This section contains the Release Notes for Artifactory SaaS releases. To view a SaaS release's release notes, select the version from the table of contents under this topic. **Note** Release notes for previous releases that have passed their end-of-life date (18 months after the initial release) can be found in [Artifactory End of Life](doc:artifactory-end-of-life). ## Artifactory 7.161 This section includes all the Artifactory 7.161 releases. ### Artifactory 7.161.13 SaaS Released: 25 July 2026 **Critical Security Notice** This version is designed to fix multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments due to the additional security risks it introduces. **Breaking Change for Remote Terraform Repositories** Due to a breaking change whereby Artifactory hardened controls on external Terraform URLs, remote Terraform repositories may return `External URL is not allowed` errors. If this error appears for a credible URL, an administrator must enable external dependency rewrite for the URL in the remote repository settings. For more information, see [Remote Terraform Repository](/artifactory/docs/terraform-opentofu-and-terraform-backend-repositories#remote-terraform-repository). **CVEs Addressed** | CVE | Component | Severity | Fix Description | | :---------------------------------------------------------------- | :-------- | :------- | :----------------------------------------------------------------------------------------------- | | [CVE-2026-65617](https://www.cve.org/CVERecord?id=CVE-2026-65617) | Packages | High | Designed to prevent unsafe Gems package deserialization that could lead to remote code execution | | [CVE-2026-65925](https://www.cve.org/CVERecord?id=CVE-2026-65925) | Packages | Medium | Designed to validate Cargo sparse index URLs to prevent server-side request forgery | | [CVE-2026-65921](https://www.cve.org/CVERecord?id=CVE-2026-65921) | Builds | High | Designed to prevent build artifact archive paths writing outside intended locations | | [CVE-2026-65922](https://www.cve.org/CVERecord?id=CVE-2026-65922) | General | High | Designed to block unauthorized writes to restricted internal metadata storage locations | | [CVE-2026-65923](https://www.cve.org/CVERecord?id=CVE-2026-65923) | Builds | Medium | Designed to validate Ansible provider URLs to prevent server-side request forgery | | [CVE-2026-66018](https://www.cve.org/CVERecord?id=CVE-2026-66018) | General | Medium | Designed to restrict build environment property access to authorized repository scopes | | [CVE-2026-66014](https://www.cve.org/CVERecord?id=CVE-2026-66014) | General | High | Designed to prevent HA authentication fail-open behavior causing privilege escalation | | [CVE-2026-65924](https://www.cve.org/CVERecord?id=CVE-2026-65924) | Packages | Medium | Designed to validate Terraform external provider URLs to prevent server-side request forgery | ### Artifactory 7.161.5 SaaS Released: 15 July 2026 **Critical Security Notice** This version is designed to fix multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments due to the additional security risks it introduces. **New Features** - **Support for LuaRocks Repositories** Artifactory now supports LuaRocks repositories, enabling you to manage your Lua dependencies across local, remote, and virtual repositories. This enhancement allows you to securely centralize, discover, and resolve all your LuaRocks packages from a single, controlled platform. For more information, see [LuaRocks Repositories](/artifactory/docs/luarocks-repositories). **Feature Enhancements** - **Xet Protocol Alignment for Hugging Face Remote Repositories** Remote Hugging Face repositories have been updated to align with Hugging Face Xet protocol changes for xorb chunk retrieval. When servicing Xet download requests, Artifactory now searches the repository for existing xorb data before fetching from the upstream registry, reducing redundant upstream traffic and improving download efficiency when the same xorb is referenced across multiple model revisions. For more information, see [Enable Xet Protocol for Hugging Face Repositories](/artifactory/docs/hugging-face-repositories#enable-xet-protocol-for-hugging-face-repositories). - **Support for Tuist Swift Remote Repositories** Artifactory now supports Swift remote repositories that connect directly to the Tuist public registry. This enhancement allows you to proxy and cache Tuist registry packages alongside your existing Swift dependencies, improving build reliability and speeding up dependency resolution. For more information, see [Swift Repositories](/artifactory/docs/swift-repositories). - **Flexible Retention Policies with Combined Conditions** You can now apply Time, Property, and Version criteria within a single policy, enabling precise management of your storage lifecycle. This means you can target outdated packages while ensuring the latest versions are always retained, minimizing data loss risk. For more information, see [Cleanup Policies](/administration/docs/cleanup-policies) and [Smart