Sonatype says “Nexus Repository 3.70.x is the last release that supports OrientDB” (upgrade page, read 2026-10-23). If your server still runs on it, you have two ways forward: upgrade the server, or move your repositories off it. Every fact below about the upgrade is quoted from the vendor’s own pages, each linked with the date we read it.
The end of the line
Sonatype says “Before updating to a release after 3.70.x, you must migrate off from the Orient database while upgrading Java” (upgrade page, read 2026-10-23). The same page says “Support for OrientDB is sunsetted and is no longer included in Nexus Repository versions 3.71.0 and beyond” (upgrade page, read 2026-10-23).
Sonatype’s versions status page lists 3.70.0 - 3.70.5 as “Sunsetted”, with a sunset date of “January 9, 2026” (versions status, read 2026-10-23). Sonatype’s download page for the line says “Instances that cannot be migrated must remain on the 3.70.x point releases for critical bug fixes” (3.70.x downloads, read 2026-10-23).
The same download page says “Nexus Repository instances that use the legacy embedded OrientDB database are affected by known OrientDB vulnerabilities, including two critical-severity CVEs” (3.70.x downloads, read 2026-10-23). That page lists them as “CVE-2026-3199, Critical, 9.4” and “CVE-2026-5189, Critical, 9.2” (3.70.x downloads, read 2026-10-23). Sonatype’s advice there: “To reduce security risk and remain on a supported database platform, migrate your Nexus Repository instance to PostgreSQL (preferred) or H2 as soon as possible” (3.70.x downloads, read 2026-10-23).
The upgrade path
Sonatype’s first step is “Upgrade to the latest version of 3.70.x using the standard upgrade procedures” (upgrade page, read 2026-10-23). The same page says “As OrientDB does not support Java 17, continue to use Java 8 or 11 until after the database migration” (upgrade page, read 2026-10-23).
Next comes the database. Sonatype says “Use Database Migrator when changing the database of a self-hosted instance” and “Use Instance Migrator if you are on OrientDB and wish to migrate to a self-hosted instance (3.90.2+), or to Sonatype Cloud” (upgrade page, read 2026-10-23).
Which database you can move to depends on your edition. Sonatype says “Sonatype recommends that Nexus Repository Pro deployments migrate from OrientDB to PostgreSQL” and “For Community Edition deployments, you must first migrate from OrientDB to H2” (upgrade page, read 2026-10-23). The same page says “Migrating to a PostgreSQL database with version 3.70.x requires a Pro license” and “Community Edition support for migration to PostgreSQL is available only in releases after 3.77.0” (upgrade page, read 2026-10-23).
Sonatype’s Database Migrator page says “The documented workflows require you to shut down Nexus Repository during migration” (Database Migrator page, read 2026-10-23). The same page says “The migrator requires at least 16GB of available RAM” and “three times the disk space as your instance’s database directory (minimum 10 GB)” (Database Migrator page, read 2026-10-23). The same page says “Migrating from OrientDB requires using Java 8 or 11” and “The database migrator does not support Oracle JDK” (Database Migrator page, read 2026-10-23).
On formats, the same page says “PostgreSQL and H2 do not support Bower or the community formats” and “Unsupported formats are not migrated” (Database Migrator page, read 2026-10-23). The same page says “The migrator does not support migrating back to OrientDB from H2 or PostgreSQL”, and “Test the migration before running in production” (Database Migrator page, read 2026-10-23).
After the database move, Sonatype says “After changing the database, upgrade your Nexus Repository instance to version 3.71.0 or later” and “Nexus Repository 3.71.0 and later does not support Java 8 or Java 11” (upgrade page, read 2026-10-23). Of the tasks that run after the migration, the Database Migrator page says they “are critical to the proper functioning of the repository after the migration process and may take a notable amount of time to complete” (Database Migrator page, read 2026-10-23).
The move
The other way forward leaves your server as it is. CloudRepo is a managed artifact repository for Maven, PyPI, npm and Docker: we run the servers, the upgrades and the patches. Our migration tool, cloudrepo-migrate nexus3, reads a Nexus 3 server through its REST API and its repository URLs, and never writes to it. Version 0.6.0 of cloudrepo-migrate is tested against Nexus 3.76.0.
Install it, then do a dry run, which lists what would move and uploads nothing:
pipx install cloudrepo-migratecloudrepo-migrate nexus3 --nexus-url https://nexus.example.com --org your-org --dry-runIt reads your Nexus login from NEXUS_USERNAME and NEXUS_PASSWORD, and your CloudRepo token from CLOUDREPO_TOKEN: set them in your shell, never on the command line. The tool moves into CloudRepo repositories that already exist, so create them first. Then do the real run, the same command without --dry-run:
cloudrepo-migrate nexus3 --nexus-url https://nexus.example.com --org your-orgWithout --dry-run, cloudrepo-migrate nexus3 moves a Nexus 3 server’s hosted Maven, npm and PyPI repositories and checks every file it moves. Proxy and group repositories are listed and skipped with a reason. A re-run resumes: a file CloudRepo already holds with the same bytes is counted, not uploaded again. For a format the tool does not move, export the files and upload them with the commands you already use. The Nexus 3 migration guide has the steps and every option.
Upgrade or move
Upgrade if you want to keep running the server yourself: the steps above are the vendor’s, in its own words. Move if you would rather stop running it: the tool copies a Nexus 3 server’s hosted Maven, npm and PyPI repositories into CloudRepo, and we run the upgrades from then on. Either way, a dry run reads your server and uploads nothing. See the plans: each self-serve plan starts with a 14-day free trial.
Before you sign a Nexus Pro quote, send it to us: we’ll give you a very competitive counteroffer.
Every vendor page this article quotes was read on 2026-10-23. Vendors change their pages, so check each one before you decide.