# NPM Component-Unknown: How long does Sonatype take to register new versions of packages?

**URL:** <https://community.sonatype.com/t/npm-component-unknown-how-long-does-sonatype-take-to-register-new-versions-of-packages/14062>\
**Category:** Sonatype Lifecycle & Firewall\
**Created:** [December 17, 2024, 3:01pm UTC](https://community.sonatype.com/t/npm-component-unknown-how-long-does-sonatype-take-to-register-new-versions-of-packages/14062 "2024-12-17T15:01:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![djb](https://avatars.discourse-cdn.com/v4/letter/d/b782af/32.png) [@djb](https://community.sonatype.com/u/djb)\
**Post date:** [December 17, 2024, 3:01pm UTC](https://community.sonatype.com/t/npm-component-unknown-how-long-does-sonatype-take-to-register-new-versions-of-packages/14062/1 "2024-12-17T15:01:24Z")

</div>

As titled, how long does Sonatype take to register a new version of a component? I had previously heard or read that it takes minutes, at least with Maven, and had assumed it was somewhere in the same ballpark with NPM. However, it has been 2 days since one particular package was released, and it remains ‘unknown’.

Example package, still ‘unknown’: [array.prototype.flat - npm](https://www.npmjs.com/package/array.prototype.flat/v/1.3.3) v.1.3.3

---

<div class="post-metadata">

**Author:** ![kristin.chew](https://avatars.discourse-cdn.com/v4/letter/k/5fc32e/32.png) [@kristin.chew](https://community.sonatype.com/u/kristin.chew)\
**Post date:** [December 19, 2024, 12:57pm UTC](https://community.sonatype.com/t/npm-component-unknown-how-long-does-sonatype-take-to-register-new-versions-of-packages/14062/2 "2024-12-19T12:57:21Z")

</div>

We have seen that it can take up to 2 hours with NPM to have the validation completed. Depending on your firewall settings, this means you may encounter a “License-None” finding that can be set to auto-release after Sonatype has completed their process. Nexus Repo has a setting that can be enabled on the npm-proxy to download the last “good” version that complies with all your policies. This will allow developers with “get latest” to obtain the n-1 version if the latest is not yet through the validation process at Sonatype. Please note that we did need to have an updated version of Nexus Repo and be on a database that was not the default/internal database to avoid performance issues and outages that were not anticipated. Sonatype’s documentation only indicated the version of Nexus Repo where this was available.