Start proxying net packages nuget gallery with nexus professional
- Know the enemy havij automated sql injection
- How do most people find new dependencies google
- An emerging role in it governance the alm architect
- How can we prove that nexus can scale
- Oss compliance lead or be led your choice
- Evaluating an open source projects security team
- Oracle issues critical security bugs for databases glassfish and more
- Is analyzing open source projects by contributors a valid metric
- When you run nexus it just works
March 2012
- The first line of defense checksums and pgp signatures in repositories
- For st patricks day a compliance strategy for beerware
- Insights password security is a trillion trillion trillion centuries secure enough
- Todays security brief application security is widely neglected by some surprising companies
- 9 of developers going rouge and contributing anyway
- A common approach for oss policy making it up as you go
- Article published in isaca journal mitigating oss risk
- Were a java shop were not going to get hacked
- Theres no analog to a repository manager in net until now
- Ken rimple interviews brian fox maven 3 running central and nexus
- Use json well youd better not be evil
February 2012
- Public service announcement your build is leaking and how to stop it
- Nexus dont dive in until you know how to swim
- Whatever weve got security people for that
- Technology focus what is scala
- What is nuget for java developers
- Scala artifacts now on central
- What do cartoons have to do with build systems
- Advanced nexus diagnostics with the nexus 2 0 describe flag
- Distributing binaries why not just use a shared filesystem
January 2012
2011 43
November 2011
- Build open source management into software development open source development tip 8
- Bringing java and linux together on the way to continuous live deployment
October 2011
- Evaluate open source components before use open source development tip 5
- Will you know when a security flaw is found in a production app
- Publishing your artifacts to the central repository
- Open source changes fast can you keep up 2
- Tips for increasing open source benefits for development part 2
- Avoid lawyers track your licenses
September 2011
July 2011
- The central repository is getting faster are you ready for the new ips
- Central grows up see the history
- The best maven how tos from the sonatype blog
June 2011
- How to Effectively Backup Sonatype Nexus Repository
- You dont need a browser to use maven central
- Maven central search architecture overview
May 2011
- Maven central failover mechanism improves temporary ip change on monday
- Sonatype donates maven 3 x integration eclipse integration to hudson
April 2011
- How not to download the internet
- Goodbye svn hello git
- Nexus 1 9 performance compatibility and dependency browsing
- Archetypes new in nexus oss and when to use archetypes
March 2011
- Hudson plugins meet dependency injection jsr330 support now available
- Configuring plugin goals in maven 3
- Enhancements to maven central
February 2011
- Sonatype's Commitment to Advancing Hudson and Making Great Software
- Top ten reasons to move to maven 3
- Guicing up hudson making life easier for developers with jsr 330
- Hudsons bright future
- Navigation improvements in the m2eclipse xml pom editor
- New service to search for artifacts in maven central
- Maven indexer sonatypes donation to repository search
January 2011
- How to Integrate Aether in Maven 3 Plugins for Dependency Resolution
- The importance of maven training
- 1600 developers speak and they want better integration
- Guice 3 0 rc2 is in maven central
- Using the maven release plugin things to know
- Maven bundle plugin 220
- Maven tip project directories and artifact ids
- Maven ide the year of maven eclipse 2
- Training questions answered checksums ssh keys writing plugins
- Downloading artifacts from nexus with bash
- How to build a rap application with tycho
- Maven how to merging plugin configuration in complex projects
2010 84
December 2010
- Now available central download statistics for oss projects
- M2e at eclipse what will this mean for you
- Retrieving a plugins documentation
- Nexus 1 9 m1 milestone 1 released
- Sonatypes enterprise development survey
November 2010
- Nexus 1 8 0 1 functionality and fixes
- Whats in maven 3 0 for plugin authors
- What to do when sonatype nexus returns 401
October 2010
September 2010
August 2010
