Skip to main content

Security updates: eMudhra certificate incident and PHP2Shell: Sonatype is aware of the eMudhra certificate incident and the PHP2Shell vulnerabilities. We are updating our products to address the eMudhra issue and have confirmed that Sonatype products are not impacted by PHP2Shell. Read Sonatype's assessment and guidance

Reduce frequent npm PCCS cache invalidation log messages

Updated

Reported in: Nexus Repository 3.96.0; other versions may also be affected.

Problem

Nexus Repository may write frequent Invalidating PCCS cache for repository messages to the npm repository log, including when PCCS-related features are not enabled. The log message by itself does not establish that PCCS is enabled or that the repository has failed.

Symptoms

The npm repository log may contain following entries:

2026-10-26 07:45:50,716+0000 INFO  [qtp943624035-32507]  ******** com.sonatype.nexus.repository.npm.internal.kv.NpmKeyValueFacet - Invalidating PCCS cache for repository npm-repo packageId @microsoft/workiq

Possible causes

The report for this issue describes the message appearing when PCCS-related features are not enabled. No separate functional impact is established by the report.

Solution

  1. In Nexus Repository, open Support > Logging.
  2. Set the logger com.sonatype.nexus.repository.npm.internal.kv.NpmKeyValueFacet to WARN.

This issue is tracked internally as FIRE-1417. If this issue is resolved in a future release, the Nexus Repository release notes will include a note about the resolution.