Software supply-chain governance, sold and operated by Merito.

Sonatype is the supply-chain governance vendor with the deepest open-source intelligence dataset in the AppSec category. The component intelligence database catalogs more than 140 million open-source components and the vendor publishes that it sees 70% more open-source vulnerabilities than alternative sources, delivers 10x faster insights than the National Vulnerability Database, and achieves 30% faster mean time to remediate compared to industry averages. Programs that adopt Sonatype get the dataset depth as the practical asset.

Nexus Repository is the artifact management foundation. Universal repository covers Maven, npm, PyPI, NuGet, Docker, Helm, RubyGems, Go modules, and the long tail of package formats. Nexus Repository Pro adds high availability, replication, SAML SSO, staging and build promotion, and enterprise support on top of the open-source community edition. Lifecycle provides Software Composition Analysis and policy enforcement across the SDLC, with repository firewall blocking malicious or non-compliant components at the registry-fetch boundary before they reach the build.