Sonatype Nexus Repository 3.71.0 & chocolatey

[daemenseth]

Since upgrading to version 3.71.0 and migrating to the new database, we've encountered issues with Chocolatey due to Sonatype’s lack of support for deprecated NuGet v2 API requests.

Questions:

Is there an option in Sonatype to enable support for deprecated API requests to maintain backward compatibility?
Alternatively, is there a recommended approach to handle these legacy requests in Sonatype?
While there is a workaround available from Chocolatey, using choco feature disable --name='usePackageRepositoryOptimizations', it’s not ideal because it requires a client-specific setting.

Thank you for any guidance or recommendations!

[daemenseth]

the problem is the chocolatey upgrade comand has issues on a nuget hosted repository with the index.json specified.
In a nuget group on the nexus there is no issue.
For more information see also this [post}(https://github.com/chocolatey/choco/issues/3506#issuecomment-2474658940)

[mrprescott]

Unfortunately, we aren't planning to rebuild support for deprecated NuGet API endpoints in the foreseeable future, but we are aware there is an issue here. We'll leave this issue open to accumulate demand.

[daemenseth]

@mrprescott can you confirm if there is a known bug with Sonatype Nexus and Chocolatey using v3 nuget repo's.
That is what Chocolatey says in this thread: chocolatey/choco#3506

Is there something we can do together to fix this issue?

[TK5-Tim]

Is there a timeline to resolve this issue?

[mrprescott]

@TK5-Tim We're not planning any changes relating to this issue in the immediate future, but we are monitoring demand.

[daemenseth]

@mrprescott Could you confirm if there are any known issues with Sonatype Nexus and Chocolatey? Is this issue related to Chocolatey due to the use of deprecated features?

Chocolatey mentions there is a known issue on the Nexus side, but it doesn't appear in Sonatype's public issue tracker:
See this link

[fdcastel]

Oh, great!

Just passing to mention that I also encountered this issue.

After taking the time to migrate my old database from OrientDB to H2, I have now discovered that this disrupted my company's entire Chocolatey feed.

It would have been immensely helpful to see a mention of this in the release notes of Nexus for Chocolatey users. I would not have migrated if I had known this.

Yes. The documentation tell us that v2 support was removed. But I would never have imagined that Chocolatey (which claims to support v3 repositories) would break like this.

---

To reiterate: Every chocolatey user out there has now to run

choco feature disable --name='usePackageRepositoryOptimizations'

to use any feed from Sonatype Nexus OSS 3.71+.

[fdcastel]

According to the Chocolatey team, the issue originates from the Nexus side:

Nexus advertises a NuGet v2 search endpoint in it's NuGet v3 repository feeds. Chocolatey CLI is respecting that and using that NuGet v2 endpoint, which means NuGet v2 repository optimizations come into play.

To the best of my understanding, the search features of a v3-only repository are more limited compared to those of a "v2+v3"-capable repository.

As @mrprescott mentioned, the v2 endpoints have been deprecated and removed. That’s understandable. However, in this case, Nexus should not be advertising v2 features to its clients.

This seems to be the core issue. Chocolatey is acting based on the capabilities Nexus claims to support.

More information: https://blog.chocolatey.org/2025/02/repository-search-queries/