Sonatype Licensing Explained: Nexus Community vs Pro, and the Move to Guide
This page answers the Sonatype licensing questions buyers actually ask — what Nexus Repository Community Edition can and cannot do, what happens when you hit its limits, and why you can no longer buy Sonatype Lifecycle as a new customer. Figures are Sonatype list prices in USD.
The short answer: two things changed recently and both matter. Community Edition limits were cut by more than half in December 2025 and are now enforced — exceed them and you lose write access, so builds that publish artifacts fail. And Sonatype Lifecycle is no longer sold to new customers; its capabilities now sit inside a new product called Sonatype Guide.
What does Sonatype sell now?
The lineup was reorganised in 2026 and several familiar names have moved or gone:
| Product | Status |
|---|---|
| Nexus One Platform | Current bundle brand, replacing “Sonatype Platform” |
| Sonatype Nexus Repository | Current — Community Edition and Pro |
| Sonatype Repository Firewall | Current (Firewall “Classic” is sunset) |
| Sonatype Guide | Current, newest — now carries the Lifecycle capabilities |
| Sonatype Lifecycle | Existing customers only; not sold to new customers |
| Sonatype SBOM Manager | Folded into Guide for new customers |
| Nexus Repository OSS | Replaced by Community Edition, Feb 2025 |
| Sonatype Auditor | Sunset |
| Nexus Repository 2 | Sunset |
Sonatype’s own pages disagree on this. The products page still lists Lifecycle and SBOM Manager as standalone products; the pricing page states plainly that new customers must purchase Guide instead. Treat the pricing page as the commercial position and get confirmation in writing before planning around a Lifecycle purchase — contact us and we will establish what is actually available to you.
Is Nexus Repository Community Edition good enough?
It depends almost entirely on scale, and the ceiling is lower than most people assume.
| Version | Component limit | Daily request limit | Enforcement |
|---|---|---|---|
| 3.76.1 and earlier | — | — | Monitored, not enforced |
| 3.77.0 | 100,000 | 200,000/day | Enforced, 30-day grace |
| 3.87.0 onward (Dec 2025) | 40,000 | 100,000/day | Enforced |
What happens when you hit the limit is the part to understand. Sonatype’s own staff put it plainly: go above the usage limits and you cannot write to Nexus Repository until usage falls back below them. This is not a warning banner. Builds that publish artifacts fail.
Two things make the 40,000-component ceiling arrive faster than expected:
- Proxy repositories count toward the component limit. A proxy of Maven Central alone can consume a substantial share of the allowance before any of your own artifacts land.
- Failed requests reportedly count toward the request limit, which makes a misconfigured pipeline expensive in allowance terms as well as build time.
The limits were also cut in a minor version bump, from 3.86 to 3.87, without being advertised as a reduction. Anyone depending on Community Edition should pin versions deliberately and treat the free tier as subject to unilateral change.
What Pro adds
| Capability | Community Edition | Pro |
|---|---|---|
| Full format support (Maven, npm, PyPI, NuGet, Hugging Face) | Yes | Yes |
| CI/CD integration | Yes | Yes |
| External PostgreSQL | Yes | Yes |
| Unlimited components and transactions | — | Yes |
| High availability & resiliency | — | Yes |
| Zero-downtime upgrades | — | Yes |
| SSO / SAML | — | Yes |
| Full AWS, Azure, GCP support | — | Yes |
| Enterprise support and SLA | — | Yes |
Community Edition did gain formats in early 2025 — Cargo, Conan V2, Composer and Hugging Face moved into the free tier — so the direction of travel is not uniformly restrictive. But SSO, HA and an SLA have always been the Pro gates, and for most organisations one of those three forces the decision before the component count does.
What does Sonatype cost?
| Product | Price | Included |
|---|---|---|
| Nexus Repository Community Edition | Free | 40,000 components / 100,000 requests per day |
| Nexus Repository Pro, self-hosted | $7,500/year | 50,000 components, 15M monthly requests |
| Nexus Repository Cloud Edition | From $1,950/year | 25 GB, then $1.10/GB to 1,000 GB, $0.90/GB above |
| Repository Firewall Cloud | $4,800/year | npm, Maven, PyPI, NuGet |
| Repository Firewall self-hosted | Quote | 15+ formats, air-gapped support |
| Sonatype Guide Free | $0 | 500 credits, unlimited developers |
| Sonatype Guide Pro | $1,200/year | 5,000 credits, priority support |
| Sonatype Guide Enterprise | Quote | Governance, policy management, automated waivers |
Do not anchor on $1,200 for software composition analysis. Guide Pro is an intelligence and API product. The Lifecycle-equivalent governance, policy engine and waiver workflow sit in Guide Enterprise, which is quote-only. If someone has budgeted an enterprise SCA programme at Guide Pro pricing, the number is wrong by an order of magnitude.