- Benefits of a Repository Manager: Partners and Vendors
- Temporary staging and promotion with nexus professional
- Benefits of a repository manager part i
- Benefits of a repository manager part iii continuous build deployment
- Introducing aether
- Maven 3 and sonar
- Aether questions answered for jax
- Listen to brian fox discuss maven 3 on basementcoders com
- Benefits of a repository manager part iv deployment
- Maven by example now available as an epub
- Maven the complete reference now available as an epub
- How to migrate repositories from artifactory to nexus
- Benefits of a repository manager part ii caching and collaborating
- How to migrate from ant to maven project structure
- Nexus 1 7 2 now available with improved search interface
July 2010
- The elephant in the room developer onboarding
- Multi level staging and build promotion with nexus pro 1 7
- Gwt 2 0 4 now available in maven central
June 2010
- Diy retrieving a maven plugins documentation
- Jason van zyl talks to how software is built
- Whats new in nexus open source 1 7 0
May 2010
April 2010
- Easily Move Artifacts Between Sonatype Nexus Repositories
- The maven team announces release of apache maven 3 0 beta 1
- Jboss switches to nexus professional
- Whats new in nexus 1 6
- Why sonatype nexus for the non programmer
- Amazons aws powers sonatypes on demand training infrastructure
- Nexus 1 6 introduces auto blocking unreachable remote repositories
March 2010
- Top 10 Maven Myths Debunked: Insights and Actions
- Flexmojos two years later
- Eclipsemagazine interview with jason van zyl
- Why external repos are being phased out of central
- On the web testing javascript with apache maven
- Introduction to maven shell
- How to configure the maven jetty plugin for openejb
- The bottom line in the maven ant debate
February 2010
- 03 in other news
- Partitioning Nexus Repository with Privileges and Roles
- Java net maven repository rescue mission on march 5th
- Now available m2eclipse 0 10 0
- Documenting the nexus rest api with enunciate
- Browse javadoc 150
- How to contribute to the maven books
January 2010
- 10 questions
- What Differentiates Nexus Repository Manager? | Sonatype
- Effective Routing Rules for Managing Nexus Repository Groups
- Migrating from Artifactory to Nexus: Ning's Success Story
- How to Create a Nexus Plugin Using m2eclipse in Eclipse
- Streamlining Apache Portals Releases with Nexus Staging Suite
- Maven Archetypes and Nexus: There is no faster way
- Generate PGP Signatures for Maven Projects: A Complete Guide
- 2009 tips and tricks roundup
- How to backup sonatype nexus configuration and repository artifacts
- Sonatype and the foundations of the maven and nexus communities
- Three approaches to user management in nexus
- From plexus to guice 3 creating a guice bean extension layer
- Nexus open source or professional which one is right for you
- Next generation maven development stack
- From plexus to guice 2 the guiceplexus bridge and custom bean injection
- From plexus to guice 1 why guice
- Maven the definitive guide split into two books
- Meet the nexus remote repository browsing plugin
- Nexus 1 5 0 highlights open sourcing nexus ldap integration
- Announcing nexus 1 5 0 ldap archive browsing javadoc and more
- Bootstrapping an alfresco project with maven archetypes delivered with nexus
- How to create two jars from one project and why you shouldnt
- Why we chose the gpl for nexus
- Nexus oss ecosystem
- Managing oss forges with nexus
- Maven in the wild smarts mythbusters and a review of the maven book
2009 95
December 2009
- 17 in other news
- 04 in other news
- Response to maven problems on the jboss wiki part two
- Sonatype nexus 141 introduces a plugin console and custom artifact metadata
- Maven dependency resolution a repository perspective
- Nexus tips and tricks split staging deployment and promotion role
- Response to maven problems on the jboss wiki part three
- Spring maven nexus best practices
- Maven p2 there is no dillema just a mild case of myopia
November 2009
- 18 on other news
- 11 in other news
- How to Streamline Open Source with Sonatype Nexus Repository
- Flexibility in Maven 3.x: Exploring Polyglot and ModelReaders
- Maven 30 new and improved formula
- Nexus tips and tricks publishing maven sites to nexus 14
- In other news
- Response to maven problems on the jboss wiki part one
- Nexus professionals support for atlassian crowd
- Maven 30 alpha 3 released