Archiving](/administration/docs/archive#smart-archiving). - **Increased Access Control for Anonymous Users** The JFrog Platform now allows selecting specific granular actions that non-admin users with manage permissions can assign to anonymous users in permission targets in the UI, to enhance security and prevent unauthorized privilege escalation. For more information, see [Allow Anonymous Access](https://docs.jfrog.com/administration/docs/security-configuration#allow-anonymous-access). - **Enhanced Visibility Controls for OIDC Identity Mappings** To strengthen security and improve organizational compliance, you can now restrict project admins from viewing global OIDC identity mappings. Project Administrators will now only view the identity mappings that are directly applicable to their specific, assigned projects. For more information, see [OIDC Settings](https://docs.jfrog.com/administration/docs/security-configuration#oidc-settings). - **Nested JSON Claims Support in OIDC Integrations** The JFrog Platform now supports mapping nested JSON claims directly within your OIDC identity mappings. This enhancement simplifies your authentication configuration by allowing you to map multiple levels of nesting (for example, `custom_claims.department.group`) without needing to flatten the claims manually. For more information, see [Nested JSON Claims](https://docs.jfrog.com/administration/docs/openid-connect-integration#nested-json-claims). - **New Worker events: Artifactory Repositories** JFrog Workers now supports setting Artifactory repository events to trigger workers, allowing automation of repository management, such as enforcing naming convention. For more information, see [Worker Event Types.](https://docs.jfrog.com/administration/docs/worker-event-types) - **Artifactory Access APIs Deprecation** Artifactory User, Groups, Token, and Permissions management REST APIs are being deprecated and replaced with Access REST APIs, which might require changes to your automations. The deprecation date will be announced in JFrog release notes. For more information, see [Deprecated JFrog APIs](https://docs.jfrog.com/integrations/docs/deprecated-jfrog-apis). **CVEs Addressed** | CVE | Component | Severity | Fix Description | | :---------------------------------------------------------------- | :-------- | :------- | :---------------------------------------------------------------------------------------- | | [CVE-2026-65616](https://www.cve.org/CVERecord?id=CVE-2026-65616) | General | High | Designed to strengthen refresh token signature validation to prevent privilege escalation | **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :----------------------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFS-4094 | Federated Repositories | Critical | Fixed a broken authorization service that could permit low‑privileged users to read configuration data. | | RTDEV-92030 | General | High | Fixed a privilege‑escalation vulnerability that could allow a low‑privileged user to obtain elevated permissions. | | RTDEV-89766 | Builds | Medium | Fixed an issue whereby the Platform UI would fail to display the complete history of promoted builds. | | RTDEV-88306 | Repositories | High | Fixed an issue whereby updating a repository's configuration without specifying an environment reset the repository's assigned stage to the default `DEV` instead of preserving the configured value. | | RTDEV-86197 | Repositories | Medium | Fixed an issue whereby repository stages could be assigned to build info and release bundle repositories. | | JA-20925 | Authentication Providers | High | Fixed an issue related to OIDC where GenericOIDC Identity Mappings incorrectly matched OIDC tokens with different claim values when curly-brace-wrapped UUIDs (such as Bitbucket Pipelines) were used. | ## Artifactory 7.160 This section includes all the Artifactory 7.160 releases. ### Artifactory 7.160.0 SaaS Released: 08 July 2026 **Feature Enhancements** - **Option Added to UI to Change Block Download Behavior When Curation is Unavailable** An option has been added to the user interface to change the **Block Download** behavior when Curation is not available, so that it is now possible to allow the continuation of downloading artifacts from remote repositories if Curation is not available. - **Xray Configuration Synchronization for Federated Repositories** When adding a new member to an existing Federated repository, Artifactory now synchronizes Xray configuration from the source repository to the new member, including **Enable Indexing in Xray**. Changes to Xray settings on existing members are not synchronized. For more information, see [Xray Configuration Synchronization](/artifactory/docs/federated-repositories#xray-configuration-synchronization). - **Support for Cryptographic Signing for Nix Repositories** Nix repositories in Artifactory now support cryptographic signing with Ed25519 keys. When you add a signing key to your Nix repository, packages in your private binary cache are signed so Nix clients can verify they came from Artifactory and weren't