How does Sonatype count licences?
This is genuinely contested, and you should treat it as an open question until it is written into your order form.
Sonatype’s own contractual language for user-based products is extremely broad. A separate subscription is required for each individual — including employees, contractors and subcontractors — who produces, consumes or evaluates artifacts stored in or scanned by the product, or who evaluates or in any way uses any reports generated by it.
Read that last clause carefully. It extends the countable population well beyond people who commit code, to anyone who reads a vulnerability report. Other mechanics from the same source:
- Counting is by individual, not account — one person with a token and a username is one licence.
- Anonymous users still require licensing.
- Shared people across teams are counted once: two 20-developer teams with 10 people in both is 50 licences, not 60.
- Total user count must stay within licensed limits across production and test instances combined.
- On expiry, all functionality ceases except installing a new licence and generating support files.
Meanwhile third-party sources describe Lifecycle variously as licensed per application, per user, and per contributing developer — and Sonatype’s new Guide tiers advertise “unlimited developers” and meter on credits instead. What consumes a credit is not published anywhere we could find.
The practical guidance: get the licensing unit, the definition of a countable user or credit, and the true-up mechanism written into the order form. A verbal answer from a sales conversation is not good enough here, because the contractual definition and the marketing description genuinely differ.
Nexus Repository Pro is the clean exception — it is licensed per instance with usage caps, not per developer.
What changed in 2025 and 2026
- Feb 2025 — Community Edition replaces the OSS distribution; PostgreSQL support added; several formats move into the free tier.
- 3.77.0 — Community Edition usage limits become enforced, with a 30-day grace period.
- Dec 2025 (3.87.0) — limits cut to 40,000 components and 100,000 requests per day.
- June 2025 — OSSRH end of life, replaced by the Central Publisher Portal. Affects anyone publishing to Maven Central.
- 2026 — Sonatype Guide launches; Lifecycle and SBOM Manager consolidate into it for new customers.
- 2026 — OSS Index migrates into Guide and is now metered by credits. Organisations previously making tens of thousands of free lookups a month report exhausting the 500-credit free allowance within a day. This materially affects OWASP Dependency-Check and similar free tooling.
Note what is not on that list: a list-price increase. The economically equivalent change was cutting the free tier’s allowance, which pushes free users toward the $7,500 Pro tier without any price moving.
Frequently asked questions
Will Sonatype cut the Community Edition limits again?
They have done it once already, in a minor version, with roughly a 50–60% reduction. There is no published commitment against further changes. If Community Edition is load-bearing for your builds, that is a risk to plan around rather than assume away.
Can we still buy Sonatype Lifecycle?
Not as a new customer — you buy Sonatype Guide, which now carries the software composition analysis and open source governance capability. Existing Lifecycle customers can still add user licences to an existing instance.
Do non-production, DR and HA instances need separate licences?
Sonatype markets “no per-node charges” for high availability clusters and edge nodes, and its user-based terms count users once across production and test. Neither is a contractual guarantee in anything we could find publicly — both should be in your order form.
What happens to our artifacts if we do not renew?
For user-based products, all functionality ceases except licence installation and support-file generation. For Nexus Repository Pro specifically, whether the instance goes read-only or stops entirely is not clearly documented. Ask before you need to know.
How does this compare to JFrog Artifactory on cost?
Different shapes. Sonatype’s self-hosted Pro is a flat $7,500 annual fee with usage caps. JFrog is a monthly subscription plus metered consumption of storage and transfer, with security priced per contributing developer. Sonatype has a genuinely free tier; JFrog no longer does. Which wins depends on your artifact volume and developer count, and the comparison has to be modelled on your actual numbers rather than headline prices.
What support comes as standard?
Standard support — 8am to 5pm local, three-hour Severity 1 response — is included with every subscription. Extended (24×7 on production outages) and Gold (24×7, one-hour Severity 1, direct senior engineer routing) are paid add-ons.
Pricing and licensing terms verified 19 September 2026 against Sonatype’s published pricing, community forums, help documentation and sunsetting notices. Sonatype’s products page and pricing page currently disagree on whether Lifecycle and SBOM Manager are still sold standalone. Confirm before budgeting.
About to hit the Community Edition ceiling?
We size Nexus estates against real component and request volumes, work out whether Pro, Cloud or a different architecture is the right answer, and handle the migration — including the Lifecycle-to-Guide question if you are an existing customer.
Speak With An Expert