This section contains the Release Notes for Artifactory Self-Managed releases.

To view a self-managed release's release notes, select the version from the table of contents.

📘

Note

Release notes for previous releases that have passed their end-of-life date (18 months after the initial release) can be found in Artifactory End of Life.

This section contains crucial notices for:

• Customers using AWS SDK storage.
• Self-Managed users using SAML SSO and basic authentication.

Before upgrading, make sure to review the changes and take the necessary actions.

• ASW SDK v2 is the Default AWS SDK Storage
  JFrog Artifactory has officially transitioned its default AWS SDK from v1 to v2 as of Artifactory 7.146.7. If you are setting up new S3 storage integrations or relying on the default configuration, Artifactory will now natively use SDK v2 from version 7.146.7.

⚠️

SDK Storage with KMS Client-Side Encryption

Customers using AWS SDK storage with KMS client-side encryption should not use AWS SDK v2. If you are using AWS SDK storage with KMS client-side encryption, ensure that in the binarystore.xml file awsSdkV2 is set it to false. For more information, see Amazon S3 Template Parameters.

• Multiple SAML SSO Provider Configurations

  The JFrog Platform now supports multiple configurations for SAML SSO providers. Enabling multiple SAML SSO configurations can help large organizations streamline the login and authentication processes for multiple platforms, resulting in a faster and more convenient authentication experience.

📘

Note

Before creating multiple SAML configurations, JFrog recommends deleting the old configuration and reconfiguring it with a different setting name other than Default. If you reconfigure your SAML configuration, you must also update the relevant information in the Identity Provider server.

• Enabling SSO Disables Basic Authentication By Default

  Enabling single sign-on authentication now disables internal password authentication by default. For more information, see Disable Basic Authentication Method.

⚠️

Breaking Change for SAML SSO

As notified in SAML SSO configuration, if you have configured SAML authentication in your environment, make sure to configure a Custom Base URL to prevent a 500 error.

• Migration of SAML Authentication Provider from Artifactory Service to Access Service

  As part of enhancements to the JFrog Access Service, which is becoming the primary service for authentication providers, the functionality for the SAML authentication provider has moved to the Access Service.

⚠️

Breaking Change for synchronizeLdapGroups User Plugin

Following the migration of SAML SSO from Artifactory service to Access service, the deprecated user plugin synchronizeLdapGroups will no longer be used for SAML SSO user login. As an alternative, the functionality of the plugin has been implemented as part of the provider. For more information, see Enabling Synchronization of LDAP Groups for SAML SSO.

This section includes all the Artifactory 7.161 releases.

Released: 25 August 2026

CVEs Addressed

Resolved Issues

Released: 21 August 2026

Resolved Issues

Released: 12 August 2026

Feature Enhancements

• Improved Throughput and Scalability for GCP

  Artifactory now automatically generates a significantly larger number of temporary upload prefixes on GCS buckets to improve upload throughput and scalability for GCP customers.

• Improved Azure Blob Storage Access Reliability
  Artifactory has improved Azure Blob Storage access reliability by introducing a configurable SAS start-time offset (sasStartTimeOffsetSeconds, default: 900 seconds) in binarystore.xml. This offset prevents intermittent 403 authorization errors caused by clock skew between Artifactory and Azure Blob Storage hosts. For more information, see Azure Blob Storage v2 Binary Provider.

• Security Hardening for Docker and OCI Referrers API

  Due to a change that hardened the OCI Referrers API (GET /v2/ <name>/referrers/<reference>), the API now returns 403 Forbidden if the authenticated user does not have read permission on the subject image. 

  Users or automations that previously relied on retrieving referrers without read permission on the subject will now receive 403 Forbidden. Grant read permissions on the relevant repository path to restore access.

  This change affects local, virtual, remote, and smart remote repositories. For virtual repositories, referrers are aggregated only from member repositories that the user is permitted to read. Related to CVE-2026-66380.

CVEs Addressed

Resolved Issues

Released: 27 July 2026

📘

Security Notice

This version is designed to fix multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments due to the additional security risks it introduces.

⚠️

Breaking Change for Remote Terraform Repositories

Due to a breaking change whereby Artifactory hardened controls on external Terraform URLs, remote Terraform repositories may return External URL is not allowed errors. If this error appears for a credible URL, an administrator must enable external dependency rewrite for the URL in the remote repository settings. For more information, see Remote Terraform Repository.

📘

Embedded OpenJDK Updated to Java 25

Starting with Artifactory version 7.161.15, the embedded OpenJDK has been updated to Java 25 (JDK 25.0.3). Please refer to the Embedded OpenJDK Version page for the complete compatibility matrix.

New Features

• masterKey and joinKey are now mandatory (Helm Charts only)

  Both masterKey and joinKey are now mandatory at install time.

  • On fresh install: both keys must be provided before running helm install.
  • On upgrade: reuse the existing keys from the previous deployment. Do not generate new keys.

  For more information, see Install JFrog Artifactory using Helm.

  To generate, retrieve, and configure the keys, see Manage Keys.

• Bundled Nginx certificate auto-generation disabled by default

  Starting with version 7.161, automatic certificate generation for the Nginx bundled with the Artifactory Helm chart is disabled by default. Auto-generated certificates are meant strictly for non-production environments and pose security risks if used in production.

  • Providing Certificates: You must supply custom TLS certificates as a pre-created Kubernetes secret managed by the user prior to deployment when HTTPS is enabled.
  • Upgrades: Upgrades using existing auto-generated certificates will continue to work, but we strongly recommend migrating to user-managed custom secrets.
  • Non-Production Environments: To enable auto-generated certificates for non-production setups, you must explicitly set the `generateSelfSignedCert: true`. For more information, see Terminate TLS with Custom Certificate.

• New services: JFBUS and JFMELT

  Two new services have been added to Self-Managed Artifactory instances:

  • JFBus is a service that provides an internal event bus (message queue) for asynchronous communication between JFrog services in the JPD.
  • JFMelt is a service that collects, processes, and routes audit and operational events generated by JFrog products in the JPD.

  These services run as part of the standard platform stack, connect directly to the Artifactory database, and are required for advanced JFrog capabilities to function.

  For more information, see Artifactory Product.

• New operating system support: Debian 13, RHEL 10, SUSE 15.7

  Artifactory and Distribution now support the following newly validated operating systems for self-managed installations:

  • Debian 13
  • RHEL 10
  • SUSE Linux Enterprise Server 15.7

  See the Supported Platforms and OS Matrix for the full list of supported operating systems and versions.

• Service pod architecture: Frontend, JFBus, and JFmelt as standalone Deployments

  Frontend, JFBus, and JFmelt now run as standalone Kubernetes Deployments and are enabled by default:

  • Frontend moves out of the Artifactory StatefulSet pod, where it previously ran as a container, and now runs in its own Deployment.
  • JFBus and JFmelt have always run as standalone Deployments since their introduction, but are now enabled by default instead of opt-in.

  JFmelt is an event collection and dispatch pipeline for the JFrog Platform (Pro and above; requires JFBus and JFConnect).

• splitServicesToContainers: false no longer supported in Artifactory Helm Charts

  In Artifactory Helm Charts, splitServicesToContainers defaults to true.

  Starting with Artifactory 7.161.x, setting splitServicesToContainers: false is no longer supported.

  Helm deployment or upgrade validation will fail if this parameter is explicitly set to false.

  For more information, see JFrog Platform Deprecations.

• Support for Agent Packages Repositories

  Artifactory now supports using the Agent Package Manager (APM) client to publish and install agent primitives in Agent Packages repositories in Artifactory. Agent Packages Repositories provide a governed, private registry for agent configuration, including skills, plugins, prompts, hooks, Model Context Protocol (MCP) servers, instructions, and agents.

  You can use Agent Packages repositories to distribute resources for harnesses like Claude, Cursor, Codex, and more. For more information, see Agent Packages Repositories.

• Markdown View in Artifacts Page

  A view option was added for Markdown (.md) files on the Artifacts page.

• Support for Agent Plugins Repositories

  Artifactory now supports Agent Plugins Repositories for secure storage and distribution of agent plugins across harnesses. Agent Plugins repositories in Artifactory provide the following capabilities:

  • Secure plugin ZIP storage: Use local Agent Plugins repositories in Artifactory to securely store plugin ZIP files, index metadata, and serve marketplace files for Claude, Cursor, and Codex.
  • Multi-harness plugins: Package a single plugin for one agent only, or for multiple agents in one plugin ZIP file using the JFrog CLI.
  • Native Claude marketplace integration: Register Artifactory as a plugin marketplace in Claude Code through claude-marketplace.json to download plugins natively.
  • Broad client support with JFrog CLI: Use the JFrog CLI to deploy multi-harness plugin directories and install plugins for supported harnesses.

  For more information, see Agent Plugins Repositories.

• Migration Tool for NuGet repository normalization

  The Migration Tool is now available in Artifactory Settings to migrate existing repositories to new normalization standards. As of this release, you can use the Migration Tool to migrate NuGet local, remote, and smart remote repositories. Each migration runs a dry run first and produces a report of compliant and non-compliant packages. You can optionally fix non-compliant packages before migration, and specify where to move remaining non-compliant packages. After migration, all packages left in the repository will be compliant with new artifact and package naming conventions, and PackageBaseAddress will be enabled.

  For more information, see Migration Tool.

• New REST API for Deleting Multiple Repositories

  A new REST API has been added for deleting multiple repositories. You can indicate which repositories to delete in the body of the request. If a specified repository cannot be deleted, this does not affect the deletion of other repositories specified in the body of the request. For more information, see Delete Multiple Repositories.
  

  Also, the legacy Delete Repository REST API, which deletes a single repository, has been fixed and now returns JSON instead of plain text in all cases (previously returned JSON only in case of an error). For more information, see Delete Repository.

• New Get Cluster Locks REST API

  Artifactory now provides a REST API that allows you to view locks. Use this REST API instead of the legacy distributed_locks table to troubleshoot stuck replication, indexing, or other operations:

  • GET /artifactory/api/system/locks: Returns locks across the cluster

  • GET /artifactory/api/system/locks/local: Returns locks held by the current node

  The REST APIs require PostgreSQL database, native DB locks enabled, and admin privileges. For more information, see Get Cluster Locks and Get Node Locks.

• Support for LuaRocks Repositories

  Artifactory now supports LuaRocks repositories, enabling you to manage your Lua dependencies across local, remote, and virtual repositories. This enhancement allows you to securely centralize, discover, and resolve all your LuaRocks packages from a single, controlled platform. For more information, see LuaRocks Repositories.

• Load Healer (Automatic Load Protection)
  This release introduces Load Healer automatic load protection, which protects Artifactory from overload caused by a single activity monopolizing the available worker threads. For more information, see Load Healer (Automatic Load Protection).

Feature Enhancements

Projects

• All Projects and Set Me Up Views Show Only Relevant Virtual Repositories

  The All Projects and Set Me Up views now show only the virtual repositories in projects that you belong to and also global (unassigned) virtual repositories. Virtual repositories from unrelated projects no longer appear in these views. Previously, All Projects and Set Me Up views listed every virtual repository reachable through underlying local and remote repositories, including repositories from projects unrelated to your work. This made the lists long and hard to navigate as the number of projects grew. This change does not affect permissions or your actual access to any repository.

Builds

• Build Search Optimization

  The build search operation has been optimized to provide you with faster results in API calls and the platform UI.

Packages

• Support for Sharded Conda Metadata

  Self-managed instances of Artifactory can now serve sharded repodata for Conda local, remote, and virtual repositories. This increases performance for large packages. To use sharded metadata, configure the Artifactory system property artifactory.conda.shards.enabled=true and configure the Conda client with repodata_use_shards: true and solver: libmamba. For more information, see Enable Conda Metadata Sharding.

• Cache Revalidation for Debian Component Files in Remote Repositories

  Debian remote repositories now support automatic cache revalidation for Components-{arch}.yml files in the dep11 directory. This enhancement ensures that these specific component files stay synchronized with upstream repositories, preventing stale data and hash mismatch errors for clients.

• Syncing Docker Tag Download Statistics for Shared Digests

  Artifactory can now align Docker and OCI tag download statistics when multiple tags point to the same image digest. Administrators can enable Synchronize download statistics for shared digests in Package Settings. When enabled, pulling by tag or digest updates Number of downloads, Last download date, and Last downloaded by for every tag that shares that digest in the same repository and image name. This applies only to tags that you have permissions to read. This enhancement gives a clearer picture of tag usage without changing how you pull images. For more information, see Enable Synchronized Download Statistics for Shared Digests.

• Support Added for NuGet v3 repository-signatures in Remote NuGet Repositories

  Artifactory now supports repository-signatures for remote NuGet v3 repositories when the upstream registry also supports repository-signatures. This is applicable only to remote NuGet v3 repositories.

• Support Added for Git Submodules for CocoaPods Packages

  Artifactory now supports Git submodules for CocoaPods packages fetched from remote repositories. This is also supported for virtual repositories when the pod is resolved through a remote child repository.

• Improved PyPI Simple JSON Processing Time

  The response times for api/pypi/simple were reduced on PyPI remote repositories by caching the translated package and repository indexes.

• Enhanced Metadata Support for PyPI Simple JSON API

  Support has been added for several metadata fields in the PyPI Simple JSON API:

  • description_content_type
  • dynamic
  • license_expression
  • license_files
  • maintainer
  • maintainer_email
  • project_urls
  • provides_extra
  • requires_dist

• Enhanced Package Details for Skills

  When viewing package details for items in Skills repositories, the SKILL.md file contents now appear in the Packages view.

• NuGet Remote Metadata Caching Enhancements for Chocolatey
  
  Virtual NuGet repositories that connect to Chocolatey now have an enhanced remote caching layer. This cache stores both successful package metadata and "not found" responses (404), enhancing performance and stability during high-volume lookups.

• Minimum Metadata Retrieval Cache Period Set for NuGet Remote Repositories Pointing to chocolatey.org

  A four hour minimum has been set as the minimum metadata retrieval cache period for NuGet remote repositories that point to chocolatey.org.

• Scoped Token Authentication for AI Editor Extensions Repositories

  Artifactory Set Me Up now generates a scoped reference token for connecting your IDE to an AI Editor Extensions remote repository. You can copy a serviceUrl snippet from Set Me Up with the token embedded for manual configuration.

• Cargo Registries: Unauthenticated config.json Returns 401 Error When Anonymous Access is Off

  For Cargo repositories with Anonymous Access disabled, Artifactory now returns HTTP 401 for unauthenticated requests to the registry config.json, so the Cargo client can follow the RFC 3139 flow and retry with credentials instead of receiving a 200 without logging in. Repositories that allow Anonymous Access are unchanged and still serve config.json without authentication.

• End of Support for Cargo Git Indexing

  As previously announced in JFrog's Deprecations in Process, Cargo Git Indexing is no longer supported. Artifactory now uses the Sparse Index Protocol for Cargo repositories.

• Improved npm Indexing Performance

  Indexing for npm has been enhanced, after identifying and improving inefficient per-artifact property retrieval during metadata generation.

• Added Negative Caching for PyPI Local Repositories

  A negative cache has been added for PyPI simple-index lookups on local repositories. Repeated requests for non-existent package indexes now skip the database query, significantly reducing database load under high miss traffic.

• PyPI Curation Performance Improvements

  PyPI Curation Service performance has been improved by implementing an internal caching mechanism for package index responses. This significantly reduces latency and improves build speeds for curated PyPI repositories.

• Support for Cryptographic Signing for Nix Repositories

  Nix repositories in Artifactory now support cryptographic signing with Ed25519 keys. When you add a signing key to your Nix repository, packages in your private binary cache are signed so Nix clients can verify they came from Artifactory and weren't tampered with. For more information, see Configure Cryptographic Signing for Nix Binary Caches.

• Xet Support for Local and Virtual Repositories

  Xet support in Hugging Face repositories has been expanded to include local and virtual repositories. The Enable xet protocol option in Packages Settings now enables Xet for all local, virtual, and remote Hugging Face repositories in the organization.

  For more information, see Enable Xet Protocol for Hugging Face Repositories.

  📘

  Note

  If you enabled Xet for remote repositories prior to this update, Xet is automatically enabled for all local and virtual repositories that use the new Machine Learning layout.

