@nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, and @nx/shared-fs-cache, the caching half of Nx Powerpack - because the CREEP cache-poisoning vulnerability (CVE-2025-36852) is baked into their bucket-credential design and cannot be patched. Nx's migration advice is Nx Cloud, or a server that implements the Nx remote cache OpenAPI specification. Cachely is exactly that server, managed for you, with the 409-on-existing-key and read-only token enforcement the spec demands.On Nx 20.8 or later, yes. Upgrade every runner first, then remove the deprecated plugin, set NX_SELF_HOSTED_REMOTE_CACHE_SERVER
NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN and keep nx.json task config unchanged.
This page states those packages were deprecated after CVE-2025-36852 and are not receiving updates or patches.
You move from shared bucket credentials to scoped workspace tokens enforced at the API, with read-only tokens for untrusted builds.
Related: Cachely pricing | Security model | Nx Cloud alternative guide | Setup docs.
This is a cache-backend swap. Nx still computes the task hash from the same targets, inputs, outputs, and named inputs, so your task graph does not need to move. The change is removing the deprecated bucket plugin and pointing Nx at a server that implements its self-hosted remote cache API.
Nx introduced its OpenAPI self-hosted cache support in version 20.8. Upgrade local development, CI, and any release runners before removing the Powerpack package. Complete the normal Nx migration review first; the cache-backend swap itself does not require changing task inputs or outputs.
npm uninstall @nx/s3-cache
# or @nx/gcs-cache, @nx/azure-cache, @nx/shared-fs-cacheDelete the matching cache block from nx.json, remove its bucket credentials from CI and developer environments, then revoke those credentials. Do not leave an unused writer key active as a fallback.
NX_SELF_HOSTED_REMOTE_CACHE_SERVER=https://remote.cachely.dev
NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN=<your-token>Use a read-write token only on protected branches. Pull requests and forks should receive a read-only token, so they can restore trusted artifacts but cannot publish a cache entry that a later privileged build will consume.
Primary sources: Nx's deprecated self-hosted cache package notice, Nx's self-hosted remote cache guide, and CVE-2025-36852. For S3-compatible endpoints and the old plugin shape, see the Nx S3 cache migration guide.
| Feature | Cachely | Nx Powerpack cache |
|---|---|---|
| Status | Actively developed managed service. | Deprecated; no updates or security patches, may be removed from npm. |
| Cache poisoning (CVE-2025-36852) | Closed by design: read-only PR tokens plus create-if-absent writes (409 on existing keys), enforced at the API. | Vulnerable by design - one bucket credential grants read and write to every build, and it cannot be fixed. |
| Credential model | Per-pipeline workspace tokens, scoped read-only or read-write, revocable in one click. | A single cloud storage credential shared across all builds, managed through bucket IAM. |
| Infrastructure | Nothing to provision - managed storage on Cloudflare R2 included. | Your own S3/GCS/Azure bucket or shared filesystem, plus its IAM, lifecycle, and cost management. |
| License | No CLI-side license: Nx self-hosted OpenAPI remote cache support ships in Nx 20.8+. | Required a Powerpack activation key (free only for small teams). |
| Insights and ROI | Hit rate, slowest tasks, CI minutes and cost saved, optimization suggestions. | None - a bucket has no idea what it saved you. |
| Migration effort | Upgrade to Nx 20.8+ if needed, remove the plugin, then set two environment variables. nx.json task config is unchanged. | n/a - this is what you are migrating from. |
Checked against public documentation on 20 August 2026. Nx Powerpack cache may have changed since; let us know and we will update the page.
If you are on one of the deprecated packages today, Nx's own guidance is to treat them as a live risk and migrate. Nx Cloud is the first-party option; a hardened OpenAPI-spec server is the self-hosted-style option.
Choose Cachely when you want that second option without building and operating it yourself: the same drop-in protocol, the mandatory anti-poisoning behaviour already enforced, managed storage included, and ROI reporting on top - at one flat price. If you specifically want a bucket-backed setup, the Nx S3 cache guide walks through the @nx/s3-cache replacement options.
NX_SELF_HOSTED_REMOTE_CACHE_SERVER
NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN and keep your nx.json task config unchanged.