tampered with. For more information, see [Configure Cryptographic Signing for Nix Binary Caches](/artifactory/docs/nix-repositories#configure-cryptographic-signing-for-nix-binary-caches). - **Xet Support for Local and Virtual Repositories** Xet support in Hugging Face repositories has been expanded to include local and virtual repositories. The Enable xet protocol option in Packages Settings now enables Xet for all local, virtual, and remote Hugging Face repositories in the organization. For more information, see [Enable Xet Protocol for Hugging Face Repositories](/artifactory/docs/hugging-face-repositories#enable-xet-protocol-for-hugging-face-repositories). **Note:** If you enabled Xet for remote repositories prior to this update, Xet is automatically enabled for all local and virtual repositories that use the new Machine Learning layout. - **Support for Evidence in Remote Repositories** You can now attach evidence to artifacts in remote repositories. For more information about evidence, see Evidence Management. - **Ubuntu **`amd64v3`** Architecture Support Added for Debian Repositories** Added support for Ubuntu `amd64v3` architecture variant during the calculation of the coordinates flow for Debian remote repositories, ensuring accurate indexing and caching. **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :----------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-90399 | General | Critical | Fixed an issue whereby, in certain cases, deprecated services could allow a low-privileged user to retrieve artifacts from repositories they were not authorized to access. | | RTDEV-90288 | Federated Repositories | Medium | Fixed an issue whereby disabling **Active Replication** on a smart remote repository did not disable **Event-Based Pull Replication**. | | RTDEV-90068 | Packages | Critical | Fixed an issue whereby Nix remote repositories could not proxy `.nar.zst` NAR files from upstream binary caches, causing 404 errors. | | RTDEV-89960 | Packages | Medium | Fixed an issue whereby, when using VCS smart remote repositories, the downloadTagFile endpoint failed with a PackageNotFound exception error. | | RTDEV-89945 | Packages | Medium | Fixed an issue whereby, a docker pull on a Docker smart remote repository did not update the main Artifactory instance download stats. | | RTDEV-89767 | User Interface | High | Fixed an issue whereby anonymous UI file downloads via the tree browser could be incorrectly redirected to the native UI instead of downloading the file. | | RTDEV-89345 | General | Medium | Fixed an issue whereby the repo-layout regex used to resolve module info on every artifact download was being recompiled from scratch on every request instead of being cached. | | RTDEV-88337 | Storage | Medium | Fixed an issue whereby, project storage quota notification emails were being sent too frequently because Artifactory was ignoring the configured notification period property **artifactory.projects.storage.quota.notification.period**. | | RTDEV-88308 | Packages | Medium | Fixed an issue whereby, the Maven **Set Me Up** snippet was corrupted when Anonymous Access was enabled. | | RTDEV-87580 | Repositories | Medium | Fixed an issue whereby, when global **Anonymous Access** was enabled and an anonymous user had explicit read/download permissions, users downloading artifacts via the Web UI or Native Browser layout received the login page HTML source instead of the actual file payload. | | RTDEV-87361 | Packages | Medium | Fixed an issue whereby an anonymous connection to an upstream repository through a HelmOCI smart remote failed with HTTP 400 when subdomain reverse proxy was enabled. | | RTDEV-85594 | Packages | Medium | Fixed an issue whereby CocoaPods Smart Remote repositories were missing from the Available Repositories list when configuring a virtual repository. | | JA-21766 | Authentication Providers | Medium | Fixed an issue related to AWS IAM role mapping whereby, when trying to assign or update an AWS IAM role for a user who already has awsIamRole custom data, the JFrog Platform returned an error. | | JA-21745 | Projects | Medium | Fixed an issue related to Access whereby, when trying to create new tokens via REST API using Project-scoped Project Admin reference tokens, the JFrog Platform returns a 403 Forbidden error. | | JA-21212 | User Management | High | Fixed an issue related to custom roles where creating two custom global roles with identical suffixes, differing only by a trailing special character, caused unexpected behavior in the JFrog Platform. Under certain circumstances, when opening the details of the second global role, the details of the first role were displayed instead. | | JA-21203 | User Interface | Medium | Fixed an issue related to the GitHub OIDC integration whereby, when selecting a user/group for the first time, in certain circumstances, the JFrog Platform showed an unexpected validation. | ## Artifactory 7.158 This section includes all the Artifactory 7.158 releases. ### Artifactory 7.158.4 SaaS Released: 29 June 2026 **New Features** - **Support