• Ubuntu amd64v3 Architecture Support Added for Debian Repositories

  Added support for Ubuntu amd64v3 architecture variant during the calculation of the coordinates flow for Debian remote repositories, ensuring accurate indexing and caching.

• Xet Protocol Alignment for Hugging Face Remote Repositories

  Remote Hugging Face repositories have been updated to align with Hugging Face Xet protocol changes for xorb chunk retrieval. When servicing Xet download requests, Artifactory now searches the repository for existing xorb data before fetching from the upstream registry, reducing redundant upstream traffic and improving download efficiency when the same xorb is referenced across multiple model revisions.

  For more information, see Enable Xet Protocol for Hugging Face Repositories.

• Support for Tuist Swift Remote Repositories

  Artifactory now supports Swift remote repositories that connect directly to the Tuist public registry. This enhancement allows you to proxy and cache Tuist registry packages alongside your existing Swift dependencies, improving build reliability and speeding up dependency resolution. For more information, see Swift Repositories.

Access

• Increased Access Control for Anonymous Users

  The JFrog Platform now allows selecting specific granular actions that non-admin users with manage permissions can assign to anonymous users in permission targets in the UI, to enhance security and prevent unauthorized privilege escalation. For more information, see Allow Anonymous Access.

• Enhanced Visibility Controls for OIDC Identity Mappings

  To strengthen security and improve organizational compliance, you can now restrict project admins from viewing global OIDC identity mappings. Project Administrators will now only view the identity mappings that are directly applicable to their specific, assigned projects. For more information, see OIDC Settings.

• Nested JSON Claims Support in OIDC Integrations

  The JFrog Platform now supports mapping nested JSON claims directly within your OIDC identity mappings. This enhancement simplifies your authentication configuration by allowing you to map multiple levels of nesting (for example, custom_claims.department.group) without needing to flatten the claims manually. For more information, see Nested JSON Claims.

Release Lifecycle Management

• Enhanced Evidence Table

  The evidence table for Release Bundle v2 versions now includes evidence associated with the artifacts contained by the Release Bundle, in addition to the evidence associated with the Release Bundle itself. For more information, see View the Release Bundle Version Evidence Table.

• Support for Evidence in Remote Repositories

  You can now attach evidence to artifacts in remote repositories. For more information about evidence, see Evidence Management.

• Conflict Resolution during Release Bundle v2 Creation

  A new query parameter, conflict_resolution, has been added to the REST APIs for creating and updating Release Bundle v2 versions. Use this query parameter to resolve collisions between source artifacts with the same checksum. Two options are available:

  • automatic (default): Resolves collisions using the most recent artifact (taking its properties and evidence).
  • manual: Generates an error when a collision is detected. If fail_fast=true (default), the error occurs immediately. If fail_fast=false, the error is generated only after all collisions are detected. This was the general system behavior before conflict_resolution was introduced.

Retention

• Flexible Retention Policies with Combined Conditions

  You can now apply Time, Property, and Version criteria within a single policy, enabling precise management of your storage lifecycle. This means you can target outdated packages while ensuring the latest versions are always retained, minimizing data loss risk. For more information, see Cleanup Policies and Smart Archiving.

• Retention Policy Support for Agent Plugins

  Cleanup and Smart Archiving policies now support Agent Plugins packages.

• Release Bundle v2 Cleanup Policies for Enterprise X and Enterprise+ Users

  Enterprise X and Enterprise+ users can now run cleanup policies that remove eligible Release Bundle v2 versions.

• Cleanup Policies Performance Improvements for Conan Repositories

  Cleanup policy performance has been improved to handle duplicate Conan packages without stopping the cleanup run. Duplicate Conan packages are now handled properly so cleanup runs can complete successfully. This enhancement improves reliability for cleanup policies that run on Conan repositories.

• Detailed Messages for Skipped Packages in Smart Archive Run Reports

  Archive run reports now provide descriptive messages that explain why a particular package was skipped, as described below. The following messages have been added:

  Scenario	Report Message
  Package modified since last archive (checksum mismatch, artifact count change, and so on)	Package at source modified since last archive
  Package was previously restored from cold storage	Package was restored at 2026-04-28 10:30:00 +0000

  These new messages enable operators who review archive run reports to understand immediately why a package was skipped without digging through Artifactory logs. In addition, the message for restored packages includes the exact UTC timestamp of the restore, making it easier to correlate them with restore operations.

• Define Stages in Retention Policies

  You can now limit the scope of Retention policies (Cleanup policies for packages and Smart Archiving policies) to specific lifecycle stages. For example, you can define a Cleanup policy that removes all Docker images more than 2 weeks old from the DEV stage only. Docker images at other stages, such as QA, would be left undisturbed. This new capability makes it possible to tailor your Retention policies to the requirements of each phase of your software development lifecycle.

• Define Path Patterns in Retention Policies

  You can now refine the scope of package cleanup policies and Smart Archive policies by optionally defining one or more path patterns (as an addition to the mandatory repository patterns). The use of a wildcard at the beginning or end of each path pattern is supported.

Storage

• Option to Disable the CRT AWS SDK v2 Client

  An option has been added to disable the CRT AWS SDK v2 client and use the AWS S3 Async Netty client by setting <s3UploadStrategy>ASYNC</s3UploadStrategy> in binarystore.xml. For more information, see Amazon S3 Template Parameters.

• AWS SDK v2 Supports Single-Request Copy

  AWS SDK v2 now supports a single-request copy inside a bucket by setting the flag <useSyncClientForCopy>TRUE</useSyncClientForCopy>. For more information, see Amazon S3 Template Parameters.

General

• Option Added to UI to Change Block Download Behavior When Curation is Unavailable

  You can now configure Block Download behavior to allow downloading artifacts from remote repositories even when Curation is unavailable.

• Xray Configuration Synchronization for Federated Repositories

  When adding a new member to an existing Federated repository, Artifactory now synchronizes Xray configuration from the source repository to the new member, including Enable Indexing in Xray. Changes to Xray settings on existing members are not synchronized. For more information, see Xray Configuration Synchronization.

• User Context in Webhook Event Payloads

  Webhook event payloads for artifact-related events now include a user_context field that identifies the user or access token that triggered the event. For more information, see Webhook Event Types.

• CPU Overhead Performance Improvement

  CPU overhead was reduced for large AQL search queries. Complexity was reduced from O(N²×M) to O(N×M).

• High CPU Spikes Eliminated

  A per-request regex recompilation that caused CPU spikes during request bursts was eliminated.

• Improved Temporary Memory Allocation

  Optimizations were made in temporary memory allocation in the download flow.

• New Worker events: Artifactory Repositories

  JFrog Workers now supports setting Artifactory repository events to trigger workers, allowing automation of repository management, such as enforcing naming convention. For more information, see Worker Event Types.

• OneModel GraphQL engine

  The OneModel Apollo Router engine was replaced by Cosmo Router, providing improved performance and OS compatibility.

• Artifactory Access APIs Deprecation

  Artifactory User, Groups, Token, and Permissions management REST APIs are being deprecated and replaced with Access REST APIs, which might require changes to your automations. The deprecation date will be announced in JFrog release notes. For more information, see Deprecated JFrog APIs.

CVEs Addressed

Resolved Issues

This section includes all the Artifactory 7.146 releases.

Released: 25 August 2026

CVEs Addressed

Resolved Issues

Released: 12 August 2026

New Features

• Package Traffic Controller (PTC)

  Package Traffic Controller (PTC) is now generally available for Self-Hosted. PTC intercepts public package traffic via your security edge (SASE)—Zscaler ZIA, Netskope, or Cloudflare Gateway—and redirects it through Artifactory Package Reroute, so JFrog Curation and audit apply without changing developer workflows. For more information, see Package Traffic Controller (PTC).

• Improved Azure Blob Storage Access Reliability
  Artifactory has improved Azure Blob Storage access reliability by introducing a configurable SAS start-time offset (sasStartTimeOffsetSeconds, default: 900 seconds) in binarystore.xml. This offset prevents intermittent 403 authorization errors caused by clock skew between Artifactory and Azure Blob Storage hosts. For more information, see Azure Blob Storage v2 Binary Provider.

• Bundled Nginx certificate auto-generation disabled by default

  Starting with version 7.161, automatic certificate generation for the Nginx bundled with the Artifactory Helm chart is disabled by default. Auto-generated certificates are meant strictly for non-production environments and pose security risks if used in production.

  • Providing Certificates: You must supply custom TLS certificates as a pre-created Kubernetes secret managed by the user prior to deployment when HTTPS is enabled.
  • Upgrades: Upgrades using existing auto-generated certificates will continue to work, but we strongly recommend migrating to user-managed custom secrets.
  • Non-Production Environments: To enable auto-generated certificates for non-production setups, you must explicitly set the `generateSelfSignedCert: true`. For more information, see Terminate TLS with Custom Certificate.

• Security Hardening for Docker and OCI Referrers API

  Due to a change that hardened the OCI Referrers API (GET /v2/ <name>/referrers/<reference>), the API now returns 403 Forbidden if the authenticated user does not have read permission on the subject image. 

  Users or automations that previously relied on retrieving referrers without read permission on the subject will now receive 403 Forbidden. Grant read permissions on the relevant repository path to restore access.

  This change affects local, virtual, remote, and smart remote repositories. For virtual repositories, referrers are aggregated only from member repositories that the user is permitted to read. Related to CVE-2026-66380.

CVEs Addressed

Resolved Issues

Released: 27 July 2026

📘

Security Notice

This version is designed to fix multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments due to the additional security risks it introduces.

📘

Breaking Change for Remote Terraform Repositories

Due to a breaking change whereby Artifactory hardened controls on external Terraform URLs, remote Terraform repositories may return External URL is not allowed errors. If this error appears for a credible URL, an administrator must enable external dependency rewrite for the URL in the remote repository settings. For more information, see Remote Terraform Repository.

CVEs Addressed

Released: 21 July 2026

📘

Note for Customers Using AWS S3 Storage

Customers using AWS S3 storage should be aware that, starting from this release, AWS SDK v2 strictly enforcesGetObjectVersion permission.

CVEs Addressed

Feature Enhancements

• KMS Client-Side Encryption Compatible with AWS SDK v2 Storage

  You can now use KMS client-side encryption with AWS SDK v2 storage (resolved known issue RTDEV-86625). The parameter kmsCryptoMode is not used in AWS SDK v2.

Resolved Issues

Released: 16 July 2026

📘

This patch includes security bug fixes. Customers with Self-Managed deployments are strongly recommended to upgrade to the latest patch for this version.

CVEs Addressed

Resolved Issues

Released: 15 July 2026

📘

Security Notice

This version is designed to fix multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments due to the additional security risks it introduces.

CVEs Addressed

Resolved Issues

Released: 8 July 2026

Feature Enhancements

• Configurable Allow Lists for Import, Export, and Backup Path Validations

  The path validations for import, export, and backup in Artifactory can now be configured to have allow lists, so that import, export, and backup operations are restricted to only explicitly permitted directories. Each operation has its own allow list, so there are 3 separate allow lists. Although these allow lists are not mandatory, JFrog recommends using them for additional security. The allowlist can be configured either with artifactory.system.properties or with system.yaml (system.yaml takes precedence).

  • Configure with artifactory.system.properties as follows:

    artifactory.import.allowed.paths=/tmp/art-import/,/mnt/imports/
    artifactory.export.allowed.paths=/tmp/art-export/
    artifactory.backup.allowed.paths=/mnt/backups/

  • Configure with system.yaml as follows:

    artifactory:
        security:
            import:
                allowedPaths: /tmp/art-import/,/mnt/imports/
            export:
                allowedPaths: /tmp/art-export/
            backup:
                allowedPaths: /mnt/backups/

Resolved Issues

Released: 29 June 2026

📘

Forced Use of AWS SDK v1 with KMS Client-Side Encryption

As of this version, customers using AWS S3 storage with KMS client-side encryption can only use AWS SDK v1. Use of AWS SDK v2 with KMS client-side encryption is not possible and customers will be automatically switched to AWS SDK v1.

Feature Enhancements

• PyPI JSON Version Processing Enhancement

  PyPI JSON version processing has been optimized to reduce complexity.

• Cache Revalidation for Debian Component Files in Remote Repositories

  Debian remote repositories now support automatic cache revalidation for Components-{arch}.yml files in the dep11 directory. This enhancement ensures that these specific component files stay synchronized with upstream repositories, preventing stale data and hash mismatch errors for clients.

Resolved Issues

Released: 10 June 2026

⚠️

Important Notice for Customers Using AWS SDK Storage with KMS Client-Side Encryption

Customers using AWS SDK storage with KMS client-side encryption should not use AWS SDK v2. If you are using AWS SDK storage with KMS client-side encryption, ensure that in the binarystore.xml file awsSdkV2 is set it to false. For more information, see Amazon S3 Template Parameters.

📘

Improved federation flow (metadata negotiation removed)

The standalone Artifactory Federation Service (RTFS) improves the federation flow by decoupling from metadata negotiation to reduce protocol overhead and simplify the connection handshake. The negotiation code is no longer part of RTFS and federation operates as expected without that step.

Repositories that were marked DISABLED_BY_SYSTEM under legacy Federation because of failed metadata negotiation may retain that database state after migration. This is not an RTFS negotiation failure. Full Sync is unlikely to resolve it. Contact JFrog Support for guidance.

For more information, see Disabled-by-System Repositories and Metadata Negotiation in Federated Repositories.

Feature Enhancements

• Upgrade to Apache Tomcat 11.0.22

  The Apache Tomcat version bundled with Artifactory has been upgraded to version 11.0.22.

• Support for Opting Out of New SAML Login Redirect Behavior

  The JFrog Platform now supports reverting to the previous implementation of SAML login redirect, whereas upon automatic logout, users will be redirected to the SAML login URL. For more information, see SAML SSO.

• Federation

  • Configurable Payload Size for RTFS Communication with Access

    You can now configure how much data the Artifactory Federation Service (RTFS) can receive from the JFrog Access service. Increasing this limit helps prevent federation failures when Access returns large configuration responses, for example, in environments with many Federated repositories. For more information, see Configure RTFS Properties in system.yaml in Federated Repositories.

  • Federation Configuration Setting Applies to All RTFS Communication with Access

    A federation configuration setting that controls how much data RTFS can receive from Access now applies to all RTFS communication paths with Access, not only a single path. For more information, see Configure RTFS Properties in system.yaml in Federated Repositories.

Resolved Issues

Released: 26 May 2026

Feature Enhancements

• Retry Mechanism for AWS SDK v2 Client HTTP Requests

  A retry mechanism has been added for AWS SDK v2 client HTTP requests.

• Reference Attributes Added to Composer’s dist Metadata for Local Repositories

  Artifactory now supports reference attributes in Composer’s dist metadata for local repositories. This is useful for identifying dev composer packages and resolving caching issues with clients.

Resolved Issues

Released: 20 May 2026

Feature Enhancements

• Improved Performance for NuGet Repository Database Queries

  For customers experiencing lock contentions due to heavy_query_cache, it is recommended to set the property artifactory.db.lock.native.pool.size = 10. Contentions are seen only when the workload is significantly high. The default size of the pool is 5.

  The following is a typical example as seen in the logs when there is a database contention:

  Timed out while trying to acquire lock: hqc:nuget_hqc_ ... Couldn't acquire lock for: 120000 milliseconds and locked by: ...

Resolved Issues

Released: 14 May 2026

Resolved Issues

Released: 5 May 2026

Resolved Issues

Released: 28 April 2026

📘

This patch includes security bug fixes. Customers with Self-Managed deployments are strongly recommended to upgrade to the latest patch for this version.

CVEs Addressed

Released: 16 April 2026

📘

AWS SDK v2 is now the default AWS SDK

Following the update in Artifactory 7.133.3, JFrog Artifactory has officially transitioned its default AWS SDK from v1 to v2 as of this release. If you are setting up new S3 storage integrations or relying on the default configuration, Artifactory will now natively use SDK v2.

Why We Made This Change

Amazon Web Services ended support for SDK v1 at the end of 2025. By making v2 the default, JFrog is ensuring that your Artifactory environments are positioned for long-term stability and are protected against the risks of using deprecated software. AWS SDK v2 has the following advantages:

• Security & Compliance: Eliminates the security risks associated with running end-of-life software that no longer receives security patches.
• Performance & Feature Parity: Unlocks the ability to leverage the latest AWS optimizations, availability improvements, and new features for a more robust storage solution.

