VMware Public Patch Repository URLs were deprecated as of April 23, 2025
As of April 23, 2025, VMware’s public patch and update repository URLs have been officially deprecated following the transition to Broadcom’s entitlement-based distribution model. This change affects how vCenter Server, ESXi, and Lifecycle Manager (vLCM) retrieve software updates and component metadata.
Public facing repository URLs and authentication mechanisms are changing in VMware. The Download URLs are no longer common but unique for each customer and therefore will require to be re-configured.
The update URL is no longer functional. This is expected public patch repository URLs were deprecated as of April 23, 2025, and have been replaced by customer‑specific, authenticated download tokens.
To continue receiving updates in connected environments, administrators must manually update their repository configurations in Lifecycle Manager and VAMI or via CLI to point to the new authenticated URLs.
VMware now requires the use of a download token, unique to your VMware support account, to access update repositories.
Download the Token from Broadcom Support Portal by following the steps in VCF Authenticated downloads Configuration Update Instructions. If the token has already been acquired, apply the same by following below instructions.
The software depots address has changed to dl.broadcom.com for all the VCF (VMware Cloud Foundation) Products or Components.
Please ensure that the affected components can reach the dl.broadcom.com through any firewall. Once depots are successfully reconfigured please remove the legacy depot addresses:
- depot.vmware.com
- hostupdate.vmware.com
- vapp-updates.vmware.com
from firewall config as these addresses will be retired at a future date.
vCenter Update via vCenter Server Appliance Management Interface (VAMI)
When trying to update the vCenter appliance by using the vCenter Server Appliance Management Interface (VAMI), you will run as of April 23, 2025 into the following error.
https://<vcenter-FQDN or IP address>:5480/#/ui/update/availableUpdates
Update section: Network failure. Check the network settings and try again.
To construct the new repository URL including our custom specific Download Token, we first need to wait the connection attempt before we can click on the Settings button below.
Use the Default URL to construct new URL with the Downloaded Token.
vCenter Server 7.x
Default:
https://vapp-updates.vmware.com/vai-catalog/valm/vmw/8d167796-34d5-4899-be0a-6daade4005a3/<current_version>.latest
Change to:
https://dl.broadcom.com/<downloadToken>/PROD/COMP/VCENTER/vmw/8d167796-34d5-4899-be0a-6daade4005a3/7.0.3.02200vCenter Server 8.x
Default
https://vapp-updates.vmware.com/vai-catalog/valm/vmw/8d167796-34d5-4899-be0a-6daade4005a3/<current_version>.latest
In the Update Settings dialog select Specified under Repository Settings and enter the new URL including the Download Token and clicking on SAVE.
Note: Replace <downloadToken> with the actual downloaded token id.
The token is valid for downloading products associated with the license (e.g., vSphere, vCenter, ESXi, etc.). So you cannot use a token from a different account and associated license.
New available Updates will be found again.
Source: https://knowledge.broadcom.com/external/article/390120
vSphere Lifecycle Manager Updates (ESXi Hosts)
In vSphere Lifecycle Manager under Patch Setup the default Download Sources (VMware’s formerly public patch and update repository URLs) will now as of April 23, 2025 shown as not connected anymore.
Connectivity Status under Lifecycle Manager > Settings > Patch Setup for hostupdate.vmware.com URL’s show Not Connected or Validating.
Triggering sync updates will fail.
A general system error occurred: A depot is inaccessible or has invalid contents. Make sure an official depot source is used and verify connection to the depot.
Disable VMware’s formerly default repositories and configure the new Broadcom public patch and update repository URLs including the custom specific Download Token.
On the vSphere Client Home page, Navigate to Lifecycle Manager. Under Settings select Administration -> Patch Setup and disable all legacy repositories.
Note: If the vCenter Server is running on 7.0 U3c (build 19234570) or 8.0 GA versions (8.0GA, 8.0a, 8.0b & 8.0c), configuring the Custom URLs mentioned below will fail. Please perform Update Manager DB reset before proceeding with below steps if the vCenter Server is on these impacted versions.
Note: The default URLs cannot be removed and delete button will be greyed out, it can only be disabled.
Add the below URLs one by one by clicking ‘NEW’:
New URLs:
https://dl.broadcom.com/<Download Token>/PROD/COMP/ESX_HOST/main/vmw-depot-index.xml https://dl.broadcom.com/<Download Token>/PROD/COMP/ESX_HOST/addon-main/vmw-depot-index.xml https://dl.broadcom.com/<Download Token>/PROD/COMP/ESX_HOST/iovp-main/vmw-depot-index.xml https://dl.broadcom.com/<Download Token>/PROD/COMP/ESX_HOST/vmtools-main/vmw-depot-index.xml
Note: Replace <Download Token> with the actual downloaded token id.
Source: https://knowledge.broadcom.com/external/article/390121
Links
VCF authenticated downloads configuration update instructions
https://knowledge.broadcom.com/external/article/390098Unable to patch the vCenter via VAMI as it fails to download the updates from Broadcom public repositories
https://knowledge.broadcom.com/external/article/390120Error: A general system error occurred: Failed to download VIB(s): Error: HTTP Error Code: 403, vLCM fails to download the ESXi patches and images from online repositories
https://knowledge.broadcom.com/external/article/390121“Executing download job throws error: HTTP Error Code: 403” UMDS fails to download the patches from online repositories
https://knowledge.broadcom.com/external/article/390123