for Agent Packages Repositories** Artifactory now supports using the Agent Package Manager (APM) client to publish and install agent primitives in Agent Packages repositories in Artifactory. Agent Packages Repositories provide a governed, private registry for agent configuration, including skills, plugins, prompts, hooks, Model Context Protocol (MCP) servers, instructions, and agents. You can use Agent Packages repositories to distribute resources for harnesses like Claude, Cursor, Codex, and more. For more information, see [Agent Packages Repositories](/artifactory/docs/agent-packages-repositories). **Feature Enhancements** - **Support for User Context in Workers and Webhooks** All Workers and Webhooks events now support including the user who initiated the event in the event payload for increased auditability. - **Cache Revalidation for Debian Component Files in Remote Repositories** Debian remote repositories now support automatic cache revalidation for `Components-{arch}.yml` files in the `dep11` directory. This enhancement ensures that these specific component files stay synchronized with upstream repositories, preventing stale data and hash mismatch errors for clients. **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-86877 | Packages | Medium | Fixed an issue whereby npm package uploads that violated the path-enforcement rule were allowed, resulting in downstream metadata generation failures. | | RTDEV-85614 | User Interface | Medium | Fixed an issue whereby when browsing repository contents in the Artifacts view using a Windows OS, a **Load More** option was displayed to show more of the contents in the repository, but when clicking it the same set of artifacts was displayed instead of loading the next batch of entries. | | JA-21498 | Projects | High | Fixed an issue related to Projects whereby, when deleting a project and attempting to create another project with the same key, the JFrog Platform returned an error. | | JA-21307 | User Interface | Medium | Fixed an issue related to the Access Tokens page in the JFrog Platform UI whereby, under certain circumstances, when sorting access tokens by project key, the JFrog Platform returned a 400 error. | ## Artifactory 7.157 This section includes all the Artifactory 7.157 releases. ### Artifactory 7.157.0 SaaS Released: 16 June 2026 **New Features** - **Markdown View in Artifacts Page** A view option was added for Markdown (.md) files on the Artifacts page. - **New REST API for Deleting Multiple Repositories** A new REST API has been added for deleting multiple repositories. You can indicate which repositories to delete in the body of the request. If a specified repository cannot be deleted, this does not affect the deletion of other repositories specified in the body of the request. For more information, see [Delete Multiple Repositories](https://docs.jfrog.com/artifactory/reference/deleterepositories).
Also, the legacy Delete Repository REST API, which deletes a single repository, has been fixed and now returns JSON instead of plain text in all cases (previously returned JSON only in case of an error). For more information, see [Delete Repository](https://docs.jfrog.com/artifactory/reference/deleterepository). **Feature Enhancements** - **Retention Policy Support for Agent Plugins** [Cleanup](/administration/docs/cleanup-policies#cleanup-supported-packages) and [Smart Archiving](/administration/docs/archive#smart-archiving-supported-packages) policies now support [Agent Plugins](/artifactory/docs/agent-plugins-repositories) packages. - **Support for Opting Out of New SAML Login Redirect Behavior** The JFrog Platform now supports reverting to the previous implementation of SAML login redirect, whereas upon automatic logout, users will be redirected to the SAML login URL. For more information, see [SAML SSO](https://docs.jfrog.com/administration/docs/saml-sso). - **PyPI JSON Version Processing Enhancement** PyPI JSON version processing has been optimized by reducing complexity. **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :-------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-88100 | Packages | Medium | Fixed an issue whereby Linux binary CRAN packages installed from source instead of as pre-compiled binaries when proxied through an Artifactory remote CRAN repository pointing to a Posit Linux Binary URL. | | RTDEV-85657 | Packages | Medium | Fixed an issue whereby the After Download Error (ADE) worker failed to trigger when downloading from a local repository using a Docker client. | ## Artifactory 7.156 This section includes all the Artifactory 7.156 releases. ### Artifactory 7.156.2 SaaS Released: 10 June 2026 **New Features** - **Support for Agent Plugins Repositories** Artifactory now supports Agent Plugins Repositories for secure storage and distribution of agent plugins across harnesses. Agent Plugins repositories in Artifactory provide the following capabilities: - **Secure plugin ZIP storage**: Use local Agent Plugins repositories in Artifactory to securely store plugin ZIP files, index