This support for AWS SDK v2 and its configuration is added in Artifactory Helm Charts 107.146.x.

For more information, see Integrate Artifactory with AWS SDK v2 for S3 Storage and Fine-Tuning AWS SDK v2 with Artifactory.

Important: Customers using AWS SDK storage with KMS client-side encryption should not use AWS SDK v2. If you are using AWS SDK storage with KMS client-side encryption, ensure that in in the binarystore.xml file awsSdkV2 is set it to false. For more information, see Amazon S3 Template Parameters.

⚠️

Deprecation of the Security Configuration Descriptor (XML export/import via REST API and UI)

The Security Configuration Descriptor, which allows exporting and importing Artifactory's security configuration as raw XML, will be deprecated as of July 1, 2026. This deprecation includes the REST API endpoints GET/POST /api/system/security and the Security Descriptor page in the Administration module (Administration > Artifactory Settings > Security Descriptor). Deprecation has been noted on the relevant documentation pages. Security configuration should be managed through the dedicated REST APIs and the Administration UI.

What you need to do : Migrate any automation that uses GET/POST /api/system/security to the dedicated Security REST APIs. If you use the Security Descriptor UI page for manual configuration review, use the standard security administration pages instead (Administration > Security). For bootstrap scenarios, use the Access Configuration Bootstrap YAML.

🚧

Member Node Deprecation in Artifactory High Availability (HA) Helm Chart

To streamline High Availability (HA) deployments and finalize the transition to a fully masterless architecture , we have officially removed the "Member Node" configuration from the Artifactory HA Helm chart (v7.146.x and later).

What has changed:

• Previously, while Artifactory HA charts defaulted to 3 replicas (3 Primary, 0 Members), legacy code for "Member Nodes" remained for backward compatibility.
• Starting with version 7.146.7, this legacy code has been completely removed. Artifactory now treats all nodes as equals, simplifying scaling and cluster management.

Action Required: Mandatory Configuration Update

If your current values.yaml contains an artifactory.node block, your upgrade will fail with the following validation error:

'artifactory.node' is no longer supported. Member nodes have been removed from this chart. Please remove the 'artifactory.node' block from your values and use 'artifactory.primary.replicaCount' to scale instead.

Steps to Resolve:

• Remove the Block: Delete the entire artifactory.node section from your values.yaml.
• Scale via Primary: To define the number of nodes in your cluster, use the artifactory.primary.replicaCount parameter instead.

🚧

Frontend Microservice Pod Separation

To enhance system resilience and better align with modern cloud-native standards, Artifactory v7.146.7 introduces the ability to decouple the Frontend microservice into its own dedicated pod.

**What’s New: **frontend.asPod

Previously, the Frontend service shared resources and lifecycles within the main Artifactory pod. You can now isolate this service by toggling a new flag in your configuration.

• Parameter: frontend.asPod
• Default Value: false (Frontend remains within the Artifactory pod)
• For Standalone: Set to true (Frontend deploys as a standalone pod)

New Features

• Support for Nix package type

  You can now use Nix repositories in Artifactory as a high-performance binary cache to ensure fast, reliable, and reproducible builds. This integration allows you to proxy and cache NixOS Search , while also providing a secure platform to host and publish custom internal channels.

  Artifactory enhances the Nix ecosystem by providing unified access through virtual repositories, and global distribution via federated repositories to synchronize artifacts across locations. Artifactory also provides native metadata calculation to logically group related artifacts, improving discoverability and artifact management without compromising Nix's core content-addressed reproducibility. For more information, see Nix Repositories.

• Skills local repositories

  Skills repositories are now available in Artifactory as an open beta. You can use Skills repositories as a private skill registry for AI agent capabilities, allowing you to publish, discover, and install skills from one controlled place. Skills repositories offer full integration with JFrog CLI (jf skills) v2.98.0 or newer, and a ClawHub v1–compatible REST API for seamless and secure publish and resolve flows.

  For Artifactory instances with JFrog AI Catalog, you can optionally enable semantic scanning to help catch malicious skills before distribution, adding a supply-chain gate to your AI skill lifecycle. A batch deletion feature deletes blocked skills every 30 minutes.

  For more information, see Skills Repositories.

• NuGet Enforce Layout

  This version of Artifactory introduces NuGet Enforce Layout. By enabling NuGet Enforce Layout, you will avoid package duplication and bring Artifactory closer in alignment with the nuget.org registry.

  NuGet Enforce Layout has three main uses:

  • It allows access to the PackageBaseAddress service, which speeds up NuGet restore operations.
  • It normalizes the names of the packages that you deploy based on SemVer, according to the NuGet Normalized Version Numbers convention, supported in NuGet versions 3.4 and above.
  • It prevents the upload of duplicate versions or several package versions that are identical according to the Normalized Version Numbers rules.

  For more information, see NuGet Enforce Layout.

📘

Note

NuGet Enforce Layout is available only if your Artifactory version has the NuGet Package Handler activated.

• API for returning all Release Bundle v2 cleanup policies

  A new REST API returns a list of all existing Release Bundle v2 cleanup policies for either a specific project or for the entire system. For more information, see Get All Cleanup Bundle Policies API.

• Add Platform Auditor role in REST API The JFrog Platform now supports assigning users the Platform Auditor role via the user management REST API endpoints. For more information, see Create User, Update User, and Get User Details.

Feature Enhancements

Projects

• Added support for project admin permissions The JFrog Platform now supports more granular control over project admin permissions, allowing you to grant project admins Manage Resources permissions, but prevent them from creating or managing remote repositories.

Builds

• Build content displayed in platform UI

  The platform UI now contains a Content tab that provides a list of all the packages and standalone artifacts (known collectively as releasables) included in the build. For more information, see View Build Number Information.

• Improved build module performance in platform UI To enhance the user experience, the time required to display build modules in the platform UI was significantly decreased. This improvement is most noticeable when loading large builds in the UI.

Authentication

• Webhook management scoped tokens

  The JFrog Platform now supports creating scoped tokens, allowing access to manage Webhooks endpoints. For more information, see Create Scoped Token.

• Added a warning message when deleting a SCIM token

  The JFrog Platform now displays a warning message when attempting to delete a SCIM token, as deletion might disconnect authentication provider integrations.

• Support for Setting Maximum Token Expiration Value

  The JFrog Platform now supports setting a maximum value for token expiration in the UI, enabling self-service management and increased platform security.

User management

• Support for Webhook Creation role The JFrog Platform now supports a role that allows users who are not platform administrators to create and manage Webhooks. For more information, see Create and Edit Users.

Database

• AQL limit applied to the Artifactory server to protect the database server from overload

  An AQL limit has been applied to the Artifactory Server to protect the Database Server from overload caused by excessive AQL search requests issued by end-users. The AQL limit includes concurrency limits at both global and per-user levels. This ensures that the database server has enough remaining capacity to serve other critical activities, such as upload and download.

Packages

• Improved Helm metadata processing

  Helm metadata processing has been improved by eliminating redundant version comparison during repository indexing. This optimization reduces CPU overhead during index.yaml generation and virtual repository rewrites, significantly improving performance and scalability for repositories with a large number of chart versions.

• Improved Pub error handling and status codes

  For Pub clients older than version 2.15.0, error handling and status codes have been changed to align with proper authorization behavior. When a user without write permissions tries to download a package from a remote, virtual, or smart remote repository, Artifactory will now return HTTP 403 (Forbidden) instead of 404.

• Enhanced UI Support for DNF Client in RPM Packages

  This release adds the DNF client option to RPM Set Me Up instructions. While Artifactory has long supported both YUM and DNF clients, the Set Me Up instructions previously only displayed YUM option. Artifactory is prioritizing the DNF client to align with modern RPM-based distributions where DNF is the default package manager.

• npm metadata protection

  To avoid potential metadata corruption, Artifactory now blocks writing to the .npm directory during copy or move operations to paths in that directory. This limitation prevents source metadata from overwriting the destination's system-generated files, ensuring your npm packages remain correctly indexed after the move.

• npm attestation support

  This version of Artifactory introduces support for native npm provenance and attestations in remote and virtual repositories. When running npm audit signatures, the output now includes signatures and attestations for supported packages. This enhancement allows you to retrieve build-source metadata directly from upstream registries and ensure package authenticity. For more information, see Use npm Audit.

• Support for JSON indexing with PyPI Simple JSON API

  Artifactory now supports the PyPI Simple JSON API to provide a modernized alternative to traditional HTML-based package metadata. This opt-in feature enables JSON indexing for PyPI repositories via the Accept header, allowing for faster and more efficient dependency resolution by modern Python package managers. For more information, see Enable JSON Indexing in PyPI Repositories.

• Updated POM validation log level

  Log entries for POM deployment path mismatches have been updated from Error to Warning to better reflect that these issues typically are not caused by system failure. This change reduces noise in monitoring tools while still reporting incorrect POM metadata.

• Improved Maven indexing performance

  Artifactory performance has been improved by optimizing database indexes for Postgres DB. By reducing the database load during file upload and deletion operations, this change ensures better system stability and faster response times for Maven repositories.

• Improved re-indexing process for Opkg repositories

  The re-indexing process for Opkg repositories has been improved such that a full re-index is no longer required when adding or deleting packages to or from an Opkg repository. Only the affected package entries are added to or removed from the Opkg index file when adding or deleting a package.

Repositories

• Support for Red Hat Ansible Automation Hub

  Ansible remote repositories now support proxying Red Hat Ansible Automation Hub. This enhancement lets you cache and serve certified and validated Ansible content collections from Automation Hub through Artifactory, while applying your own access controls and governance policies. For more information about this capability, see Proxying Red Hat Ansible Automation Hub.

• PyPI Curation Performance Improvements

  PyPI Curation Service performance has been improved by implementing an internal caching mechanism for package index responses. This significantly reduces latency and improves build speeds for curated PyPI repositories.

• Support added for Custom HTTP headers in remote repositories

  Custom HTTP headers can now be configured for all remote repositories directly through Artifactory, without requiring external proxy workarounds. For more information, see Remote Repository JSON Configuration and Repositories Configurations in Artifactory YAML.

• Support for Smart Remote Repositories over JFrog Bridge Connections

  Smart remote repositories are now fully supported over JFrog Bridge connections in hybrid environments. Smart remote repository detection occurs when the upstream repository is accessed via a bridge connection, and properties are properly synced when downloading artifacts through a Smart Remote repository over a bridge.

• Xet protocol in remote Hugging Face repositories

  Remote Hugging Face repositories now support Xet protocol, providing enhanced download performance and handling files larger than 50 GB. Xet is supported for repositories that use the new Machine Learning layout. Migrate legacy Hugging Face repositories to the new layout to use Xet. For more information, see Enable Xet Protocol for Hugging Face Repositories.

• Enhanced Hugging Face compatibility for Xet 1.3.0+ clients

  Added support for the /v1/ CAS API path prefix to ensure compatibility with hf_xet client version 1.3.0 and later. This update enables successful file reconstruction and xorb chunk retrieval by correctly processing versioned endpoint paths.

• Strict tag overwrite enforcement configuration

  Docker, OCI, and Helm OCI repositories now have an Enforce Strict Tag Overwrite configuration setting. When enabled, this configuration requires explicit Delete/Overwrite permissions when pushing images with an existing name and tag. This enforcement prevents multiple manifest types under the same tag, maintaining stricter registry integrity.

• AQL search results now respect repository include and exclude patterns

  AQL search results now respect repository include and exclude patterns for local, remote, and virtual repositories. Items that do not match a repository's patterns are filtered out for non-admin users, so AQL results align with repository access rules and other search methods. For more information, see Artifactory Query Language.

Release Lifecycle Management

• Draft Release Bundle v2 versions

  You can now use the Create Release Bundle v2 Version REST API to create an unlocked, mutable draft. Use the new Update Draft Release Bundle v2 Content REST API to add sources—such as artifacts, packages, builds, or bundles—as needed. When the draft is final, use the new Finalize Draft Release Bundle v2 Version REST API to lock the bundle and make it immutable. Please note that Evidence cannot be added to a draft Release Bundle version until it is finalized. For more information about draft versions, including other limitations, see Create a Draft Release Bundle v2 Version.

• Artifactory Edge APIs now support Release Bundle v2

  The following REST APIs, which were developed for Release Bundle v1, can now be used to retrieve information about Release Bundle v2 (RBv2) versions as well:

  • GET /api/release/bundles?type=target
  • GET /api/release/bundles/{name}?type=target
  • GET /api/release/bundles/{name}/{version}?type=target&format={format}
  • GET /api/release/bundles/{name}/{version}/status?type=target
  • GET /api/release/bundles/{name}/{version}/artifacts
  • DELETE /api/release/bundles/{name}/{version}

  This feature enhancement is intended for users who have existing CI/CD processes that include calls to these endpoints and who now require RBv2 support. Users who do not already use these endpoints should use the standard RBv2 endpoints, as described in the Release Lifecycle Management API reference.

• Performance improvements when exporting Release Bundle v2 versions

  We are excited to announce significant performance improvements to the export Release Bundle v2 feature. This enhancement provides a more efficient and streamlined experience for users in both self-hosted and SaaS environments. Key improvements include:

  • Faster processing times: Reduced export times for Release Bundles, allowing for quicker access to essential data.
  • Optimized resource usage: More efficient utilization of system resources during the export process, leading to enhanced overall performance.
  • Scalability enhancements: Improved handling of larger datasets, ensuring consistent performance with support for big bundles, allowing users to export extensive Release Bundles without performance degradation.

• Platform UI searches support Release Bundles v2

  The global search bar at the top of the platform UI now includes support for Release Bundles v2. A toggle switch makes it easy to choose between searching for Release Bundles v1 and Release Bundles v2 (v2 is the default). This enhancement makes it easy to find any Release Bundle quickly without first navigating to a specific window in the application. For more information, see Release Bundles Search.

• Improved performance of Release Bundles v2 page

  To improve the user experience, the platform UI page for Release Bundles v2 has been optimized, especially when displaying a long list of Release Bundles.

• Evidence attachments

  You can now attach a single, unstructured file — such as a PDF — during the evidence creation process. This feature provides a tamper-proof, signed container for both your structured evidence and unstructured data, ensuring a complete end-to-end audit trail. For more information, see Add an Attachment to Evidence.

• Evidence distribution for Release Bundle v2 versions

  JFrog Distribution and Artifactory now support the optional distribution of evidence attached to Release Bundle v2 versions (including package and artifact evidence), allowing security and compliance metadata to be delivered directly to Edge nodes. This ensures that every artifact reaches its destination with a complete, verifiable record of its quality and security posture. This feature completes the "chain of trust" by enabling the relevant users at the Edge to verify signatures, test reports, and compliance data before consumption.

  ❗️

  Important

  The ability to distribute evidence requires the enhanced distribution engine (introduced in JFrog Distribution release 2.28.1). You must also enable the configuration parameter evidence-distribution-enable.

Retention

• Define path patterns in Retention policies

  You can now refine the scope of package cleanup policies and Smart Archive policies by optionally defining one or more path patterns (as an addition to the mandatory repository patterns). The use of a wildcard at the beginning or end of each path pattern is supported.

• Cleanup policies available for Enterprise X subscriptions

  JFrog cleanup policies are now available to users with an Enterprise X subscription, in addition to those with Enterprise +. Cleanup removes unnecessary files, applications, and configurations to free up storage and improve system performance.

• Cleanup policies can skip promoted artifacts

  Package cleanup policies can now skip artifacts that are part of a promoted Release Bundle v2. Such cases are now treated as a warning instead of an error, which enables the cleanup of other packages to proceed smoothly. For more information, see Work with Cleanup.

General

• Additions to the Artifactory Request Log and Outbound Request Log

  The Artifactory Request Log (JSON only) and Outbound Request Log (JSON only) have been extended with two new fields that significantly simplify the analysis of traffic patterns:

  • repo: The name of the repository as it appears in the URL
  • repo_type: The type of the repository (one character). Will be one of the following:
    • v: virtual
    • l: local (also for federated)
    • r: remote

Resolved Issues

This section includes all the Artifactory 7.133 releases.

📘

Critical Security Notice

All subversions are vulnerable to multiple non-critical security vulnerabilities that, in some deployments, can be chained into critical-severity attacks. We recommend that all customers upgrade to the latest version. View the latest Self-Managed and SaaS releases.

