AppTrust Release Notes
Updates about the latest features and enhancements in JFrog AppTrust
15 September, 2026
AppTrust Service [1.104.0]
Features and Enhancements
The following features and enhancements were added in this release:
- Compliance Administration: You can automate enforcement of regulatory and internal security frameworks in AppTrust through a two-stage setup. A platform administrator activates a framework in the Compliance Catalog, enables the mapped rules, and makes the framework available to your organization. A project administrator then selects which applications are in scope and, per application, sets each rule to Warning or Fail at the Production gate. Nothing is enforced until both stages are complete. See AppTrust Compliance.
- Attach Evidence on Application. You can attach signed evidence directly to an application so compliance attestations that apply across releases, such as architectural review and penetration-test results, stay in AppTrust. Use the REST API or CLI to record the evidence, including outcome, who performed the review, and the period it applies, then view it on the application and enforce it in promotion policies. See Add Evidence Document to Application.
- JFrog Traceability GitHub Action: A GitHub Action that records signed JFrog evidence for every pull request merged into a configured target branch. Evidence is keyed by the merge commit SHA and travels with your software through Artifactory and AppTrust. See JFrog Traceability.
Unified Policy [1.85.0]
Features and Enhancements
The following features and enhancements were added in this release:
- Waiver Management Enhancements: You can create policy waivers that apply to additional scopes, including findings, policies, and organization, and configure the waiver request flow per policy. See Request a Waiver.
1 September, 2026
AppTrust Service [1.98.0]
Features and Enhancements
The following features and enhancements were added in this release:
- GitHub PR Merge Evidence: You can attach GitHub pull request merge and approval details to application versions as signed evidence. After you enable the integration for selected lifecycle stages, AppTrust collects this evidence automatically when a promotion to an enabled stage succeeds, without blocking the promotion. You review the evidence on the application version and in the activity log. See GitHub Integration for PR Merge Evidence.
Unified Policy [1.80.0]
Features and Enhancements
The following features and enhancements were added in this release:
- Rule Management UI: You can view, create, edit, and delete rules in the AppTrust Rules UI, including out-of-the-box rules and rules you create from templates. Each rule defines a condition that policies evaluate and enforce when you promote an application version. See Rules.
4 August, 2026
AppTrust Service [1.88.0]
Features and Enhancements
The following features and enhancements were added in this release:
- Path Mapping for App Version Promotion: Ability to define advanced path transformations in the Promote Application Version API request. When a version transitions to a target environment, its internal artifacts can be reorganized without altering the immutable source version definition. See Path Mapping.
- Intelligent Lifecycle Assignment: In application version creation, option to send the version directly to DEV, as long as it passes all evaluations for getting into DEV. See Create an Application Version.
- Application Version Distribution: Ability to distribute an application version to remote targets such as Edge nodes. See Distribute Application Version API.
- Operational Validity (Support Window): Ability to specify how application versions are monitored and supported either by time, by version count, or not at all. See Create an Application.
- Jira Evidence Integration: The Jira Evidence Service provides automated traceability by linking Jira issue statuses and histories to AppTrust application versions. The service triggers, executes, and attaches signed evidence to the application version before gate evaluations occur, ensuring AppTrust can permit or block promotions based on ticket completion. See AppTrust Jira Integration.
- ServiceNow Integration for Change Requests: The ServiceNow integration lets you manage application governance entirely within your existing ServiceNow change request workflows, automatically syncing application definitions and embedding AppTrust compliance evidence into change requests without duplicate data entry. See ServiceNow Integration.
Unified Policy [1.75.0]
Features and Enhancements
The following features and enhancements were added in this release:
- Changed Evidence Data Domain to OneModel: Expanded the structure that allows for custom template creation. Added ability to write Rego on top of releaseables (lead artifacts) instead of all artifacts.
18 June, 2026
Unified Policy [1.62.0]
Features and Enhancements
The following feature was added in this release:
- Template Management UI & Rego Playground. The new template management UI includes the Rego Playground, an AI assisted tool to help you write, test, and debug Rego policies when you create custom templates. The playground includes an interactive code editor with AI code generation, test execution with sample data, examples based on existing templates, and real-time validation with error feedback. For more information, see Templates.
25 May, 2026
AppTrust Service [1.75.0]
Features and Enhancements
The following features and enhancements were added in this release:
- Multi-Value Label Support in Public APIs & CLI. Application labels now support multiple values per key across the AppTrust REST API and CLI.
- AppTrust Blast Radius. When a critical CVE has actually occurred, AppTrust will show the full impact of the occurrence at both the application level and the project level. For more information, see Application Insights: Blast Radius.
- Project Insights. Now you can see a dashboard of insights at the project level, similar to the application-level insights. This includes DORA metrics, top reasons for failure, and blast radius at the project level. See Project Insights.
29 March, 2026
AppTrust Service [1.58.0]
Features and Enhancements
The following features and enhancements were added in this release:
- Promote and Release Permissions. You can configure separate permissions for promoting and releasing application versions. Promote permissions are stage-aware, allowing you to scope them to specific lifecycle stages. For more information, see Set Promote and Release Permissions.
- Application Version Creation Wizard. A new UI wizard guides you through creating an application version.
Unified Policy [1.44.0]
Features and Enhancements
The following enhancement was added in this release:
- Global Lifecycle Policies. You can create lifecycle policies with a global scope that apply across the platform. Global policies can only be applied to global stages and require administrator permissions to manage. In addition, you can define multiple applications or projects in a single lifecycle policy scope, enabling centralized policy management across related scopes.
25 February, 2026
AppTrust Service 1.29.10
Features and Enhancements
The following features and enhancements were added in this release:
- Support for Overwrite Policy in Promotion. This feature determines whether artifacts can be overwritten during promotion. For more information, see Promote an Application Version in the Platform UI.
- Include/Exclude Filters. Filters were added to the Promote Application Version API and CLI to enable inclusion or exclusion of specific repositories.
- Runtime Integration. For each Application Version in AppTrust, you can see a runtime status indicator showing whether it is currently in runtime and its health: Running (Healthy) or Integrity Violation.
- Create Dry Run Version. This feature enables you to simulate the creation of an application version via the API or CLI. AppTrust performs all backend validations — verifying that builds exist, artifacts are accessible, and the version name is valid — and returns the results without persisting the version. This allows you to catch configuration errors before committing a version to the lifecycle.
- Create Draft Version. This feature enables you to create an application version in a draft state, allowing you to rename it and add contents (builds, packages, and artifacts) iteratively before finalizing. When a draft version is promoted, AppTrust automatically locks and signs it to ensure immutability and compliance upon the first promotion to the target stage.
- AppTrust Automation with Terraform. Terraform providers are now available for AppTrust automation. You can define and manage your application lifecycles, version promotions, and governance policies as code using the AppTrust and Unified Policy Terraform providers, bringing DevGovOps to your automation workflows.
Unified Policy 1.32.25
New Feature
The following new feature was added in this release:
- Lifecycle policy waivers. Waivers provide a method of promotion from one stage to another without evaluation of the criteria defined for promotion to succeed. Users can request and cancel waivers, and administrators and policy managers can approve, reject, and revoke waiver requests. In the current release, waivers apply to the stage-gate level in the lifecycle.
Updated 24 days ago
Did this page help you?