metadata, and serve marketplace files for Claude, Cursor, and Codex. - **Multi-harness plugins**: Package a single plugin for one agent only, or for multiple agents in one plugin ZIP file using the JFrog CLI. - **Native Claude marketplace integration**: Register Artifactory as a plugin marketplace in Claude Code through claude-marketplace.json to download plugins natively. - **Broad client support with JFrog CLI**: Use the JFrog CLI to deploy multi-harness plugin directories and install plugins for supported harnesses. For more information, see [Agent Plugins Repositories](/artifactory/docs/agent-plugins-repositories). **Feature Enhancements** - **Release Bundle v2 Cleanup Policies for Enterprise X Users** Enterprise X users can now run cleanup policies that remove eligible Release Bundle v2 versions. - **Build Search Optimization** The build search operation has been optimized to provide you with faster results in API calls and the platform UI. - **CPU Overhead Performance Improvement** CPU overhead was reduced for large AQL search queries. Complexity was reduced from O(N²×M) to O(N×M). - **High CPU Spikes Eliminated** A per-request regex recompilation that caused CPU spikes during request bursts was eliminated. - **Improved Temporary Memory Allocation** Optimizations were made in temporary memory allocation in the download flow. - **Improvements in NuGet Version Sorting** Optimizations were made in memory consumption of NuGet version sorting. - **All Projects and Set Me Up Views Show Only Relevant Virtual Repositories** The All Projects and Set Me Up views now show only the virtual repositories in projects that you belong to and also global (unassigned) virtual repositories. Virtual repositories from unrelated projects no longer appear in these views. Previously, All Projects and Set Me Up views listed every virtual repository reachable through underlying local and remote repositories, including repositories from projects unrelated to your work. This made the lists long and hard to navigate as the number of projects grew. This change does not affect permissions or your actual access to any repository. **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTDEV-88344 | General | High | Fixed an issue whereby AQL search queries caused significant memory waste under normal download traffic. | | RTDEV-87840 | Evidence | Medium | Fixed an issue whereby invalid Evidence payloads (for example, no signatures for DSSE envelope or unrecognized payload type) returned 500 errors instead of 400. | | RTDEV-87836 | Release Lifecycle Management | High | Fixed an issue whereby Xray failed to scan draft Release Bundle v2 versions. | | RTFS-3508 | Federated Repositories | High | Fixed an issue whereby adding a second or subsequent remote federation member to an existing federated repository failed with a 400 error stating the repository cannot be added to the federation because it is a member of another federation. | | RTDEV-85598 | Packages | Medium | Fixed an issue whereby when modifying the `deb.distribution` property on an existing Debian package within a federated repository to add a new distribution, this resulted in a 0-byte package file on the target instance. | | RTDEV-85592 | Packages | Medium | Fixed an issue whereby a downloaded module **.zip** from a smart remote repository that contained executables could lose Unix file permissions. | | RTDEV-85530 | Packages | Medium | Fixed an issue whereby the Swift reindex process crashed when a repository contained a **.zip** file that wasn't a valid Swift package (i.e., missing a `Package.swift` file), causing the entire reindex to fail instead of simply skipping the non-Swift archive. | | JA-21124 | Authentication Providers | Medium | Fixed an issue related to Access whereby IAM Role Binding did not provide support for the IAM role with path-based prefixes. |
## Artifactory 7.155 This section includes all the Artifactory 7.155 releases. ### Artifactory 7.155.3 SaaS Released: 03 June 2026 **Feature Enhancements** - **Syncing Docker tag download statistics for shared digests** Artifactory can now align Docker and OCI tag download statistics when multiple tags point to the same image digest. Administrators can enable Synchronize download statistics for shared digests in Package Settings. When enabled, pulling by tag or digest updates `Number of downloads`, `Last download date`, and `Last downloaded by` for every tag that shares that digest in the same repository and image name. This applies only to tags that you have permissions to read. This enhancement gives a clearer picture of tag usage without changing how you pull images. For more information, see [Enable Synchronized Download Statistics for Shared Digests](/artifactory/docs/additional-docker-information#enable-synchronized-download-statistics-for-shared-digests). - **Enhanced evidence table** The evidence table for Release Bundle v2 versions now includes evidence associated with the artifacts contained by the Release Bundle, in addition to the evidence associated with the Release