⚠️

Important Notice for Customers Using RTFS (Artifactory Federation Service)

A critical issue affects RTFS on all Artifactory 7.133 versions higher than 7.133.12. Customers may see a Federation service is unable to connect banner even when RTFS is healthy. Upgrade to 7.146.0 or later (7.146.x, 7.147.x) for a permanent fix. Until then, restart Artifactory pods that log ALERT: RTFS is enabled ... but the federation service queue does not exist.

This issue affects RTFS only. Legacy federation is not affected.

For more information, see Troubleshoot RTFS connection banner on Artifactory 7.133.x in Federated Repositories.

Released: 12 August 2026

CVEs Addressed

Released: 27 July 2026

📘

Security Notice

This version is designed to fix multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments due to the additional security risks it introduces.

Released: 16 July 2026

Resolved Issues

Released: 15 July 2026

Resolved Issues

Released: 29 June 2026

⚠️

Important Notice for Customers Using AWS SDK Storage with KMS Client-Side Encryption

Customers using AWS SDK storage with KMS client-side encryption should not use AWS SDK v2. If you are using AWS SDK storage with KMS client-side encryption, ensure that in the binarystore.xml file awsSdkV2 is set it to false. For more information, see Amazon S3 Template Parameters.

Resolved Issues

Released: 10 June 2026

Feature Enhancements

• Support for Opting Out of New SAML Login Redirect Behavior

  The JFrog Platform now supports reverting to the previous implementation of SAML login redirect, whereas upon automatic logout, users will be redirected to the SAML login URL. For more information, see SAML SSO.

Released: 28 April 2026

📘

This patch includes security bug fixes. Customers with Self-Managed deployments are strongly recommended to upgrade to the latest patch for this version.

Feature Enhancements

• Improved npm Indexing Performance

Indexing for npm has been enhanced, after identifying and improving inefficient per-artifact property retrieval during metadata generation.

CVEs Addressed

Released: 15 April 2026

Resolved Issues

Released: 1 April 2026

This is a maintenance release with no features or enhancements. CVEs that don't impact Artifactory have been fixed.

Released: 31 March 2026

Resolved Issues

Released: 18 March 2026

Feature Enhancements

• Improved AWS SDK v2 CRT Client-Handling of Slow Connections

  AWS SDK v2 CRT client-handling of slow connections has been improved by exposing the connection health timeout configuration. For more information, see Amazon S3 Template Parameters.

Resolved Issues

Released: 2 March 2026

Resolved Issues

Released: 18 February 2026

Resolved Issues

Released: 10 February 2026

🚧

Intended Change in Artifactory’s Response to Improper Configuration of a Smart Remote Repository

To properly configure a smart remote repository using the Create Repository API, the URL of an Artifactory instance must be used as the URL of the remote repository, and the attribute contentSynchronisation must have enabled = true in the Repository Configuration JSON. Currently, if a user wants to create a smart remote repository and enables contentSynchronisation, but does not set the URL of an Artifactory instance as the URL of the remote repository, Artifactory responds by creating a regular (not smart) remote repository, sends a 200 success message, and disables contentSynchronisation. The user does not receive any indication that the smart remote repository that the user tried to create is actually a regular remote repository or that contentSynchronisation is disabled. Starting from May 12, 2026, Artifactory will respond differently to this scenario. Instead of creating a regular remote repository, Artifactory will respond with a 400 error message, and no repository will be created.

🚧

Artifactory to Stop Allowing Importing a Backup of Repositories with the -cache Suffix

Artifactory does not allow creating a repository with the -cache suffix, because -cache is a reserved string that Artifactory uses internally to create a -cache repository for every remote repository. However, currently Artifactory allows importing a backup of repositories even if there are repositories in that backup with a -cache suffix. Starting from May 12, 2026, Artifactory will no longer allow a backup of repositories if there are repositories in that backup containing the -cache suffix. Ensure that by May 12, 2026, you do not have any repositories with the -cache suffix to be backed up for the backup to run successfully.

Note that renaming existing repositories is not possible. Therefore, if you need to rename a repository because it has the -cache suffix, the most efficient way to do this is to create a new repository, copy the contents of the repository with the -cache suffix into it, then delete the old repository.

Resolved Issues

Released: 3 February 2026

Resolved Issues

Released: 22 January 2026

⚠️

Breaking Change for JFrog Platform Logging

From this Artifactory version, two system properties (​​audit:enabled​ and ​db:batch-size​​) will be moved from the ​Access YAML​ configuration file to the ​System YAML​​ configuration file, and their values will be reverted to the default value.

This should not impact your environments. However, note that if you have defined a different value for either of these variables or wish to edit them, you can now find and edit them in the ​system.yaml​ file, located in the ​$JFROG_HOME/artifactory/var/etc​​ folder.

More information about the parameters to be changed:

Parameter name in Access YAML (removed)	Parameter name in System YAML (added)	Description	Default value
Audit: enabled:	logging: audit: enabled:	Toggle logging of changes in Access configuration. It is highly recommended to keep this enabled.	true
db: batch-size:	database: batchSize:	Control the number of records in each batch when performing actions on Access resources.	100

❗️

Transition Default AWS SDK from v1 to v2 (Q2 Update)

In preparation for the sunset of AWS SDK v1 by Amazon Web Services, JFrog Artifactory will transition its default AWS SDK from v1 to v2 by June 30, 2026. This is a proactive step to ensure customers are positioned for long-term stability, security updates, and new features as v1 reached end-of-support at the end of 2025.

Why is JFrog making this change?

• End of Support for v1: Amazon Web Services announced that SDK v1 reached end-of-support at the end of 2025. After this date, v1 no longer receives new features, availability improvements, or security updates.
• Security and Compliance: Continuing to use v1 beyond 2025 exposes environments to potential security risks due to the lack of ongoing updates.
• Feature Parity and Optimization: Integration with v2 allows users to leverage the latest AWS features and optimizations for a more robust and efficient storage solution.

JFrog strongly recommends that all Artifactory customers currently using SDK v1 transition to SDK v2 at this point in time and not postpone this unnecessarily. For instructions on how to do this, see Integrate Artifactory with AWS SDK v2 for S3 Storage.

📘

Timeline for the Sunset of JFrog Legacy Repository Federation

We are officially announcing the sunset plan for Legacy Repository Federation as we transition to the next-generation Artifactory Federation Service (RTFS). Please take note of the following timeline for this change:

Timelines

January 2026 (Current Status)

Official declaration of the sunset plan to all customers.

Migration Window (Now through Mid-2027)

An 18-month period during which customers are requested to migrate to the new Artifactory Federation Service. We encourage all users to begin planning their transition to take advantage of RTFS's superior architecture and enhanced capabilities.

July 2027 (Deprecation)

The actual removal of Legacy Federation from the codebase of new releases.

Note: Older releases will continue to be supported based on JFrog standard support policies.

Important Information

Database Requirements

Please be aware that the new RTFS service explicitly requires a PostgreSQL database connection. However, this requirement applies only to the RTFS service itself; your main Artifactory installation remains completely unaffected and continues to support all currently available databases.

Implementation Options

• If your Artifactory already uses PostgreSQL, you can use the same database instance.
• If your Artifactory uses a different database, you only need to introduce a separate PostgreSQL instance for the RTFS service. There is no need to migrate your entire Artifactory installation.

Why This Change?

The Artifactory Federation Service (RTFS) represents the next generation of repository federation with:

• Superior standalone microservice architecture designed to reduce impact on Artifactory
• All new features (including Unidirectional Sync) are being developed exclusively for RTFS
• Already the default for all JFrog SaaS customers
• Validated by leading enterprise customers with improved stability and performance

Migration Support

The migration from Legacy Federation to RTFS is designed to be seamless:

• Automatic migration tools are provided to ensure configuration and data integrity
• No downtime required during migration
• Hybrid mode supported (RTFS and Legacy can coexist during transition)
• Full rollback capabilities during the transition window
• You do not need to migrate all sites simultaneously

Important

Please note the following regarding certificates:

• The Artifactory Federation Service (RTFS) supports self-signed certificates and certificates signed by a custom Certificate Authority (CA) starting from Artifactory version 7.133.4.
• Customers running earlier versions must upgrade to a supported version to use self-signed or custom CA certificates with RTFS.

Note: This sunset applies to Self-Hosted environments only.

For detailed information about RTFS features, migration procedures, and FAQs, please refer to the Artifactory Federation Service documentation.

📘

Filebeat Removal

Removed the Filebeat component from all JFrog product installers as part of the JFrog Insight deprecation process.

Action Required: If you utilize the bundled Filebeat application for purposes other than JFrog Insight, you must install a standalone version of Filebeat before upgrading to this version to prevent service disruption.

New Features

• Application metrics now available to SaaS Users

  Users working in SaaS (Cloud) environments can now receive a wide variety of application-related metrics (based on the Open Metrics standard) using a new REST API. For more information, see Get Artifactory Application Metrics API.

• New REST API for preparing evidence for deployment to Artifactory The new Prepare Evidence for Signing REST API simplifies the evidence creation process for users who do not use the JFrog CLI. The API request contains the predicate, which is a JSON containing claims about the defined evidence subject (for example, a build or artifact), and can include an optional markdown version. The API returns a payload that conforms to the in-toto attestation standard used by the JFrog platform. After signing the payload, you can deploy the evidence to the JFrog platform using the Deploy Evidence REST API. For more information, see Create Evidence using REST APIs.

Feature Enhancements

Release Lifecycle Management

• Release Bundle v2 creation dry run You can now use the Create Release Bundle v2 REST API to perform a dry run, which simulates the creation of the Release Bundle and performs all the necessary validations, but without persistence. For more information, see Perform a Release Bundle v2 Creation Dry Run.
• New REST API for deleting the tag from a Release Bundle v2 version To improve the user experience, you can use a new, dedicated REST API to delete a tag from a Release Bundle v2 version. For more information, see Delete Release Bundle v2 Version Tag API.
• Query parameter for returning all errors during Release Bundle v2 creation To help debug issues you may encounter during Release Bundle v2 creation, a new fail_fast query parameter has been added to the Create Release Bundle v2 REST API. When set to false, the API will return validation errors that occur during creation as a group instead of failing after the first error. For more information, see Release Bundle v2 Creation Errors Collected by System.
• RLM promotion rollback from platform UI To improve the user experience, you can now roll back a Release Bundle v2 version promotion from the platform UI. For more information, see Promotion Rollback. Please note that the UI icon for deleting a promotion has been removed, as rollback replaces this functionality.
• Audit trail maintained when promoting duplicate Release Bundle artifacts Previously during Release Bundle v2 promotions, the system skipped artifacts that already existed in the target stage. This behavior prevented the target stage from being updated with evidence associated with those artifacts. This enhancement guarantees that all associated evidence is copied to the target stage, ensuring a complete and verifiable audit trail throughout your SDLC.
• Improved performance when creating Release Bundles from builds with dependencies To enhance the user experience, we have implemented significant performance enhancements when creating Release Bundle v2 versions from builds that contain dependencies.

Platform UI

• Significantly Improved Package Details User Interface The Package Details user interface (UI) has been significantly improved, and now displays valuable information about package versions in a more user-friendly format, including:
  • When the Package Details view is initially displayed, details on the latest version or tag of the package appear.
  • Use of native terminology, based on the package context (for example, tags for Docker/OCI packages, versions for other package types).
  • Quick selection of a package version, allowing you to easily find the version you need.
  • An All Versions view, allowing quick impact analysis across all versions to see vulnerabilities and where versions are stored.
  • Multi-client install commands: Installation commands are provided for all officially supported clients in every package type.
  • More install commands for more package types: The new UI introduces 35 new install commands to help developers use the packages they are looking for.
  • Context-sensitive Information tabs, displaying important version information according to the package type. For more information, see The Package Details User Interface.
• Significant Improvements in the Repositories User Interface The Repositories user interface has been significantly re-designed, making it much more user-friendly and efficient. When initially opening the Repositories list, there are options to view the 20 most recently viewed repositories and to view inactive repositories. Filtering capability has been added, so that you can now filter the Repositories list according to Repository type, package type, URL (for remote repositories), Project association, stage, and repositories that have a replication (for local and remote repositories). For more information, see View Repositories.
• Date picker to improve Builds page performance To improve performance, the Builds page now features a date picker that displays only those builds within a defined timeframe. The default value is the last 7 days. Users can choose a different timeframe as needed.
• Improved performance of Build Versions page in platform UI Pagination has been added to the Build Versions page in the platform UI, which makes it faster and more convenient to use when the selected build contains many existing versions.
• User Management - Permissions Updated the tooltip for the Include All Builds checkbox to clarify that selecting this option includes all builds and preserves any defined exclude patterns. For more information, see Add Builds.
• Added a Warning Message When Deleting a SCIM Token The JFrog Platform now displays a warning message when attempting to delete a SCIM token, as deletion might disconnect authentication provider integrations.

Package Management and Repositories

• Support for .dsc Source packages in local Debian repositories Local Debian repositories now support Debian source packages. After configuring your sources.list file for source packages, you can deploy the component source package files one by one to your local repository and resolve them as a single package using apt-get source. For more information, see Connect Debian to Artifactory.

• Performance optimizations in NuGet package manager

  Artifactory now offers a newer implementation of the NuGet package manager in Self-Managed Artifactory deployments. The new implementation significantly improves performance and efficiency with the following benefits:

  • Improved package resolution speed and download efficiency
  • Resolved legacy memory-related issues
  • Reduced JVM heap memory usage To enable the new NuGet handler, add the following property to the Artifactory system properties file: artifactory.package.handler.nuget=true.

  The new handler is opt-in for Self-Managed Artifactory deployments at this time, but it will be the default NuGet handler for all customers in an upcoming release. The new handler is already implemented in SaaS versions of Artifactory.

  📘

  Note

  To ensure optimal performance, it is recommended Artifactory 7.125.0 or later before enabling this feature.

• New REST APIs for VCS Remote Repositories to Obtain Data from Subgroup Repositories New REST APIs have been added for VCS remote repositories to obtain data from subgroup repositories. Four new APIs have been added that allow you to:

  • Download a VCS Branch from a Subgroup Repository API

  • Download a VCS Tag from a Subgroup Repository API

  • Download a File in a VCS Branch in a Subgroup Repository API

  • Download a File in a VCS Tag in a Subgroup Repository API

    Also, the legacy APIs Get VCS Tags and Get VCS Branches can be used to obtain VCS tags and branches from subgroup repositories. Currently, branches and tags can be downloaded only in the tar.gz format. In this Artifactory version, these APIs can be used to obtain data from the Google Source Git Provider.

• Google Source Git Provider for VCS Remote Repositories Support has been added in the Artifactory user interface for the Google Source Git Provider for VCS remote repositories. For more information, see Use VCS to Proxy Git Providers.

• Improvements in VCS Remote Repositories APIs The user organization can now be used as the repository for downloading VCS tags, branches, files in a tag, and files in a branch. For more information, see Download a VCS Tag API, Download a VCS Branch API, Download File within a VCS Tag API, and Download File within a VCS Branch.

• Supported Clients and Versions

  • Support for Kiro with AI Editor Extension repositories You can now set up AI Editor Extension Repositories in Artifactory to securely proxy and cache the Kiro extension marketplace, and configure your Kiro IDE to download extensions from the Artifactory cache. For more information, see Get Started with AI Editor Extensions.
  • Support for pnpm client with npm repositories You can now configure the pnpm client to connect to npm repositories in Artifactory and use it to manage npm packages. For more information, see pnpm CLI.
  • Support for uv client with PyPI repositories You can now configure the uv client to connect to PyPI repositories in Artifactory and use it to manage Python packages. For more information, see uv client.
  • Support for Yarn Modern with npm repositories Artifactory now supports natively managing npm packages with Yarn V2+ (Modern). For more information, see Connect Yarn to Artifactory.

• JFrog CLI commands for setting up IDEs with AI Editor Extension and JetBrains Plugins repositories The new jf ide setup command automates the process of connecting your IDE to an AI Editor Extensions or JetBrains Plugins repository in Artifactory. You can run the single command to configure any supported client, instead of manually granting permissions and editing configuration files. For more information, see Connect IDE to Artifactory for AI Editor Extensions and Connect JetBrains IDE to Artifactory for JetBrains.

• Curation Support Added for PHP Composer Remote Repositories Artifactory now ensures security compliance for Composer repositories protected by JFrog Curation. If a package is blocked by security policy, Artifactory automatically prevents the Composer client from falling back to external source URLs to download.

