What happened to the Nx Powerpack cache packages?

Nx deprecated @nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, and @nx/shared-fs-cache (the caching half of Nx Powerpack) because of the CREEP cache-poisoning vulnerability (CVE-2025-36852). The flaw is in their bucket-credential design and cannot be patched, so the packages will not receive updates. Nx recommends migrating to Nx Cloud or to a server that implements the Nx remote cache OpenAPI specification.

Is Cachely a drop-in replacement for @nx/s3-cache and the other Powerpack cache packages?

Yes. Cachely is a managed implementation of the exact Nx remote cache OpenAPI specification Nx points migrators at. You remove the plugin and its bucket/IAM plumbing, set NX_SELF_HOSTED_REMOTE_CACHE_SERVER and NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN, and keep your nx.json task config unchanged.

Why is a bucket-backed Nx cache unsafe?

The deprecated packages share a single credential with read and write access to the whole cache, so any pull-request build that holds it can upload a poisoned artifact that later trusted builds download. Cachely closes this by brokering every request through its API: pull-request builds get read-only tokens, and writes are create-if-absent (an existing key returns 409 Conflict), so a known-good artifact can never be replaced.

Do I still need a Powerpack license key with Cachely?

No. Cachely does not use Powerpack. Nx self-hosted remote cache support ships in the Nx CLI itself (Nx 19+); Cachely is the server side, on a flat subscription with no bucket to provision.

How is Cachely priced compared with the deprecated Powerpack cache packages?

Cachely uses one flat subscription based on usage limits, not per-seat or per-workspace billing. It replaces plugin plus bucket/IAM overhead with a managed cache service.

Cachely vs Nx Powerpack cache

The supported successor to the deprecated Nx Powerpack cache packages.

Nx deprecated its own self-hosted cache packages - @nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, and @nx/shared-fs-cache, the caching half of Nx Powerpack - because the CREEP cache-poisoning vulnerability (CVE-2025-36852) is baked into their bucket-credential design and cannot be patched. Nx's migration advice is Nx Cloud, or a server that implements the Nx remote cache OpenAPI specification. Cachely is exactly that server, managed for you, with the 409-on-existing-key and read-only token enforcement the spec demands.

Start free

Quick answers

Cachely vs Nx Powerpack cache: pricing and feature answers

Is migration from @nx/s3-cache a drop-in change?

Yes. Remove the deprecated plugin, set NX_SELF_HOSTED_REMOTE_CACHE_SERVER NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN and keep nx.json task config unchanged.

Why move off Nx Powerpack cache packages now?

This page states those packages were deprecated after CVE-2025-36852 and are not receiving updates or patches.

What changes in day-to-day operations?

You move from shared bucket credentials to scoped workspace tokens enforced at the API, with read-only tokens for untrusted builds.

Side by side

Cachely vs the Nx Powerpack cache packages (@nx/s3-cache and friends)

Cachely versus the Nx Powerpack cache packages (@nx/s3-cache and friends) compared feature by feature.
Feature	Cachely	Nx Powerpack cache
Status	Actively developed managed service.	Deprecated; no updates or security patches, may be removed from npm.
Cache poisoning (CVE-2025-36852)	Closed by design: read-only PR tokens plus create-if-absent writes (409 on existing keys), enforced at the API.	Vulnerable by design - one bucket credential grants read and write to every build, and it cannot be fixed.
Credential model	Per-pipeline workspace tokens, scoped read-only or read-write, revocable in one click.	A single cloud storage credential shared across all builds, managed through bucket IAM.
Infrastructure	Nothing to provision - managed storage on Cloudflare R2 included.	Your own S3/GCS/Azure bucket or shared filesystem, plus its IAM, lifecycle, and cost management.
License	No CLI-side license: Nx self-hosted remote cache support ships in Nx 19+.	Required a Powerpack activation key (free only for small teams).
Insights and ROI	Hit rate, slowest tasks, CI minutes and cost saved, optimization suggestions.	None - a bucket has no idea what it saved you.
Migration effort	Remove the plugin, set two environment variables. nx.json task config is unchanged.	n/a - this is what you are migrating from.

Comparison reflects publicly documented behaviour as of 2026. Nx Powerpack cache may have changed since; let us know and we will update the page.

Bottom line

When Cachely is the right call

If you are on one of the deprecated packages today, Nx's own guidance is to treat them as a live risk and migrate. Nx Cloud is the first-party option; a hardened OpenAPI-spec server is the self-hosted-style option.

Choose Cachely when you want that second option without building and operating it yourself: the same drop-in protocol, the mandatory anti-poisoning behaviour already enforced, managed storage included, and ROI reporting on top - at one flat price. If you specifically want a bucket-backed setup, the Nx S3 cache guide walks through the @nx/s3-cache replacement options.

Start free See pricing

Related guides

FAQ

Cachely vs Nx Powerpack cache: migration and feature FAQ

What happened to the Nx Powerpack cache packages?: Nx deprecated @nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, and @nx/shared-fs-cache (the caching half of Nx Powerpack) because of the CREEP cache-poisoning vulnerability (CVE-2025-36852). The flaw is in their bucket-credential design and cannot be patched, so the packages will not receive updates. Nx recommends migrating to Nx Cloud or to a server that implements the Nx remote cache OpenAPI specification.
Is Cachely a drop-in replacement for @nx/s3-cache and the other Powerpack cache packages?: Yes. Cachely is a managed implementation of the exact Nx remote cache OpenAPI specification Nx points migrators at. You remove the plugin and its bucket/IAM plumbing, set NX_SELF_HOSTED_REMOTE_CACHE_SERVER NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN and keep your nx.json task config unchanged.
Why is a bucket-backed Nx cache unsafe?: The deprecated packages share a single credential with read and write access to the whole cache, so any pull-request build that holds it can upload a poisoned artifact that later trusted builds download. Cachely closes this by brokering every request through its API: pull-request builds get read-only tokens, and writes are create-if-absent (an existing key returns 409 Conflict), so a known-good artifact can never be replaced.
Do I still need a Powerpack license key with Cachely?: No. Cachely does not use Powerpack. Nx self-hosted remote cache support ships in the Nx CLI itself (Nx 19+); Cachely is the server side, on a flat subscription with no bucket to provision.
How is Cachely priced compared with the deprecated Powerpack cache packages?: Cachely uses one flat subscription based on usage limits, not per-seat or per-workspace billing. It replaces plugin plus bucket/IAM overhead with a managed cache service.