Bundle itself. For more information, see [View the Release Bundle Version Evidence Table](/governance/docs/view-the-release-bundle-version-evidence-table). - **Support Added for NuGet v3 repository-signatures in Remote NuGet Repositories** Artifactory now supports `repository-signatures` for remote NuGet v3 repositories when the upstream registry also supports `repository-signatures`. This is applicable only to remote NuGet v3 repositories. - **Support Added for Git Submodules for CocoaPods Packages** Artifactory now supports Git submodules for CocoaPods packages fetched from remote repositories. This is also supported for virtual repositories when the pod is resolved through a remote child repository. **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-87274 | Packages | High | Fixed an issue whereby enabling the settings **Complete list manifest image overwrite** and **Enforce Strict Tag Overwrite** under **Package Settings->Docker, OCI, HelmOCI** was not applied. | | RTDEV-86957 | Packages | Medium | Fixed an issue where connection pool leaks occurred when Artifactory fetched the **Package.swift** release manifest from Swift remote repositories. | | RTDEV-85520 | Packages | Medium | Fixed an issue whereby compound Debian component names (for example, **updates/main**) were not handled correctly when the calculate coordinates API ran on a Debian security remote cache repository, causing virtual repository index calculation to skip resolvable security packages. | | RTDEV-85269 | Release Lifecycle Management | Medium | Fixed an issue whereby the platform UI failed to display the contents of an OCI package version deployed with Docker when navigating from Release Bundle v2 content screen. | | RTDEV-84660 | Repositories | High | Fixed an issue whereby restoring a deleted repository root from the Trash Can incorrectly copied its properties onto the restored root folder and all of its child-folders and items. | | JFUI-21094 | General | Medium | Fixed an issue whereby the SAML default REST API was being called even though it was not configured. | ## Artifactory 7.154 This section includes all the Artifactory 7.154 releases. ### Artifactory 7.154.0 SaaS Released: 24 May 2026 **New Features** - **JFrog Grid: Distributed Collaboration** JFrog Grid automatically syncs Projects and Access controls across multiple sites - distributed teams share one unified workspace. Frog Grid simplifies multisite operations management so you can build and expand your globally-synced platform. For more information, see [JFrog Grid](/administration/docs/jfrog-grid). **Feature Enhancements** - **Reference Attributes Added to Composer’s **`dist`** Metadata for Local Repositories** Artifactory now supports reference attributes in Composer’s `dist` metadata for local repositories. This is useful for identifying dev composer packages and resolving caching issues with clients. **Resolved Issues** | Jira | Component | Severity | Description | | :-------------------------------------------------------------- | :-------------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [RTFACT-31465](https://jfrog.atlassian.net/browse/RTFACT-31465) | Packages | Medium | Fixed an issue whereby it was not possible to publish a new version of a non-public RubyGem to Artifactory due to the YAML document size. | | RTDEV-85528 | Packages | Medium | Fixed an issue whereby deploying a Debian package with a blank architecture property broke indexing for the repository. | | RTDEV-85174 | Repositories | Medium | Fixed an issue whereby a custom HTTP header was getting dropped for remote repositories. | | RTDEV-84090 | Repositories | Medium | Fixed an issue whereby Go `.mod` files triggered Xray scan status polling when copying remote cache items to a local repo that has "Block Unscanned Artifacts" enabled, even though `.mod` is not a supported Xray extension. | | RTDEV-65069 | Repositories | Low | Fixed an issue whereby a generic remote repository failed to properly follow HTTP 303 redirects from upstream servers when the redirected path ended with a trailing `/`. | | JA-20998 | User Management | High | Fixed an issue related to access whereby, under certain circumstances, when unsharing a resource from certain users or groups, the JFrog Platform returned an error when anyone with permission tried to access the resource. | | JA-20120 | User Management | Low | Fixed an issue where, when Disable Internal Password Login was enabled globally, administrators could not set or update a local user's password from the Create/Edit User screens, even for users included in the Internal users allowed to use basic authentication exclusion list. | ## Artifactory 7.153 This section includes all the Artifactory 7.153 releases. ### Artifactory 7.153.2 SaaS Released: 18 May 2026 **Metadata Retrieval Cache Period Changes** As of Artifactory version 7.153.2, NuGet remote repositories that proxy `community.chocolatey.org` have an enforced minimum Metadata Cache Retrieval Period of four hours (14400 seconds). The enforced minimum aligns with Chocolatey