• Added Support for the Range Header in Download Requests for PyPI Repositories Artifactory now supports Range requests when downloading Python packages from local, remote, and virtual PyPI repositories. This improves compatibility with the UV package manager and prevents redundant full-package downloads, reduces unnecessary download counts, and improves performance.

• Added Support for Proxying the GitHub Enterprise Cloud Private Registry for Go Remote Repositories Support has been added for proxying the GitHub Enterprise Cloud private registry (<comanyName>ghe.com) for Go remote repositories.

• Curation Support Added for PHP Composer Remote Repositories Artifactory now ensures security compliance for Composer repositories protected by JFrog Curation. If a package is blocked by security policy, Artifactory automatically prevents the Composer client from falling back to external source URLs to download. This feature requires Xray version 3.137.0 or above.

• URL Auto-Correct Added to Procedure for Creating a Smart Remote Repository An auto-correct feature was added to the procedure for creating a smart remote repository for certain package types, to ensure that a correct URL is used. For more information, see Configure a Smart Remote Repository.

• Bridge URLs in Remote Repositories Bridge URLs can now be used in remote repositories without additional configuration.

Retention and Cleanup Policies

• Retention Policies - Package Version Pattern Filtering Cleanup and Smart Archiving retention policies now support Include and Exclude Package Version Patterns. For more information, see Cleanup Policies and Smart Archiving.
• Improved the Run reports generated by Retention Policies for packages (Cleanup and Smart Archiving) The reports now include Package Path, Created Date, Modified Date, and Last Downloaded Date columns under Run Detailed Summary to facilitate better validation and auditing of deleted or archived packages. For more information, see Smart Archiving Run Report Overview, Restore Run Report Overview and Cleanup Run Report Overview.
• Enhanced Cleanup and Archiving Policy Logic Cleanup and smart archiving now supports logical AND operators, allowing you to combine time-based and property-based conditions for more granular management.

Workers

• Updated Payload Code Sample for "Before Download Request Worker" The payload code sample for Before Download Request Worker has been updated for backward compatibility and to avoid compilation errors. The redundant repoPath object has been removed from the root of the event request, and the headers object is now identified as requestHeaders. For more information, see Before Download Request Worker Code Sample.

Evidence

• Evidence system enhancements
  • Cosign v3: The Evidence system now supports automatic evidence creation using the Sigstore bundle format. This includes compatibility with both the cosign sign and cosign attest commands with the new-bundle-format flag. Support remains in place for in-toto attestations (DSSE) created with the legacy Cosign v2 attest command.
  • PSS Padding: To simplify integration with different systems that produce attestations, the Evidence system now supports secure PSS (Probabilistic Signature Scheme) padding for signatures when creating evidence with APIs. PKCS#1 v1.5 padding is still supported.
  • Base64 URL encoding: The Evidence system now supports Base64 URL encoding for the DSSE signature. Standard Base64 encoding is still supported.
• New REST APIs for evidence queries Two new REST APIs are available for performing evidence queries. They are intended for users who prefer traditional REST APIs for integration with their existing automation tools instead of using GraphQL. For more information, see Search Evidence (REST API) and Get Evidence by ID (REST API).
• Evidence GraphQL API for returning evidence by ID You can now use GraphQL to return the details of a specific evidence item using its ID instead of using its path. For more information, see Get Evidence by ID (GraphQL).

User Integrations

• Support for Regex in OIDC Integration Dynamic Mapping The JFrog Platform OIDC integration now supports dynamic mapping creation using regular expressions (regex), which automates and streamlines the process for various use cases.

Platform Management

• Added a Warning Message When Deleting a SCIM Token The JFrog Platform now displays a warning message when attempting to delete a SCIM token, as deletion might disconnect authentication provider integrations.
• Support for New SCIM REST API Endpoints The JFrog Platform now supports getting more information about your SCIM configuration and schemas via REST API. For more information, see Get Resource Types API, Get Service Provider Configuration, Get Schemas API, and Get Schema by ID.
• New Support for Password Control Via REST API The JFrog Platform Access service now enables you to expire and un-expire all passwords via REST API. For more information, see Expire Password for All Users API and Un-Expire Password for All Users API.
• Support for Filtering Tokens by Scope via REST API The JFrog Platform now supports filtering the results of the Get Tokens REST API using the scope parameter to get token results for a specific scope, such as group. For more information, see Get Tokens API.
• Added Support for Project Admin Permissions The JFrog Platform now offers more granular control over project admin permissions, enabling you to grant Manage Resources permissions to project admins while preventing them from creating or managing remote repositories.
• Logging of Administration Configuration Changes The JFrog Platform now supports logging of any changes made to the access configuration, such as enabling anonymous access, in the Access audit trail log.
• Support for Webhook Target Validation The JFrog Platform now supports creating a whitelist to allow private domains or IP addresses to be used as Webhook targets without needing to disable Artifactory validation.****

Storage

• Support Added for Decompressing .xz and tar.xz Files

  Artifactory now supports decompressing .xz and tar.xz files, similar to the already supported decompression for .zip, .tar, and .gz files.

Helm Charts

• The Artifactory Helm chart now supports Azure Workload Identity authentication through the new useInstanceCredentials parameter. This authentication method replaces the legacy saasTokens and accountKey configurations. For more information, see Azure Workload Identity
• The Artifactory Helm chart now includes the rtfs.customCertificatesSecretName parameter for the RTFS service. This ensures custom certificates are properly copied to the RTFS container’s trusted certificates folder.

Resolved Issues

This section includes all the Artifactory 7.125 releases.

📘

Critical Security Notice

All subversions are vulnerable to multiple non-critical security vulnerabilities that, in some deployments, can be chained into critical-severity attacks. We recommend that all customers upgrade to the latest version. View the latest Self-Managed and SaaS releases.

Released: 18 August 2026

CVEs Addressed

Released: 27 July 2026

📘

Security Notice

This version is designed to fix multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments due to the additional security risks it introduces.

Released: 15 July 2026

Resolved Issues

Released: 29 June 2026

⚠️

Important Notice for Customers Using AWS SDK Storage with KMS Client-Side Encryption

Customers using AWS SDK storage with KMS client-side encryption should not use AWS SDK v2. If you are using AWS SDK storage with KMS client-side encryption, ensure that in the binarystore.xml file awsSdkV2 is set it to false. For more information, see Amazon S3 Template Parameters.

Resolved Issues

Released: 28 April 2026

📘

This patch includes security bug fixes. Customers with Self-Managed deployments are strongly recommended to upgrade to the latest patch for this version.

CVEs Addressed

Released: 27 January 2026

Resolved Issues

Released: 13 January 2025

Resolved Issues

Released: 30 December 2025

Resolved Issues

Released: 16 December, 2025

Resolved Issues

Released: 4 December 2025

Feature Enhancements

• Database Optimizations

  • Optimized Artifactory's shift events operation by refactoring the internal database process to use bulk inserts, significantly reducing database round trips and improving performance
  • Optimized the performance of node event deletion in Artifactory when using an Oracle Database by adding an optional system property to utilize the primary key index. See Oracle for Artifactory.

Resolved Issues

Released: 18 November, 2025

Feature Enhancements

• Retention Policies - Package Version Pattern Filtering

  Cleanup and Smart Archiving retention policies now support Include and Exclude Package Version Patterns. For more information, see Cleanup Policies and Smart Archiving.

Resolved Issues

Released: 4 November, 2025

Resolved Issues

Released: 30 October, 2025

New Features

• Support for Sigstore bundle attestations

  Artifactory now supports the automatic conversion of OCI Sigstore bundle attestations into JFrog evidence.

• New Parent Manifests API

  A Parent Manifests API has been added, which allows you to discover all parent manifest lists associated with a specific Docker manifest. For more information, see Find Parent Manifest Lists.

• New Platform Auditor User Type

  The JFrog Platform now supports a Platform Auditor user role that allows users to view the entire JFrog Platform Web UI but not perform any actions, which can be useful for auditing or compliance monitoring. To use this feature, enable the following feature flag in your system configuration file:

  accessPlatformAuditor: true

  For more information, see The Platform Auditor.

• Support for signed attestations in OCI images

  The Evidence Collection service can take signed, 3rd-party attestations uploaded to Artifactory as OCI images and convert them automatically into JFrog evidence. For example, this new feature can successfully convert attestations created using the cosign attest command. For the automatic conversion to work, the attestations must conform to both the DSSE and in-toto standards.

• Cleanup - Builds

  Artifactory now supports a build cleanup policy to delete unintended builds. For more information, see Cleanup Policies.

• New Remote Repository Types for IDE Plugins

  Two new remote repository types, AI Editor Extensions and JetBrains Plugins, are now available to proxy IDE plugin marketplaces. The AI Editor Extensions repository supports proxying extension marketplaces for VSCode, Cursor, and Windsurf. This repository type is integrated with JFrog Curation to enable policy-based blocking of unwanted plugins. The JetBrains Plugins repository supports proxying the JetBrains Marketplace for JetBrains IDEs such as IntelliJ IDEA and PyCharm.

  With both repository types, you can browse and install extensions and plugins natively within each IDE.

  The repositories are available to customers with an Ultimate bundle subscription.

• New Remote Repository Type for Bazel Modules

  The new Bazel Modules remote repository type supports caching and proxying the Bazel Central Registry (BCR) in Artifactory. This repository type is designed to support module dependency maknagement in accordance with Bazel 9 requirements. Maintaining a secure cache and proxy of the BCR ensures that developers pull only approved and vetted dependencies, enhancing security and streamlining the development process. For more information, see Bazel Modules Repositories.

• Update Password Policy Via REST API

  The JFrog Platform now supports creating and updating your instance’s password policy via REST API, for easier access for Cloud instances. For more information, see Password Policy.

• Artifactory Now Natively Supports the Terraform Provider Registry Protocol

  Artifactory now natively supports the HashiCorp Terraform Provider Registry Protocol, acting as a fully compliant Provider Origin Registry for both Terraform and OpenTofu. This enhancement simplifies client configuration, enhances security with GPG verification, and provides smarter protocol-aware proxying. This new method applies to local, virtual, and federated repositories and adds to the network_mirror approach. For more information, see Documentation.

Feature Enhancements

• Storage

  • Support for AWS SDK v2 in S3 Storage

    Artifactory's S3 binary storage provider now supports AWS SDK v2. This integration allows you to leverage the latest AWS features and optimizations for a more robust and efficient storage solution, while maintaining full backward compatibility with your existing S3 configurations. AWS SDK v2 receives all active development, new features, and security updates, ensuring your storage integration remains up-to-date. For more information, click here.

❗️

Important

Amazon Web Services has decided to make SDK v1 end-of-life at the end of 2025. Therefore, JFrog strongly recommends that all Artifactory customers currently using SDK v1 transition to SDK v2 at this point in time.

• Support for Azure Workload Identity

  Artifactory now supports authentication with Azure Blob Storage using Azure Workload Identity. This method provides a secure, secret-less authentication mechanism for applications running on Azure Kubernetes Service (AKS). It leverages federated identity credentials, eliminating the need to manage and rotate secrets such as SAS tokens or storage account keys within your Artifactory configuration. For more information, click here.

• Data Sharding Improvements

  Improvements were made in thread synchronization in sharding and s3-sharding providers.

• Daily Cleanup Job Added for Cache FS _pre folder

  A daily job is now triggered on startup to cleanup old dbRecord*.bin files in the cache provider’s _pre folder. The configurations for this job can be modified in the binarystore.xml file under the cache-fs provider. For more information, see Cached Filesystem Binary Provider.

• Additional Configuration for GCP Internal Actions

  The ability to configure readTimeout was added to Google Cloud Platform (GCP) internal actions.

• Project Administration

  • Support for webhooks for project-related builds

    Artifactory now supports the creation of webhooks for builds associated with specific projects. This enables you to receive notifications whenever a build in a particular project is uploaded, promoted, or deleted. To create a build webhook for a specific project, you must be working within the scope of the project (as opposed to All Projects).

    For specific guidelines about creating a build webhook for a specific project, see Domain: Build.

• Evidence Management

  • Evidence propagation to Federation members

    This release enhances the Evidence service to enable evidence propagation to all Federation members, regardless of whether they contain the relevant public key for verification. Evidence verification, however, is performed only on those members that have the public key. For more information, see Verify Evidence.

  • Evidence for artifacts in virtual repositories displayed in Artifacts tree

    You can now view evidence related to artifacts in a virtual repository in the Artifacts tree. This is particularly useful when attaching evidence to a Docker image created in a tool such as GitHub Actions. In such cases, users typically work with the Docker image as part of a virtual repository in Artifactory. The virtual repository must contain at least one local repository to house the evidence. For more information, see View the Artifact Evidence Table.

  • Improvements to evidence graph

    The design of the Release Bundle evidence graph has been improved to make it easier to distinguish between the various elements (builds, packages, etc.) that comprise the Release Bundle. For more information, see View Release Bundle v2 Evidence.

• Federation

  • Enhanced metadata propagation during RTFS Full Sync operations

    The Artifactory Federation Service (RTFS) now supports the propagation of artifact creation time metadata during a Full Sync operation. To enable this feature:

    1. Set the following Artifactory system property to true on the target members:

       artifactory.federated.mirror.events.upload.info.propagate.enabled

    2. Use a new REST API to enable the propagation of this specific metadata. For more information, see Propagate Creation Time Metadata during Full Sync API.

• Updated Artifactory Worker Events

  Updated the following Artifactory Worker events:

  • After Copy: The following fields are removed from the Sample Payload:

    contentLength, trustServerChecksums, servletContextUrl, skipJarIndexing and disableRedirect.

  • After Delete: The following field is removed from the Sample Payload:

    headers

  • After Property Create: The following fields are removed from the Sample Payload:

    contentLength, trustServerChecksums, servletContextUrl, skipJarIndexing, disableRedirect and headers.

  • After Move: The following fields are removed from the Sample Payload:

    contentLength, trustServerChecksums, servletContextUrl, skipJarIndexing and disableRedirect.

  • Before Move: The following fields are removed from the Sample Payload:

    contentLength, trustServerChecksums, servletContextUrl, skipJarIndexing and disableRedirect.

  • Before Download Request: The following fields are added in the response:

    modifiedRepoPath, expired and headers.

  • Before Create: The following fields are removed from the Sample Payload:

    contentLength, trustServerChecksums, servletContextUrl, skipJarIndexing and disableRedirect.

  • Before Copy: The following fields are removed from the Sample Payload:

    contentLength, trustServerChecksums, servletContextUrl, skipJarIndexing and disableRedirect.

  • Before Property Create: The following fields are removed from the Sample Payload:

    contentLength, trustServerChecksums, servletContextUrl, skipJarIndexing and disableRedirect.

  • Before Property Delete: The following fields are removed from the Sample Payload:

    contentLength, trustServerChecksums, servletContextUrl, skipJarIndexing and disableRedirect.

  • After Property Delete: The following fields are removed from the Sample Payload:

    contentLength, trustServerChecksums, servletContextUrl, skipJarIndexing and disableRedirect.

  • Updated the following Worker Events with repoType Input Parameter:

    • Before Property Replication
    • Before File Replication
    • Before Statistics Replication
    • Before Directory Replication
    • Before Delete Replication

• Smart Archiving

  • Skips Restore of Artifacts with the Same Name and Path

    The restore process now skips any artifact that already exists in the target location, preventing accidental overwrites. The existing file will be preserved, and the skipped operation will be noted in the logs and the CSV report.

  • Supported Archive Packages Search for Project Admins

    Project Admins will now see and be able to use the Archive Search feature. The search results are automatically scoped, ensuring they can only view archived packages that belong to the projects they manage.

• API Updates

  • Filtering added to Get All Repository Configurations API

    You can now use query parameters to filter the results of the Get All Repository Configurations API. You can filter by package type (for example, docker, maven) and repository type (for example, local or remote).

  • Change in API response for Release Bundle v2 tags

    To correct inconsistent behavior, the following API endpoints have changed the response for Release Bundle v2 tags from bundle_tag and release_bundle_tag to a standard response of tag:

    • Create Release Bundle v2 Version
    • Assign Tag to Release Bundle v2 Version API
    • Get Release Bundle v2 Versions API

  • Improved Get Federation Sync State REST API performance

    The performance of the REST API that returns the synchronization state of all Federated repositories in the JPD has been improved.

