· ReadyStack
Worked example
Real numbers from this tool, line by line.
Nexus Community Edition pauses new components past 40,000, and for platform engineers in the US, the UK or the EU who run one Nexus for npm, Maven and pip, the bundled sample project points at it from 9 URLs in 6 files:
| File:line | Nexus line | Replacement |
|---|---|---|
| .npmrc:1 | registry=https://nexus.acme.internal/repository/npm-group/ | registry=http://verdaccio.acme.internal:4873/ |
| .npmrc:2 | @acme:registry=.../repository/npm-hosted/ | @acme:registry=http://verdaccio.acme.internal:4873/ |
| settings.xml:6 | <url>.../repository/maven-public/</url> | <url>http://reposilite.acme.internal:8080/releases</url> |
| pom.xml:5 | deploy to .../repository/maven-releases/ | http://reposilite.acme.internal:8080/releases |
| pip.conf:2 | index-url = .../repository/pypi-group/simple | https://pulp.acme.internal/pypi/pypi-group/simple/ |
| docker-compose.yml:3 | image: sonatype/nexus3:3.77.0 | verdaccio/verdaccio:6 + dzikoysk/reposilite |
The checker's last line sums it up: 3 npm URLs move to Verdaccio, 4 Maven and Gradle URLs to Reposilite, 1 PyPI index to Pulp and 1 container image to another registry.
What Sonatype changed
Sonatype's Community Edition onboarding page says Community Edition "supports up to 40,000 total components and 100,000 requests per day". For teams over either limit, "built-in safeguards will pause the addition of new components until usage returns below both thresholds." Starting Nexus Repository 3.77.0 or later moves an OSS instance into Community Edition through an onboarding wizard. An OSS instance on 3.70.x or earlier must first upgrade to 3.71.0, which means moving to an H2 database and Java 17.
Proxied packages are components too, so a busy npm or Maven proxy can reach 40,000 well before your own hosted artifacts do. For larger needs the page says to contact Sonatype sales; it publishes no Pro price.
Why grep and a chatbot are not enough
Nexus Usage Center (3.66.0 or later) counts components and requests, not which build files depend on the instance. Grep for "nexus" misses a host like repo.acme.com/repository/npm-group/ and cannot tell an npm registry line from a Maven deploy target. A chatbot cannot see your files. The checker reads the Nexus path shape and writes the replacement:
- npm registry and scoped registry lines go to Verdaccio on port 4873; the auth line becomes //verdaccio.<domain>:4873/:_authToken=${NPM_TOKEN}.
- Maven mirrors, repositories and distributionManagement go to Reposilite on port 8080, /releases or /snapshots.
- pip index-url goes to Pulp, which serves a PyPI index at /pypi/<base_path>/simple/.
- A sonatype/nexus3 image at 3.77.0 or later is flagged as Community Edition; below 3.77.0 it is flagged as OSS with the upgrade path.
Three projects, three answers
The bundled sample gives 11 findings: the 9 URLs, the 3.77.0 server image and the map line. A Helm values.yaml with tag: 3.70.1 gives one OSS warning with the 3.71.0 step. An .npmrc already on Verdaccio gives zero.
Free and key
Every finding and every replacement line is free in the open file, in VS Code or in the web version. The 12 rules run on your machine. A $29 licence key, once, adds a whole-workspace migration plan, a dated Nexus exposure report for the company and a CI gate that fails a build adding a new Nexus URL. Doing the inventory by hand costs administrator time: $47.66 an hour at the US median wage (BLS OEWS 2025, SOC 15-1244).
15 seconds — what it actually does
Questions people ask
What does Nexus Repository Pricing: Verdaccio Migration Map do?
It reads .npmrc, settings.xml, pom.xml, build.gradle, pip.conf, docker-compose.yml and Helm values.yaml and marks every Sonatype Nexus Repository URL by file and line. Each finding carries the replacement line: Verdaccio for npm, Reposilite for Maven and Gradle, Pulp for PyPI. It also flags a sonatype/nexus3 image at 3.77.0 or later, which runs Community Edition with its 40,000-component limit.
Who is this for?
Platform and DevOps engineers who run a self-hosted Sonatype Nexus Repository Community Edition for npm, Maven, Gradle or pip, and teams already moving to Verdaccio, Reposilite or Pulp. Community Edition supports up to 40,000 total components and 100,000 requests per day; above either limit it pauses the addition of new components until usage returns below both.
Why not ask a chatbot or grep for nexus?
A chatbot cannot see which of your .npmrc, settings.xml, pom.xml, build.gradle and pip.conf files still point at Nexus. Grep for "nexus" misses hosts like repo.acme.com/repository/npm-group/ and does not write the replacement line. Nexus Usage Center (3.66.0 or later) shows component and request counts, not which files depend on the instance. This checker writes the Verdaccio, Reposilite or Pulp line for each URL.
What is free and what needs a licence key?
Free, no key: every Nexus URL and Nexus server image in the open file, with file, line and the exact Verdaccio, Reposilite or Pulp line, from 12 rules. On the bundled sample it reports 9 Nexus URLs in 6 files. A $29 licence key, once, adds the whole-workspace migration plan, a dated Nexus exposure report and a CI gate.
What does the alternative cost?
Sonatype publishes no Pro price; its Community Edition page says to contact sales for larger-scale needs. Doing the inventory by hand means an administrator reading every build file: a network and computer systems administrator costs $47.66 an hour at the US median wage (BLS OEWS 2025, SOC 15-1244). Verdaccio, Reposilite and Pulp are open source. The key is $29 once.
When do the Community Edition limits apply?
There is no calendar date. The limits apply from the moment an instance runs Nexus Repository 3.77.0 or later, when the onboarding wizard moves OSS to Community Edition. OSS on 3.70.x or earlier must first upgrade to 3.71.0, which means an H2 database and Java 17. Usage Center shows current counts from 3.66.0 (Sonatype help, CE onboarding).
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.