Nexus Repository OSS (Community) or Pro: differences and when to upgrade

The free version of Nexus Repository, previously known as OSS, is now called Community Edition. It runs only in self-hosted mode and is limited to 40,000 components or 100,000 requests per day. You should move to Pro when you hit these limits or when you need high availability, SSO, cloud storage and vendor support. Pro+ is needed if you want to block malicious packages at the point of entry.

What happened to Nexus Repository OSS

The name "OSS" still appears in older guides and discussions, but Sonatype has renamed the free edition. On the Sonatype forum it is stated that starting with version 3.77.0 the free edition is called Nexus Repository Community Edition. A Sonatype representative there also says that OSS binary builds have been discontinued ("sunset"), and that all binary builds from version 3.77 onward are Community Edition. To upgrade, you must accept the Community Edition end user license agreement (EULA). A direct upgrade to 3.77.0 is possible from version 3.71.0 and above.

According to Sonatype, the open source core (Nexus Repository Core, EPL license) remains on GitHub as source code but is not distributed as ready-made builds; you can compile it yourself, but some OSS features are missing from the core. If you read third-party instructions for "Nexus OSS", keep in mind that the limits and feature set may have changed. Check the documentation for the version you plan to install.

Community Edition limits

According to the Usage Center reference page, a Community Edition deployment must stay within:

• 40,000 components in total, or
• 100,000 requests per day.

If a limit is exceeded, users cannot add new components until the deployment falls back below both thresholds. Usage metrics are updated with a delay of up to an hour. According to Sonatype, components already stored remain available for download. Loading a Pro license removes the restrictions.

Note: other materials cite different figures (100,000 components and 200,000 requests per day). Those are earlier values from old pages; check the current limits in the Usage Center for your version.

How do you know where you stand? A component is a storage unit in the repository, for example one version of a package. A single npm project with a large dependency tree can easily add thousands of components, and a proxy to Maven Central and npmjs.com caches every version that builds have ever requested. Requests are counted across all downloads from CI/CD: with hundreds of builds a day and no cache on the build side, 100,000 requests are reached faster than you might expect.

What Community Edition includes

• A broad set of formats. Sonatype describes it as the "full ecosystem": Maven, npm, PyPI, NuGet, Docker/OCI, as well as Cargo, Composer, Conan and Hugging Face.
• Proxy, hosted and group repositories for most formats.
• Free use without a bank card.

For a development team of several dozen people, or for a pilot, this is often enough. It is best viewed as a starting point.

What Pro provides

According to Sonatype's feature table, Pro includes:

• High availability and clustering — the service does not stop when a node fails.
• SAML 2.0 / OIDC and single sign-on (SSO) — integration with the corporate user directory.
• Cloud blob storage (AWS S3, Azure, Google Cloud Storage).
• Disaster recovery replication and recovery from accidental deletion.
• FIPS 140-2 support.
• Deployment options: cloud SaaS and self-hosted.
• No usage limits: Sonatype explicitly states that Pro has no limits on components or requests.

Pro is licensed on a usage basis, and pricing is available on request.

What Pro+ adds

Pro+ includes everything in Pro and adds control over what enters the repository:

• automatic quarantine of malicious packages, including new (zero-day) ones;
• ingestion policies based on package age, CVSS and risk level;
• license control and legal restrictions;
• control of dependencies for AI agents and MCP.

Pro+ includes the right to use Repository Firewall with all publicly available capabilities. For self-hosted deployments starting with Nexus Repository 3.97.0, you need to separately install IQ Server version 208 or later, connect it to Nexus and configure the protected repositories. Pro+ on versions below 3.97.0 works as regular Pro. If you already have a separate Firewall license, Pro can also work with Repository Firewall.

We covered why this protection is needed in our article on supply chain attacks.

How to assess your current volumes

Before deciding whether you need Pro, get the actual numbers. Sonatype has added a usage dashboard to the product, and it is by this dashboard that compliance with the limits is checked. The assessment process is as follows:

1. Open the usage dashboard in the administration section and record the number of components and requests per day. Remember that metrics are updated with a delay of up to an hour.
2. Look at the trend over several weeks: component growth usually comes in steps, when a new project is added or dependency versions change.
3. Account for peak days. Daily requests grow most during mass rebuilds, for example after a vulnerability is discovered in a popular library and all teams update their dependencies at once.
4. Estimate growth for the year: how many new projects, teams and formats you plan to connect.

If the forecast exceeds the limits, it is wiser to plan for Pro right away than to have new component additions blocked in the middle of a release. Also note that the sooner you align the budget, the less pressure there will be at purchase time: Pro licensing is based on usage, and the calculation is made on request.

When it is time to move to Pro

Guidelines for the decision:

1. You are approaching the limits. If you consistently use more than 70–80 percent of the components or requests in the Usage Center, plan the upgrade in advance: blocking new component downloads will stop builds at the most inconvenient moment. (The 70–80 percent threshold is our practical guideline, not a Sonatype requirement.)
2. The repository has become critical infrastructure. If a single Nexus outage halts work for all teams, a single virtual machine without a cluster is a single point of failure.
3. You need corporate authentication. An information security requirement for single sign-on via SAML/OIDC cannot be met without Pro.
4. Storage and recovery requirements. Cloud blob storage, replication and deletion rollback are needed under RPO/RTO policies.
5. You need vendor support. Community Edition is supported by the community, while commercial vendor support is tied to paid editions.
6. You need to block malicious packages. This is a question for Pro+ (or Pro plus a separate Firewall).

When Community Edition remains a reasonable choice

• A small team or a few projects within the limits.
• A pilot and evaluation of Nexus before purchase.
• Test and training environments.
• Projects where downtime during restoration from a backup is acceptable.

Practical advice: even on Community, enable regular backups and monitoring of usage metrics so that the move to a paid edition does not become an emergency.

What to consider when planning the budget

• Licensing model. Pro and Pro+ are licensed by usage, so estimate the volume and its growth rate in advance.
• Infrastructure. A high-availability cluster requires several nodes, an external database and shared storage; these costs need to be added to the license cost.
• Security modules. If package ingestion protection is needed right away, compare two paths: Pro+ with the right to use Repository Firewall, or Pro with a separate Firewall license.
• Migration timeline. Allow time for testing the upgrade, especially if the instance has been running an older version.

How to upgrade

Loading a Pro license removes usage restrictions without requiring a reinstallation. For moving to a clustered configuration, cloud storage or PostgreSQL, the steps depend on the version; check Sonatype's documentation before migrating and make a backup. If you have a large existing instance, it makes sense to agree on a plan with an integrator in advance. For a comparison with alternatives, read Nexus Repository vs JFrog Artifactory.

Frequently asked questions

Sources

• Sonatype: Nexus Repository Editions and Feature Availability
• Sonatype: Usage Center
• Sonatype: Nexus Repository Community Edition
• Sonatype: supported formats
• Sonatype Community forum: OSS is now Community Edition
• Sonatype Community forum: changes to the Nexus Repository Core codebase