📘

Note

This API endpoint is relevant for users operating the legacy Federation service, not the Artifactory Federation Service (RTFS).

• Package Management and Repositories

  • Virtual Repositories for Hugging Face Packages

    Virtual repositories can now be created for Hugging Face packages.

    • Local and remote Hugging Face repositories that are associated with a virtual Hugging Face repository must have the Machine Learning Repository Structure.
    • Hugging Face datasets and models can be resolved from a virtual Hugging Face repository only with the snapshot_download API and not by using libraries.

    For more information, see Create a Hugging Face Repository and Resolve Hugging Face Packages.

  • RPM Package Settings

    Added support for Administrators to enable/disable RPM package settings for the following:

    • Recommends Tags
    • SHA256

    For enabling/disabling these settings, see Enable/Disable RPM Package Settings.

  • Improvement to the Vendor Folder for the Private Go Registry and the Go Proxy

    Checksums in the private Go registry and the Go proxy are now aligned for the Go version 1.24 vendor folder.

  • NuGet Package Updates

    • Curation Support for NuGet Virtual Repositories

      Extended JFrog Curation capabilities to support NuGet virtual repositories, providing a powerful, centralized way to secure your NuGet package consumption.

    • NuGet Package - Now Supports .NET CLI

      NuGet packages now include support for the .NET CLI.

    • Optimized NuGet Version

      Tightened validation to require all NuGet packages to use strict Semantic Versioning (SemVer 2.0). See specification.

    • Nuget Packages - Rate Limit

      Introduced a new rate-limiting mechanism for search APIs to prevent excessive calls and ensure service stability.

  • Upgraded Gradle Set Me Up Wizard

    The Gradle Set Me Up wizard has been upgraded to support Gradle 9.

  • Improvement in VCS Remote Repositories

    The GitHub Server option for Git providers was added for VCS remote repositories. For more information, see Create a VCS Repository.

  • Added Enforcement of Custom Configurations for Certain Remote Docker Repositories

    When creating a remote Docker repository for an Azure Container Registry (*.azurecr.io) or a Microsoft Container Registry (https://mcr.microsoft.com/), Artifactory makes the following default configuration:

    • Disable URL Normalization = true

    When creating a remote Docker repository for a Chainguard Registry (http://cgr.dev/chainguard), Artifactory makes the following default configuration:

    • Block Mismatching Mime Types = true

    These default configurations are set upon remote repository creation and can be canceled afterwards. For more information, see Other Advanced Settings for Remote Repositories.

  • Improved npm Search

    It is now possible to search for up to three search terms in npm local repositories when using the "npm search" command.

  • Enhanced Support for npm Audit

    In addition to npm virtual repositories, npm Audit is now also enabled by default on npm remote repositories that support npm Audit directly. For more information, see Use npm Audit.

  • Improved Resolving of Subgroups When Accessing Subgroups in Gitlab with Go Remote Repositories

    When accessing subgroups in GitLab with Go remote repositories (by selecting the Resolve Subgroups checkbox, as explained here), Artifactory now resolves the correct dependency version even if the URL contents contain both subgroups and submodules.

  • New Setting Added to Complete a List Manifest Image Overwrite

    A new setting has been added under Package Settings called Complete list manifest image overwrite. When this setting is enabled, overwriting a list manifest image will asynchronously overwrite all of its sub-manifests.

• Release Lifecycle Management

  • Expanded support for distributing and exporting Release Bundle v2 versions

    To make distributing and exporting Release Bundle v2 versions easier, you can now use JFrog Distribution with Release Bundle v2 versions signed with the default key in Artifactory. To support this change, the default key type has been changed from RSA to GPG, and the name of the default key has been changed to default-lifecycle-key. For more information, see Create Signing Keys for Release Bundles (v2).

  • Improved visibility for nested Release Bundles

    The Release Bundle v2 content graph now provides a clear, visual representation of nested Release Bundles. Seeing the complete hierarchy enables you to understand how the Release Bundle is constructed, even when it contains other Release Bundles. For more information, see View Release Bundle v2 Evidence.

  • Improved aggregated Release Bundle creation

    Artifactory has improved its handling of aggregated Release Bundles (meaning, a Release Bundle v2 version that is comprised of other Release Bundle versions). If the Release Bundle version you are trying to create contains multiple Release Bundles with the same artifact but different metadata (evidence or properties), Artifactory will create the version successfully using the newer version of the artifact.

  • Change of status code when creating Release Bundle v2 from build with missing artifact

    To improve reporting accuracy, errors caused by missing artifacts during Release Bundle v2 creation will be returned as a 422 error (SC_UNPROCESSABLE_ENTITY) rather than a different status code that triggered unnecessary monitoring alerts. The 422 status code represents the event more accurately as it is the expected behavior when an artifact cannot be found.

  • Performance Improvement in Release Bundle v2 Promotion Flow

    The performance of the promotion flow for Release Bundle v2 versions has been improved.

  • Source environment included in Release Bundle v2 promotion GET API results

    The Get Release Bundle v2 Promotions API and Get Release Bundle v2 Version Promotions API now include the source environment in their responses. This enables you to see at a glance the name of the environment from which the Release Bundle version was promoted.

  • Redesigned presentation of Release Bundle v2 contents

    The Content tab for Release Bundle v2 versions has been redesigned to show each package and standalone artifact included in the version (known as "releasables") and their source (for example, a build or a different Release Bundle). For more information, see View the Contents of a Release Bundle v2 Version.

  • Release Bundle v2 versions now associated with stages and lifecycles

    This version replaces environments with the concept of stages and lifecycles, to provide users with more flexibility and control over their SDLC. Administrators can create global and project stages as needed and assign them to different SDLC categories, such as Code and Promote. The administrator then adds selected stages to the lifecycle to represent the progression of release candidates through your SDLC. For more information, see Stages & Lifecycle.

  • Support for webhooks for project-related Release Bundles

    Artifactory now supports the creation of webhooks for Release Bundle v2 versions associated with specific projects. This enables you to receive notifications whenever a Release Bundle in a particular project is uploaded, promoted, or deleted. To create a Release Bundle webhook for a specific project, you must be working within the scope of the project (as opposed to All Projects).

    For guidelines about creating a Release Bundle v2 webhook for a specific project, see Domain: Release Bundle v2.

  • Created-by information provided for Sigstore evidence

    To improve understanding and traceability, the API response when creating and deploying Sigstore evidence now includes the username associated with the JFrog token instead of ‘internal’.

  • More accurate error messages during Release Bundle promotion

    To improve user understanding, validation errors during the Release Bundle v2 promotion process will now return a BAD REQUEST error message (HTTP 400) rather than a generic HTTP 500 error.

  • Release Bundle v2 auto-creation feature removed

    The Release Bundle v2 auto-creation feature, which was introduced to help customers transition from build promotion to the expanded feature set offered by Release Lifecycle Management, has been removed from the platform UI after having served its purpose.

  • Viewing Release Bundles distributed to Edge nodes

    To align the platform UI with the REST API, only admin users are permitted to view distributed Release Bundle versions (v1 and v2) in the Received tab on Edge nodes. For more information, see View Release Bundles on Edge Nodes.

• Cleanup and Retention Policies

  • Adding days/weeks selection for Time-based Policy Condition - Cleanup Release Bundle V2

    Enhanced RB V2 cleanup functionality with the addition of days/weeks selection for policy condition. You can now configure cleanup conditions, specifying days/weeks for the RB V2. For more information, see Create Cleanup Policy - Release Bundle V2.

  • Retention Policies - Cleanup & Smart Archiving

    The Stop All Runs action is now restricted to Platform Admins only. Project Admins no longer have access to this action.

  • Run Cleanup policies and Garbage Collection (GC) Simultaneously

    Enabled cleanup policies to run more reliably by making them health-aware. Jobs will now run concurrently with other tasks only if the system is HEALTHY and will automatically stop if load increases, ensuring system stability.

    This can be toggled by the system property: artifactory.retention.system.health.aware.job.enabled

• Artifact Management

  • Improved Artifact Lifecycle Management

    Artifactory now updates the creation timestamp of an artifact when it is copied or moved to a new repository to the current date and time of the operation. Previously, the original creation timestamp was retained when moving or copying an artifact to another repository, which led to incorrect assumptions about the artifact's age and relevance in the new location. The "last modified" timestamp remains unchanged to preserve the integrity of the artifact's last update. This enhancement helps in the effective adoption of cleanup policies and aligns with industry standards. To ensure backward compatibility, this feature is implemented behind a feature flag and is disabled by default.

  • New Metadata Properties Added to the manifest.json

    Metadata properties for the operating system and the operating system architecture will now be added to the manifest.json after pushing or caching a new image. These new properties are set in docker.os and docker.architecture, respectively.

  • Prevent accidental removal of referenced sub-architectures in multi-arch images

    Starting from this Artifactory version, when deleting a multi-architecture image, any sub-architecture variant that is still referenced by another image will be preserved.

  • Context retention in Artifacts browser

    When you copy or move artifacts in the Artifacts browser, the UI no longer moves automatically to the destination path of the operation but remains in its original context. To move to the destination path after the copy or move operation is complete, click the Go to path link in the confirmation message.

  • UI Support for Debian Source Package Search

    Added support for Debian Source package search.

• Caching

  • Improved Change Artifacts count UI widget caching mechanism

    Improvements were made to the Change Artifacts count UI widget caching mechanism.

  • Daily Cleanup Job Added for Cache FS _pre folder

    A daily job is now triggered on startup to cleanup old dbRecord*.bin files in the cache provider’s _pre folder. The configurations for this job can be modified in the binarystore.xml file under the cache-fs provider.

• Platform UI

  • Redesigned platform UI for Release Lifecycle Management

    The platform UI for Release Lifecycle Management has been redesigned to provide a clearer, more consolidated view of your Release Bundles. The new design centralizes all critical information for each Release Bundle version, including its timeline, contents, security scans, evidence, and properties, in an accessible and intuitive interface. For more information, see Release Lifecycle Management.

  • Improved visibility of OCI/Docker multi-arch images in the platform UI

    To reduce visual clutter and improve comprehension, Artifactory now makes it easier to manage OCI/Docker multi-arch images in the platform UI. For example, if you have a multi-arch image called my-image:1.0.0 that supports amd64 and arm64 architectures, Artifactory contains 3 distinct package versions, one for the manifest list and one for each architecture:

    • my-image:1.0.0
    • my-image:sha256__f2ca1bb6c7....
    • my-image:sha256__1a8a5828e8....

    Artifactory now displays the version for the manifest list only in the platform UI and suppresses the individual architecture versions (named according to their image tags). This enables you to focus on the multi-arch image as a single entity. Please note that all package versions will be returned when listing the content via the REST APIs.

  • Platform UI support for displaying larger evidence files

    The platform UI can now display evidence files up to a maximum size of 3000 lines (compared to 1500 lines in previous versions). Larger evidence files can be downloaded with a single click. For more information, see View Evidence.

  • Support for Easy Copying of Administration Values

    The JFrog Platform WebUI now supports a Copy button, allowing you to copy values in the Administration module pages with a single click.

    The following values will now be easily copiable:

    • Token ID under Access Tokens
    • Name under Projects, Users, Groups, Permissions, Project Members, Webhooks, and Manage Integrations
    • Auth URL under OAuthSSO
    • URL under Webhooks
    • Group Name under Crowd/ Jira
    • Provider URL under Manage Integrations
    • Project Key under Projects

• Platform Configuration

  • Support for Updating the Access Bootstrap YAML File

    The JFrog Platform now supports making changes to the access.security.bootstrap.yml file without creating a new configuration or modifying the existing Artifactory YAML file. For more information, see Access Bootstrap YAML File.

  • Improved Configuration Descriptor Validation

    Configuration descriptor validation was improved to increase system stability.

  • Traefik Version Upgrade

    The Traefik version embedded in the Router microservice was upgraded from v2 to v3. This should not impact operation. Though if you your deployment depends on specific functionality, review their upgrade notes

Resolved Issues

This section includes all the Artifactory 7.117 releases.

📘

Critical Security Notice

All subversions are vulnerable to multiple non-critical security vulnerabilities that, in some deployments, can be chained into critical-severity attacks. We recommend that all customers upgrade to the latest version. View the latest Self-Managed and SaaS releases.

Released: 18 August 2026

CVEs Addressed

Released: 27 July 2026

📘

Security Notice

This version is designed to fix multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments due to the additional security risks it introduces.

Released: 15 July 2026

Resolved Issues

Released: 29 June 2026

Resolved Issues

Released: 28 April 2026

📘

This patch includes security bug fixes. Customers with Self-Managed deployments are strongly recommended to upgrade to the latest patch for this version.

CVEs Addressed

Released: 23 October 2025

Resolved Issues

Released: 7 October 2025

Feature Enhancements

• Maintenance Release

  Released a fix for CVE-2025-41249. For more information see Artifactory Fixed Security Vulnerabilities.

Resolved Issues

Released: 24 September 2025

Resolved Issues

Released: 16 September 2025

Resolved Issues

Released: 2 September 2025

Resolved Issues

Released: 19 August 2025

Resolved Issues

Released: 5 August 2025

Resolved Issues

Released: 31 July 2025

Resolved Issues

Released: 19 July 2025

❗️

Known Issue in this Version

During startup and regular operation, the Artifactory Frontend service attempts to download resources from the public internet endpoint https://grpc.qwak.ai. Therefore, JFrog recommends avoiding the upgrade to this version if your organization's environment restricts access to this endpoint. For more information, see Artifactory Known Issues.

Resolved Issues

Released: 25 July 2025

❗️

Known Issue in this Version

During startup and regular operation, the Artifactory Frontend service attempts to download resources from the public internet endpoint https://grpc.qwak.ai. Therefore, JFrog recommends avoiding the upgrade to this version if your organization's environment restricts access to this endpoint. For more information, see Artifactory Known Issues.

Released: 24 July 2025

New Features

⚠️

Known Issues in this Version

• During startup and regular operation, the Artifactory Frontend service attempts to download resources from the public internet endpoint https://grpc.qwak.ai .Therefore, JFrog recommends avoiding the upgrade to this version if your organization's environment restricts access to this endpoint. For more information, see Artifactory Known Issues.
• When upgrading existing Artifactory installations that have Router TLS enabled (router.tlsEnabled: true) in the system.yaml file, a common issue has been identified. The upgrade process might fail because the Router service fails to start, displaying the following error: Error during the build of the default TLS configuration: unknown TLS options: default. For more information, see Artifactory Known Issues.

⚠️

Breaking Change for Access REST APIs

From this version, Access REST API responses will be returned as compact JSON and not as pretty-printed JSON. Note that some automatic parsers that rely on the formatting will require an update.

• New REST API: Get Projects List for a Global Role

  The JFrog Platform now supports getting a paginated list of projects where a specific global role is used. For more information, see Get Project List for a Global Role API.

Feature Enhancements

• RTFS Breaking Change

  The version of the Artifactory Federation Service (RTFS) that comes with this Artifactory release changes the context path from /artifactory/service/rtfs to /rtfs. This is a breaking change for users who have multiple sites (JPDs) using RTFS. (Users who run RTFS on only one site, and sites that use the legacy Federation service, are unaffected by this change.)

  Users in Self-Managed environments who have sites running an older version of RTFS should upgrade them to the new version of RTFS as soon as possible to accommodate the new context path. As an interim solution, a set of commands can be added as a workaround to bridge the context path differences between sites using the new version of RTFS and sites using an older version, as described below.

  Nginx Configuration

  Add this command to the Nginx configuration of a site using the new version of RTFS:

  location /artifactory/ {
      if ($request_uri ~ ^/artifactory/service/rtfs/(.*) $ ) {
        proxy_pass       http://router/rtfs/$1;
        break;
      }
      if ( $request_uri ~ ^/artifactory/(.*) $ ) {
        proxy_pass       http://artifactory/artifactory/$1;
      }
      proxy_pass         http://artifactory/artifactory/;
    }

  This command instructs Nginx to redirect requests from sites that use the old RTFS context path to the new context path.

  Add this command to the Nginx configuration of a site using the old version of RTFS:

  location /rtfs/ {
    if ($request_uri ~ ^/rtfs/(.*) $ ) {
        proxy_pass       http://router/artifactory/service/rtfs/$1;
        break;
      }

  This command instructs Nginx to redirect requests from sites that use the new RTFS context path to the old context path.