- Special character encoding properties
- Nexus tips disable redeployment in nexus
- A year of providing free maven repository hosting
October 2009
- Exploring Nexus, Maven 3, and Automated Testing Insights
- 13 in other new
- 07 in other news
- Maven tips and tricks optimizing with the maven dependency plugin
- New features in nexus and nexus professional 14
- Integration tests with maven part 3 case study flexmojos
- Selenium part 3
- Selenium part 2
- Selenium part 4
- Maven tips and tricks grouping dependencies
- Maven tips and tricks encrypting passwords
- Integration tests part 4 nexus plugins integration test
- Maven tips and tricks advanced reactor options
September 2009
- Understanding Nexus Tasks for Optimal Repository Management
- Access logging in nexus 136
- Nexus indexer api part 3
- Follow sonatype on twitter
- Browsing and indexing repositories with m2eclipse
- Maven tips and tricks describing maven plugins with helpdescribe
- Profiling maven tests
- Testing nexus with selenium a lesson in complex ui testing part 1
- Maven tips and tricks creating an osgi project with maven
- Maven tips and tricks using github
August 2009
July 2009
- Enhance Nexus Repository with OSGi Bundle Repository Support
- Nexus 135 released
- Writing plugins for nexus part 2
- From apache archiva to sonatype nexus
June 2009
- Publishing your artifacts to the central maven repository
- Nexus indexer api part 2
- Nexus open source and hudson on ec2
- Integration tests with maven part 2 test coverage reports
- Nexus now supports opensearch standard
- Using staging repositories for deployment in nexus
- Nexus indexer api part 1
- Writing plugins for nexus part 1
- Integration tests with maven part 1 failsafe plugin
- Optimal nexus repository configuration
May 2009
- Plexus container five minute tutorial
- Were used to the axe grinding
- Nexus indexer 20 incremental downloading
- How to make a plugin run once during a build
- Flexmojos chapter focus of 05 maven book release
- Maven integration and distributed open innovation
- Refactoring a multimodule project nexus book build
- The ulitimate java build system
April 2009
- Read the Sonatype Newsletter | Sonatype Blog
- Mavenizing the AppEngine SDK | Sonatype Blog
- Nexus 133 introduces automatic signature verification to maven artifacts
- Announcing nexus pro 132
- How to convert from ant to maven in 5 minutes
- M2eclipse 098 dev build available
- Incrementally improving a maven build while leaving the existing build intact
- What is a repository manager
- What is a repository
- Git the sweetest scm around
March 2009
- New feature in nexus 13 mirror support
- The future of maven osgi join the tycho users mailing list
- A tour of the nexus repository internals
February 2009
- Optimizing Hudson Build Farms: Overcoming Windows Integration Issues
- Explore Maven Settings Password Encryption Feature | Sonatype
- Why putting repositories in your poms is a bad idea
- Nexus crowd plugin introduction
- Maven 2010 released
- The hudson build farm experience volume iii
- The hudson build farm experience volume iv
January 2009
2008 32
December 2008
- Now Playing: Grails 1.1b2 with Improved Maven Support
- Central repository downloading the nexus index
- Central maven repository taffic using s3
- Maintain an essential public resource the central maven repository
- Central maven repository traffic investigation and analysis
November 2008
- Search Sonatype Nexus Repositories Using Python and REST API
- Nexus maven repository manager 11 released
- Searching the maven repository
- On maven model transforms and c
- The next generation of build tools for eclipse plugins and rcp applications
- Maven project model
- Searching with the nexus rest api ruby
- Nine reasons to use a repository manager sonatype nexus
- Adding a jar to a maven repository with sonatype nexus
- Building eclipse plugins with maven tycho
- Announcing nexus maven repository manager pro beta
- Searching with the sonatype nexus rest api groovy
October 2008
- Hudson meet javaservicewrapper
- Browsing javadoc for dependencies in eclipse m2eclipse
- Nexus maven repository manager 102 released
July 2008
June 2008
May 2008
- Maven code how to detect if you have a snapshot version
- Optimal maven plugin configuration
- Adding additional source folders to your maven build
- Nexus maven repository manager 100 beta 31 and source released
- Misused maven terms defined
April 2008
2007 3
August 2007
June 2007