  Apache Configuration

  Use the following Apache rewrite rule to redirect requests between sites that have a mix of old and new context paths:

  RewriteRule "^/artifactory/service/rtfs/(.*) $" "balancer://artifactory/artifactory/service/rtfs/$1" [P,L]

  Important Migration Note

  When migrating from the legacy Federation service to RTFS, be sure to use version 2.0 of the CLI, which implements the new context path.

Release Bundles

• Create Release Bundle v2 version from multiple sources

  You can now create a Release Bundle v2 version from multiple sources, for example, a combination of artifacts, builds, and existing Release Bundles. For more information, see Create Release Bundle v2 Version.

• Create a Release Bundle v2 version from packages

  You can now create a Release Bundle v2 version by defining one or more packages to include in the Release Bundle. The Release Bundle can include packages of every type supported by Artifactory. For more information, see Create Release Bundle v2 Version.

• Create a Release Bundle v2 version using items in remote-cache repositories

  You can now create a Release Bundle v2 version that includes packages and artifacts located in remote-cache repositories. For more information about Release Bundle creation, see Create Release Bundle v2 Version.

• SBOMs containing remote-cache dependencies

  Release Bundle v2 versions created from build-info can now include build dependencies located in remote-cache repositories, provided you have used the option for including dependencies in the Release Bundle. If this option has not been used, the remote-cache dependencies will not be included in the Release Bundle, but the SBOM used by Xray will still contain metadata about those dependencies.

• Release Bundle v2 – support for SBOMs with remote dependencies

  Previously, Release Bundle v2 did not include information about dependencies from remote repositories, which prevented the generation of a complete SBOM (software bill of materials) by Xray. This limitation hoas now been removed, which means that information about these dependencies will be included in the SBOM, and Xray (version 3.121.7 and above) can scan them. Having a complete SBOM increases transparency and security by providing insight into all components involved in the Release Bundle, and helps with auditing and compliance.

📘

Note

Although information about remote dependencies is included in the SBOM, the dependencies themselves are not included in the Release Bundle in the current version.

• Source environment of Release Bundle v2 promotions

  The source environment of a Release Bundle v2 promotion is now included in the API response, making it easier for users to identify the start and end points of the promotion. For more information about promotion, see Promote Release Bundle v2 Version.

• Adding properties to Release Bundle v2 versions

  You can now add properties and property sets to Release Bundle v2 versions. Properties are user-defined, key-value pairs that are added to the Release Bundle v2 version's manifest file. For more information, see Add Properties to a Release Bundle v2 Version.

• New search and filtering options for Release Lifecycle Management kanban board

  The Release Lifecycle Management kanban board now features options for searching through and filtering the displayed Release Bundle versions. These options make it easier for you to focus on the versions of greatest interest.

• Release Bundle v2 promotion rollback

  You can now use the REST API to roll back the latest promotion of a Release Bundle v2 version. Rollback deletes the contents of the latest promotion (including its artifacts, properties, and evidence) and restores the version to its previous environment, including the properties and evidence it contained when the version was first created. For more information, see Promotion Rollback.

• Release Bundle v2 version supports plus sign character

  You can now include a plus sign (+) when defining the version of a Release Bundle v2. This change was made to achieve alignment with the SemVer 2.0.0 specification. For more information, see Create Release Bundle v2 Version.

• Assigning a tag when creating a Release Bundle v2 version

  You can now assign a tag when creating a Release Bundle v2 version with the REST API. Use the tag to identify the version quickly. For example, you can create tags such as nightly-build, release-candidate, bugfix-2025-33124, and so on. The tag will appear on the card for the Release Bundle version on the Release Lifecycle stages board.

📘

Note

You can continue using the Assign Tag API to tag existing Release Bundle versions.

• Version counter on Release Lifecycle stages board

  The Release Lifecycle stages board now includes a counter so that you can see at a glance how many versions of the selected Release Bundle currently exist.

• Improved error codes during Release Bundle v2 creation

  Artifactory will now return 404 when an artifact or package is missing from the defined artifact or package list during Release Bundle v2 creation. In addition, Artifactory will return 403 when an artifact or package is filtered out due to a user permissions issue.

• Evidence provider logo displayed on stages board

  Each evidence item displayed on the Release Lifecycle stages board now includes a logo to indicate the provider of that evidence, whether it is evidence provided by the JFrog platform or evidence originating from other providers, such as GitHub or Sonar. The logo is also displayed prominently when the contents of the evidence item are opened.

• Cleanup and Retention Policies

• Support for Composer Packages in Cleanup Policies and Smart Archiving

  Cleanup Policies and Smart Archiving now support Composer package type.

• Support for Chef and Puppet Packages in Cleanup Policies

  Cleanup Policies now support Chef and Puppet package types.

• Support for N versions in Retention Policies

  Cleanup Policies and Smart Archiving now support N versions for Docker, OCI and Helm OCI. For more information, see Cleanup Supported Packages and Smart Archiving Supported Packages.

• API Run Summary Reports for Cleanup and Smart Archiving

  Added new API endpoints for cleanup and smart archiving that provide detailed run summary reports in JSON format. For more details, refer toView Package Cleanup Policy Run Summary Report API and View Smart Archiving Policy Run Summary Report API.

• Smart Archiving Packages: Evidence

  Added support for the archival of evidence associated with any packages. This enhancement ensures that relevant evidence is preserved as part of your archiving strategy, streamlining your package management process. For more information, refer to Smart Archiving.

• Property-based Policy Condition - Smart Archiving Packages

  Enhanced package-archivie functionality with the addition of a property-based policy condition. You can now include or exclude specific package versions from archive by applying a property-based policy condition. This allows for more granular control over which packages are retained or archived during archive actions. For more information, see Create Smart Archiving Policy.

• Packages and Repositories

• Default Socket Timeout for Federated Repositories

  The default socket timeout for Federated repositories has been changed to 300000 milliseconds (5 minutes). This value can be adjusted, if required, using an Artifactory system property. For more information, see Increase the Predefined Socket Timeout for Larger Repositories.

• CocoaPods Smart Repositories

  The CocoaPods Settings section has been removed from the smart repository creation page. Smart repositories automatically inherit configuration from their source repository, making manual settings unnecessary.

• Cocoapods CDN Smart Repository Support

  Added smart repositories support for CocoaPods CDN.

• Improvement in Promoting Docker Images

  Starting from this Artifactory version, when Docker image promotion overrides an existing image tag in the target repository, shared layers from other tags of the same image will not be deleted. In versions prior to 7.117.1, these shared layers may be deleted.

• Support for Oracle 23c

  Artifactory is now certified to work with the Oracle 23c database.

• Improved Get Federation Sync State REST API performance

  The performance of the REST API that returns the synchronization state of all Federated repositories in the JPD has been improved.

📘

Note

This API endpoint is relevant for users operating the legacy Federation service, not the Artifactory Federation Service (RTFS).

• JFrog Platform

• Removal and Backup of Mission Control Plugins

  The following Mission Control plugins, which were created during the initial days specifically for Mission Control, are no longer required by any JFrog products. As a result, these plugins will be removed in this version and backup files are created with a .backup extension.

  • internalUser.groovy
  • ldapSettingsConfig.groovy
  • ldapGroupsConfig.groovy
  • haClusterDump.groovy
  • repoLayoutsConfig.groovy
  • proxiesConfig.groovy
  • propertySetsConfig.groovy
  • requestRouting.groovy
  • httpSsoConfig.groovy
  • pluginsConfig.groovy

  For more information, see User Plugins documentation.

• Support for Reading Permissions Scoped Tokens

  It is now possible for non-admin users to use the Get Projects List API, Get Project Users API, Get Repository Configuration API , HA License Information API , and Get Storage Summary Info API endpoints using a scoped token. For more information, see Create Scoped Token.

• Secure Cloud Storage Credentials in Helm

  We have introduced a new feature that allows you to supply cloud storage identity and credentials as a Kubernetes secret within your values.yaml file for Artifactory Helm deployments. This capability extends to:

  AWS S3V3: Securely provide your AWS S3V3 access keys and secret keys. Azure Blob Storage: Securely provide your Azure storage account name and access key.

• Improved Builds table

  The Builds table features two important enhancements:

  The maximum of 100 builds displayed in the table has been removed. The table can now display all the builds that exist in your Artifactory instance. A search window has been added to make it easier to focus on the builds of greatest importance to you. (This new search window works in coordination with the platform search window at the top of the UI.)

• Additions to Artifactory Request Log (JSON version)

  The JSON version of the Artifactory request log has been enhanced to include additional metrics for improved tracking of request and response performance. These enhancements provide insights into response timing, data size, processing duration, and request specifications.

• Expanded support for scoped tokens in Deploy Evidence API

  The Deploy Evidence REST API now supports scoped tokens based on specified artifacts in addition to its previous support for scoped tokens based on a specified repository. In both cases, the scoped token must include the Annotate action. For more information, see Create Scoped Token.

• Filter Users and Groups by Role Within a Repository Via REST API The JFrog Platform now supports filtering users and groups by role within a specific repository via REST API. For example, you can easily retrieve a list of admins for a specific repository to streamline permissions management. For more information, see Get User List API and Get a List of Groups API.

• Allow Granting Manage Permissions in Permissions V2

  The JFrog Platform now supports allowing users with manage permissions to grant manage and other permissions to other users in Permissions V2, although it is not recommended. For more information, see Permissions.

• Add Unlimited Groups to a Reference Token in SAML The JFrog Platform now supports adding an unlimited number of groups in SAML user-scoped reference tokens, as the number of groups does not affect the payload. For more information, see Create Token.

• Improved Robustness of Binary Uploads to Google Cloud Storage (GCS)

  The robustness of binary uploads to GCS has been improved by enhancing recovery mechanisms.

• Daily Notification Emails for Token Expiration

  The JFrog Platform now supports setting intervals for email notifications about tokens that are about to expire, either once or daily during the notice period. For more information, see Token Expiration Notification.

• JFrog Platform WebUI Breadcrumbs

  From Artifactory version 7.116.3, breadcrumbs allowing you to orient yourself in the JFrog Platform WebUI will gradually be rolled out to all pages. For more information, see JFrog Platform Navigation.

• Workers

• Get Worker Code Samples with Worker Code Gallery

  The JFrog Platform now supports populating new Workers with GitHub code samples, directly from the JFrog Platform WebUI. For more information, see Configure Workers in the UI.

• Rerun Worker Runs

  The JFrog Platform now supports a Rerun feature to troubleshoot Worker runs. For more information, see Workers Troubleshooting.

• Updated Type Definitions for Event-Driven Workers' Response

  Refined TypeScript type definitions for event-driven workers' response to improve the developer experience.

Resolved Issues

This section includes all the Artifactory 7.111 releases.

📘

Critical Security Notice

All subversions are vulnerable to multiple non-critical security vulnerabilities that, in some deployments, can be chained into critical-severity attacks. We recommend that all customers upgrade to the latest version. View the latest Self-Managed and SaaS releases.

Released: 18 August 2026

CVEs Addressed

Released: 27 July 2026

📘

Security Notice

This version is designed to fix multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments due to the additional security risks it introduces.

Released: 15 July 2026

Resolved Issues

Released: 29 June 2026

Resolved Issues

Released: 28 April 2026

📘

This patch includes security bug fixes. Customers with Self-Managed deployments are strongly recommended to upgrade to the latest patch for this version.

CVEs Addressed

Released: 13 July 2025

⚠️

Breaking Change for Artifactory Federation Service

The version of the Artifactory Federation Service (RTFS) that comes with this Artifactory release changes the context path from /artifactory/service/rtfs to /rtfs. This is a breaking change for users who have multiple sites (JPDs) using RTFS. (Users who run RTFS on only one site, and sites that use the legacy Federation service, are unaffected by this change.)

Users in Self-Managed environments who have sites running an older version of RTFS should upgrade them to the new version of RTFS as soon as possible to accommodate the new context path. As an interim solution, a set of commands can be added as a workaround to bridge the context path differences between sites using the new version of RTFS and sites using an older version, as described below.

Nginx Configuration

Add this command to the Nginx configuration of a site using the new version of RTFS:

location /artifactory/ {
    if ($request_uri ~ ^/artifactory/service/rtfs/(.*) $ ) {
      proxy_pass       http://router/rtfs/$1;
      break;
    }
    if ( $request_uri ~ ^/artifactory/(.*) $ ) {
      proxy_pass       http://artifactory/artifactory/$1;
    }
    proxy_pass         http://artifactory/artifactory/;
  }

This command instructs Nginx to redirect requests from sites that use the old RTFS context path to the new context path.

Add this command to the Nginx configuration of a site using the old version of RTFS:

location /rtfs/ {
  if ($request_uri ~ ^/rtfs/(.*) $ ) {
      proxy_pass       http://router/artifactory/service/rtfs/$1;
      break;
    }

This command instructs Nginx to redirect requests from sites that use the new RTFS context path to the old context path.

Apache Configuration

Use the following Apache rewrite rule to redirect requests between sites that have a mix of old and new context paths:

RewriteRule "^/artifactory/service/rtfs/(.*) $" "balancer://artifactory/artifactory/service/rtfs/$1" [P,L]

Important Migration Note

When migrating from the legacy Federation service to RTFS, be sure to use version 2.0 of the CLI, which implements the new context path.

Feature Enhancements

- Improved Get Federation Sync State REST API performance

The performance of the REST API that returns the synchronization state of all Federated repositories in the JPD has been improved.

📘

Note

This API endpoint is relevant for users operating the legacy Federation service, not the Artifactory Federation Service (RTFS).

Resolved Issues

Released: 3 July 2025

Resolved Issues

Released: 17 June 2025

Resolved Issues

Released: 3 June 2025

Resolved Issues

Released: 20 May 2025

Feature Enhancements

- Default Socket Timeout for Federated Repositories

The default socket timeout for Federated repositories has been changed to 300,000 milliseconds (5 minutes). This value can be adjusted, if required, using an Artifactory system property. For more information, see Increase the Predefined Socket Timeout for Larger Repositories.

Resolved Issues

Released: 8 May 2025

Resolved Issues

Released: 23 April 2025

Important Announcements

- Pre-Upgrade Checks for Bundled PostgreSQL

If you are using the bundled postgresql with the Artifactory Helm chart during the upgrade to Artifactory version 7.111, it is essential to perform some pre-upgrade checks to ensure a smooth upgrade.

⚠️

Breaking Changes in Bundled PostgreSQL Upgrade

Starting from Artifactory version 7.111.x, the bundled postgresql chart is upgraded to version 15.5.20. This update is available in the latest artifactory and artifactory-ha Helm charts.

If you upgrade Artifactory from any older version to 7.111.x directly, there may be some challenges during the upgrade if you are using the bundled postgresql in the Helm chart. Customers using an external postgresql will not be affected.

For more information about the pre-upgrade checks to be performed, see Pre-Upgrade Checks for Bundled PostgreSQL in Artifactory.

- Verify Database Configurations for Go Services

If you have customized the database URL for the Metadata microservice, it is essential to configure the Evidence database URL as well for a smooth upgrade, as both are GO services.

⚠️

Database Configuration Checks for Smooth Upgrade

Similar to Metadata, Evidence is also a Go service with a direct connection to the Artifactory database. Note that, JFrog provides a JDBC to Go URL converter within the Artifactory application to facilitate this connection.

However, in some cases, the converter may be unable to connect, which could affect Go services like Metadata and Evidence.

Customers who have previously configured metadata.database.url must also add evidence.database.url before upgrading to version 7.111.x. This step is essential to maintain database connectivity after the upgrade.

New Features

- Packages: Hex Repositories

Hex repositories in Artifactory allow you to deploy and resolve Hex packages. For more information, refer to Hex Repositories. (GA for all customers) - Packages: NVIDIA NIM Models

JFrog Artifactory now integrates with NVIDIA NIM, allowing you to cache NVIDIA NIM models in Artifactory via a remote repository. NVIDIA NIM is a set of microservices designed to accelerate the deployment of foundation models across any cloud or data center, ensuring data security. It provides production-grade runtimes with ongoing security updates and stable APIs, backed by enterprise-grade support. For more information, refer to NVIDIA NIM Repositories. - API Key Deprecation Control

As part of the deprecation process, API Key has reached End of Life in Q4.24. This version includes a checkbox in the JFrog platform UI allowing you to control the API Key usage deprecation. This checkbox will be deselected by default: to block API key usage in your environment, select the Disable API Key Usage checkbox under Administration > Security > General. For more information, see JFrog API Key Deprecation Process. - New Service - JFConfig

We have added a new service to our Self-Managed instances. JFConfig is a service that can be used by other JFrog services to store configuration in a key-value format in DB in a centralized way.

For more information, see Artifactory Product. - Support readOnlyRootFilesystem in Artifactory Containers

Support has been added for readOnlyRootFilesystem in Artifactory containers, which is a Kubernetes security context feature. This feature enhances security by allowing Artifactory to operate in environments where containers are configured with readOnlyRootFilesystem=true. In this configuration, the entire file system of the container is set to read-only, preventing modifications to files or directories. This setting serves as a security measure to protect the application and its data from unauthorized changes.

For more information on how to configure this setting, see Configure readOnlyRootFilesystem in Artifactory Containers. - Enable Logging to STDOUT and STDERR

In the Artifactory Helm charts, container logs are supported through STDOUT and STDERR. This feature can be enabled by setting the feature flag logging.logToStdoutJson=true. When the feature is enabled, container logs will be output in JSON format via console logging, while service logs inside the container will be available only in text format, such as artifactory-service.log.

Feature Enhancements

- Packages and Repositories

- New Machine Learning Layout for Hugging Face Repositories

All new Hugging Face repositories are now created with the new unified Machine Learning layout. Users can also migrate legacy Hugging Face repositories to the new Machine Learning layout on a manual basis. The Hugging Face repositories legacy layout will be deprecated in July 2025 when all repositories with the legacy layout will be automatically upgraded to the Machine Learning layout. For more information, click here.

- Added Support for Chocolatey and PowerShell Clients in Nuget Repositories

Added support for PowerShell (minimum version 1.0.5) to interact with NuGet repositories. Added support for Chocolatey (minimum version 1.2.0) to interact with Nuget repositories.

For more information, see NuGet Repositories.

- Hex Virtual Repositories

Artifactory now supports Hex Virtual Repository. A Hex virtual repository aggregates Hex local and remote repositories, enabling more efficient package management. To learn more, see Hex Repositories.

- Easier Configuration of the NimModel Redirect Download Form

The NimModel redirect download form can now be configured through the User Interface.

- Complete Docker and OCI List Manifest Image Overwrite

When overwriting a list.manifest file with a new one, all previous sub-manifests will be removed, enhancing storage efficiency and reducing the need for manual cleanup. For more information, click here.

- Support Added for the PyPI JSON API in Remote and Virtual Repositories

Artifactory now supports PyPI’s JSON API in remote and virtual repositories.

- Support Added for PyPI JSON API in Local Repositories

Artifactory now supports the PyPI JSON API in local repositories with most attributes. The following attributes (JSON keys) are not supported:

- Deprecated keys (releases, downloads, has_sig, bugtrack_url) as described in PyPI JSON API The following info sub keys: description_content_type, dynamic, license_expression, license_files, maintainer, maintainer_email, project_urls, provides_extra, requires_dist Vulnerabilities key

- Permissions Added for Using Zapping Cache on Remote Repositories

The Zapping Cache action on remote repositories now requires Manage or Delete permissions, either via the UI or API. This change is backward-compatible. For more information on UI changes, click here, and for API changes, click here.

- Repositories can now be assigned to more than one environment

For more information, see Assign Environments to Repositories.

- Added Tags for RPM local repositories

Added support for the Recommends and Suggests dependency tags in the primary.xml metadata of RPM local repositories enhancing package management for clients like dnf and yum by recognizing optional dependencies.

Feature Flag Control: The inclusion of Recommends tags in primary.xml can now be configurable via a feature flag

yum.local.install.recommended.dependencies.enabled.

To learn more, refer to Install RPM Packages Using Yum.

- Added Support for Listing Folder Items in Conan Smart Remote Repositories

- A new setting, List Folder Items, is now available for Conan Smart Remote Repositories. - Enabling the List Remote Artifacts checkbox during repository creation allows folder items to be listed.

- Improved Access for Go Remote Repositories

Go remote repositories now support the ability to access subgroups in GitLab.

- Bearer Authentication for Remote Repositories

Added Bearer Authentication support for remote repositories.

- Properties Tab for RPM Remote Packages

Added functionality to calculate and display the properties of an RPM package after it is downloaded from a remote RPM repository. The package properties are now shown in the Properties tab on the UI.

- RPM Repositories - SHA-256 checksums have been integrated into Local and Virtual repositories

Added SHA-256 checksums to the repomd.xml files of local and virtual repositories. This improvement ensures package integrity verification aligns with remote repositories' security standards.

Local repositories previously do not have SHA-256 checksums in their repomd.xml files, increasing the risk of undetected package tampering or corruption.

Enable SHA-256 for enhanced security in package integrity verification. To enable SHA-256 checksums, update the configuration by setting yum.local.repomd.calculate.sha2.enabled = true

- Improved Performance of the Repository Selection Field in Set-Me-Up

The performance of the repository selection field in Set-Me-Up has been improved by promoting a search-first approach.

- Improvement to Maven Set-Me-Up Placeholders

Maven set-me-up placeholders will now automatically populate.

- Cleanup Policies

- Support for Vagrant and Hex in Cleanup and Archive

Vagrant packages are now supported in Cleanup and Archive. Hex packages are now supported in Cleanup and Archive.

- Support for Alpine and SBT in Cleanup and Archive

Alpine packages are now supported in Cleanup and Archive. SBT packages are now supported in Cleanup and Archive.

- Improved Cleanup Release Bundle V2 Report

The Cleanup Release Bundle V2 report has been improved. For more information, refer to Cleanup Run Report Overview.

- Support for Conda in Cleanup and Archive

Conda packages are now supported in Cleanup and Archive.

- Policy Conditions - Cleanup Packages

- Adding Property-based Policy Condition

Enhanced package-cleanup functionality with the addition of a property-based policy condition. You can now include or exclude specific package versions from cleanup by applying a property-based policy condition. This allows for more granular control over which packages are retained or removed during cleanup actions. For more information, see Create Cleanup Policy - Package.

- Adding days/weeks selection for Time-based Policy Condition

Enhanced package-cleanup functionality with the addition of days/weeks selection for Time-based policy condition. You can now configure by specifying Time-based cleanup conditions based on days/weeks for the packages. For more information, see Create Cleanup Policy - Package.

- Federation

- Compile list of inconsistent Federated repositories

A new API enables you to return a list of all Federated repositories in your local Artifactory instance that have a configuration mismatch with one or more remote members. After getting the list of mismatches, you can use the Synchronize Federated Member Configuration REST API on each mismatch to synchronize the members. For more information, see Get List of Inconsistent Federated Repositories API.

- New API for removing Federation members

A new REST API enables you to remove a member from all repository Federations to which it belongs. This can be used, for example, when a site is taken out of commission. This API removes the member on this site from all the Federations in which it was a part. For more information, see Remove Federation Member API.

- Release Lifecycle Management

- Improved Release Lifecycle Management Kanban board

The Release Lifecycle Management kanban board has been redesigned to provide more information at a glance, including clear indications of failed promotions. For more information, see Promote a Release Bundle v2 Version in the Platform UI.

- Auto-creation of Release Bundle v2 versions after build promotion

By default, Artifactory now creates a Release Bundle v2 version automatically when you promote a build using the JFrog CLI or REST API. It also promotes the Release Bundle to the environment associated with the build's target repository, if defined. Both copy promotions and move promotions are supported. Having a Release Bundle provides better visibility and control over your release candidate as it progresses through your SDLC.

- Creating project-specific environments during build promotion

When promoting a build, if the target repository (targetRepo) is part of a project, a project-specific environment is created for the auto-created Release Bundle v2. The environment is named after the status value of the build.

- Giving build status priority over an existing target environment during build promotion

If the status is defined for a build, the environment represented by that status is always given priority during promotion. For example, if an environment assigned to the targetRepo matches the status, the auto-created Release Bundle v2 is promoted to that environment. (That is, it is given priority over other environments that might also be assigned to the targetRepo.) If no environment exists for the status, a new environment is created for the promoted Release Bundle v2 with the name of the status, even when other environments are available.

- Searching for distributed Release Bundle versions containing a specific artifact

The Get Release Bundle v2 Versions by Artifact REST API (introduced in 7.107.1) has a new query parameter has a new query parameter that can return distributed Release Bundle versions (origin=target) containing the artifact in addition to created Release Bundle versions (origin=source). This new query parameter makes it possible to run the API on Edge nodes in addition to standard Artifactory instances.

- Moving artifacts during Release Bundle v2 promotion

When promoting a Release Bundle v2 version, you can optionally move the contents of the Release Bundle from the source to the destination instead of copying them (the behavior until now). For example, if you promote a Release Bundle v2 version from the DEV environment to the QA environment and select the Move option, the artifacts are removed from the repositories associated with DEV and moved to the repositories associated with QA. The option to move artifacts can be executed using the JFrog CLI, API, or platform UI.

- Release Bundle v2 version creation using artifacts in virtual repositories

You can now create a Release Bundle v2 version using artifacts located in a virtual repository, provided the source path of the artifacts points to a local repository (not a remote repository) aggregated by the virtual repository. This feature is relevant when creating a Release Bundle version from a list of artifacts.

- Support for SemVer sorting in Release Bundle v2 APIs

SemVer sorting support has been added to the Get Release Bundle v2 Versions API and Get Release Bundle v2 Versions in a Specific Environment API. This support is limited to the 1000 latest records and does not support pagination. This option pulls the latest 1000 records only and does not support pagination. Versions that do not conform to SemVer rules are sorted afterward lexicographically.

- New API for returning all Release Bundle v2 versions containing a specified artifact

A new REST API endpoint is available that returns a list of Release Bundle v2 versions containing a specified artifact. The origin query parameter enables you to distinguish between versions created on a device (origin=source) as opposed to versions distributed to a device (origin=target). This enables you to run this API on Edge nodes in addition to standard Artifactory instances. For more information, see Get Release Bundle v2 Versions by Artifact API.

- New API for returning all Release Bundle v2 promotions containing a specified artifact

A new REST API endpoint is available that returns a list of promoted Release Bundle v2 versions containing a specified artifact. For more information, see Get Release Bundle v2 Version Promotions with a Specific Artifact API.

- New API for returning all Release Bundle v2 versions in a specified environment

A new REST API endpoint is available that returns all Release Bundle v2 versions associated with a specified environment, for example, DEV or PROD. For more information, see Get Release Bundle v2 Versions in a Specific Environment API.

- New API for adding tags to Release Bundle v2 versions

You can now add a descriptive tag to a Release Bundle v2 version via REST API to help identify Release Bundle versions quickly. The tag will appear on the stages board in the platform UI to enhance visibility and organization. For example, you can create tags such as nightly-build, release-candidate, bugfix-2025-33124, and so on. For more information, see Assign Tag to Release Bundle v2 Version API.

- Get Release Bundle v2 Versions API returns tag information

The Get Release Bundle v2 Versions REST API now returns the descriptive tag assigned to a Release Bundle version. For more information about tagging, see Assign Tag to Release Bundle v2 Version API.

- Increased limits for Release Bundle v2 names and versions

The maximum length of the name (release_bundle_name), version (release_bundle_version), and creator (created_by) of a Release Bundle v2 has been increased to 255 characters when working with the REST API.

- New promotion icons on RLM Kanban board and timeline

New icons have been introduced to the Release Lifecycle Management stages board and timeline. These icons indicate at a glance what type of Release Bundle promotion was performed (copy artifacts or move artifacts). Hovering over the icon provides a tooltip reminder. For more information, see Promote a Release Bundle v2 Version in the Platform UI.

- Evidence

- Evidence management – support for additional databases and installation types

The Evidence service now supports all databases that Artifactory supports. For the complete list, see Artifactory Database Requirements. In addition, the Evidence service is now enabled by default for all installation types. For more information, see Installing Artifactory.

- Attach external evidence to artifacts in the local part of a virtual repository

You can now attach external evidence to artifacts located in a local repository that is aggregated inside a virtual repository. For more information about attaching external evidence, see Evidence Service.

- Changes to Evidence GraphQL APIs

The repositoryKey and path fields have been deprecated from the Get Evidence API and Search Evidence API, and subject (which contains repositoryKey, path, name, and sha256) has been added.

- Viewing Evidence in the Packages Screen

You can now view a list of the evidence files associated with a specific package version in a selected repository. For more information, see View the Package Evidence Table.

- Enable Evidence for All Installations

Starting from Artifactory version 7.111, Evidence service is available for all installations.

- JFrog Platform

- Performance Improvements with Artifactory Helm Charts bundled with Nginx

A number of performance improvements have been made when using Artifactory Helm Charts bundled with Nginx. These items can be configured in the Helm chart's values.yaml file. The enhancements include:

Improved performance with throughput improvements of up to 59% Increased number of available Nginx workers connections: from 1024 to 8192 (worker_connections 8192) Auto-scaling of the number of workers: based on the number of available CPUs (worker_processes auto) The ability to use keep-alives: for reusing the Nginx > Artifactory connections

- Added Memory Target Trigger to Artifactory Charts using HPA

Custom metrics support for Horizontal Pod Autoscaler (HPA) has been incorporated into the Artifactory Helm chart. With these metrics, you can configure custom auto-scaling behavior for HPA.

For the Artifactory chart, HPA will function only when the replica count is a minimum of 2 (i.e., in High Availability mode). For the Artifactory HA chart, HPA will operate as expected.

For more information, see Add Memory Target Trigger to Artifactory Charts using HPA.

- Improved Project Navigation

The Projects navigation menu now includes UI usability enhancements: it is now located in the sidebar and highlights Projects filtering to clarify context switching between Project and All Projects scope.

- Blocking Blob Uploads If a Digest Does Not Match the Blob’s SHA-256 Checksum

Added a flag to block blob uploads if a provided digest does not match the blob’s SHA-256 checksum. This flag is disabled by default but can be enabled as needed.

- Docker Repository Key Length Limitation on Cloud Platforms

Artifactory cloud customers using the Docker Subdomain method will now receive a warning when creating a repository if their repository key is too long for DNS record creation. This could lead to accessibility issues if DNS is not managed internally. However, exceeding the character count does not prevent creating the repository. For more information, see Docker Limitations in Artifactory.

- Support for Triggering Partial Reindexing of Helm Charts

Added support for triggering partial reindexing of Helm charts, enabling more efficient and targeted index.yaml updates. This improvement reduces processing time and resource usage. For more information, see Helm Charts Partial Re-Indexing .

- Access Token Expiration Email Now Points to the CNAME Domain

The JFrog platform will send users Access token expiration reminder emails which include the CNAME URL instead of the JFrog instance URL.

- SCIM Token Expiry Configuration

The JFrog Platform now supports the creation of SCIM tokens with configurable expiry times. To learn more, see Generate a Scoped Token for SCIM.

- Get Token Last Used Information

The JFrog Platform now supports getting a token’s ‘last used’ timestamp when using Get Tokens and Get Token By ID REST APIs.

- Support for Reading Permissions Scoped Tokens

It is now possible for non-admin users to use the Get User List API, Get a List of Groups API, and Get All Permissions API endpoints using a scoped token. For more information, see Create Scoped Token.

- Maximum placed on bad checksum search responses

Responses to the Bad Checksum Search REST API are now limited to a maximum of 10,000 results.

- Storage

- New Metric for Obtaining Shard Accessibility Status

For Artifactory instances configured to use shards, a new metric (jfsh_shard_accessibility_status_total) has been introduced for obtaining the accessibility status of each shard. The possible values are:

1: a shard is accessible 0: a shard is inaccessible

- -1: a timeout occurred while checking the accessibility status of a shard

For more information, click here.

- New Metric for Counting Binaries Not Cached Due to Their Large Size

A new metric (jfsh_cache_bypass_large_binary_total) has been added for counting binaries that were not cached due to their large size. For more information, click here.

- Supported Worker Features

- New Worker Event: Before Token Expiry

JFrog now supports creating event-driven workers to trigger before a token expires. Learn more

- Alt Response event is now supported. - Alt All Responses event is now supported. - Alt Remote Content event is now supported. - After Download Error event is now supported. - Before Download Request event is now supported. - Before Build Info Save event is now supported.

Resolved Issues