configuration recommendations. **Feature Enhancements** - **Improved PyPI Simple JSON Processing Time** The response times for `api/pypi/simple` were reduced on PyPI remote repositories by caching the translated package and repository indexes. **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-85727 | Packages | Medium | Fixed an issue whereby when the setting Complete list manifest image overwrite was enabled, when an OCI image tag was overwritten by pushing a new build with the same tag, the old sha256 manifests and layers from previous builds were not deleted. | | RTDEV-85481 | Builds | Medium | Fixed an issue whereby builds with `/` in the name caused UI failures when appended to aggregate builds. | | RTDEV-85479 | Federated Repositories | High | Fixed an issue that prevented evidence for artifacts in Federated repositories from appearing in the platform UI. | | RTDEV-84352 | Release Lifecycle Management | Medium | Fixed an issue whereby Move promotions appeared as Copy promotions in the platform UI of other Federation members. | | RTDEV-83999 | Repositories | High | Fixed an issue whereby users had limited access to repositories in a default project when using group-scoped access tokens for authorization. | | RTDEV-83615 | Authentication Providers | Medium | Fixed an issue whereby when a user tried to download an artifact through the user interface, the user was redirected to the SAML login page and then was logged out of Artifactory. | | RTDEV-77096 | General | Medium | Fixed an issue whereby a project admin with Manage Resources permissions could not manage Xray indexed resources using the User Interface. | | RTDEV-71186 | Builds | Medium | Fixed an issue whereby when a single build published multiple artifacts that shared the same hash sum but were located in different paths, the Build Info UI incorrectly deduplicated these artifacts and displayed only one entry. | | JR-10461 | Evidence | Medium | Fixed an issue that caused evidence created without a `provider-Id` to be assigned JFrog as the `provider-Id` after promotion, distribution, or federation. After the fix, evidence created without a defined provider will remain without a `provider-Id` throughout the lifecycle of that evidence. | ## Artifactory 7.152 This section includes all the Artifactory 7.152 releases. ### Artifactory 7.152.1 SaaS Released: 14 May 2026 **New Features** - **Migration Tool for NuGet repository normalization** The Migration Tool is now available in Artifactory Settings to migrate existing repositories to new normalization standards. As of this release, you can use the Migration Tool to migrate NuGet local, remote, and smart remote repositories. Each migration runs a dry run first and produces a report of compliant and non-compliant packages. You can optionally fix non-compliant packages before migration, and specify where to move remaining non-compliant packages. After migration, all packages left in the repository will be compliant with new artifact and package naming conventions, and `PackageBaseAddress` will be enabled. For more information, see [Migration Tool](/artifactory/docs/migration-tool). **Feature Enhancements** - **Enhanced Metadata Support for PyPi Simple JSON API** Support has been added for several metadata fields in the PyPI Simple JSON API: - `description_content_type` - `dynamic` - `license_expression` - `license_files` - `maintainer` - `maintainer_email` - `project_urls` - `provides_extra` - `requires_dist` - **Cleanup Policies Performance Improvements for Conan Repositories** Cleanup policy performance has been improved to handle duplicate Conan packages without stopping the cleanup run. Duplicate Conan packages are now handled properly so cleanup runs can complete successfully. This enhancement improves reliability for cleanup policies that run on Conan repositories. - **Enhanced Package Details for Skills** When viewing package details for items in Skills repositories, the `SKILL.md` file contents now appear in the Packages view. - **Conflict resolution during Release Bundle v2 creation** A new query parameter, `conflict_resolution`, has been added to the REST APIs for creating and updating Release Bundle v2 versions. Use this query parameter to resolve collisions between source artifacts with the same checksum. Two options are available: - `automatic` (default): Resolves collisions using the most recent artifact (taking its properties and evidence). - `manual`: Generates an error when a collision is detected. If `fail_fast=true` (default), the error occurs immediately. If `fail_fast=false`, the error is generated only after all collisions are detected. This was the general system behavior before `conflict_resolution` was introduced. - **Minimum Metadata Retrieval Cache Period Set for NuGet Remote Repositories Pointing to chocolatey.org** A four hour minimum has been set as the minimum metadata retrieval cache period for NuGet remote repositories that point to chocolatey.org. **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTDEV-83969 | Release Lifecycle Management | High | Fixed an issue that blocked federation events when the same Release Bundle v2 version was promoted independently on multiple federated sites. | | RTDEV-82645 | General | Medium | Fixed an issue whereby project storage quota notification emails were incorrectly sent to an internal hardcoded address instead of to the actual platform administrators. | | JR-10461 | Evidence | Medium | Fixed an issue that caused evidence created without a `provider-Id` to be assigned JFrog as the `provider-Id` after promotion, distribution, or federation. | | JA-20646 | User Management | Critical | Fixed an issue related to Access whereby when editing the anonymous user page in the JFrog Platform UI, under certain circumstances, anonymous users were removed from groups not as expected. | | JA-20644 | Authentication Providers | Critical | Fixed an issue related to SAML SSO whereby, in environments where the JFrog Platform custom CNAME was different from the custom base URL, when trying to perform SAML SSO login, the JFrog Platform returned a 401 error. | | JA-20364 | Projects | Medium | Fixed an issue related to projects whereby, it was possible to assign Platform Admins the Project Admin role via REST API and not via the UI. | | JA-20046 | General | Medium | Fixed an issue related to Stages whereby, under certain circumstances, a misconfigured race condition caused the JFrog Platform to return 500 errors. | | JA-19636 | Projects | Medium | Fixed an issue related to projects whereby, under certain circumstances, when creating a project stages, the JFrog Platform created the environment with an incorrect prefix. | ## Artifactory 7.151 This section includes all the Artifactory 7.151 releases. ### Artifactory 7.151.0 SaaS Released: 04 May 2026 **Feature Enhancements** - **New Artifacts Search Experience** The Artifacts page has been redesigned with enhanced search capabilities, making it easier to find items in Artifactory. Key enhancements include: - **Fuzzy, exact match, and wildcard search**: Search by partial or full item names, get recommended searches, and choose whether to search for exact matches only. - **Use keywords to scope your search**: Search inside a specific repository or folder, or search by exact checksum. - **See recent searches**: Recent searches are saved in the search bar so you can pick up where you left off. For more information, see [Search for Artifacts (SaaS)](/artifactory/docs/search-for-artifacts) and the JFrog Academy course [JFrog Artifactory Search Best Practices](https://academy.jfrog.com/jfrog-artifactory-search-best-practices). - **Scoped Token Authentication for AI Editor Extensions Repositories** Artifactory Set Me Up now generates a scoped reference token for connecting your IDE to an AI Editor Extensions remote repository. You can copy a `serviceUrl` snippet from Set Me Up with the token embedded for manual configuration. - **Detailed messages for skipped packages in smart archive run reports** Archive run reports now provide descriptive messages that explain why a particular package was skipped, as described below. The following messages have been added: | Scenario | Report Message | | :---------------------------------------------------------------------------------------- | :------------------------------------------------ | | Package modified since last archive (checksum mismatch, artifact count change, and so on) | Package at source modified since last archive | | Package was previously restored from cold storage | Package was restored at 2026-04-28 10:30:00 +0000 | These new messages enable operators who review archive run reports to understand immediately why a package was skipped without digging through Artifactory logs. In addition, the message for restored packages includes the exact UTC timestamp of the restore, making it easier to correlate them with restore operations. **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTDEV-84071 | Builds | Low | Fixed an issue that caused build-info processing to fail when it contained artifacts referring to directories instead of files. After the fix, those artifacts are ignored. | | RTDEV-84078 | Builds | Low | Fixed an issue whereby a failed build-info search by artifact returned a 500 error. After the fix, a failed search returns a 400 error. | | RTDEV-83357 | Release Lifecycle Management | High | Fixed an issue whereby duplicate artifact paths in the request body resulted in a 500 error. After the fix, Artifactory will handle the duplication without it resulting in an error. | ## Artifactory 7.149 This section includes all the Artifactory 7.149 releases. ### Artifactory 7.149.1 SaaS Released: 28 April 2026 **Feature Enhancements** - **Metrics Enabled by Default** Metrics collection is now enabled by default for all new SaaS installations. Open metrics play a key role in providing visibility into performance and usage patterns across customer instances, which directly contributes to deeper, more accurate insights, especially when interacting with JFrog Support. {/* _added by Michael RTDEV-61653 _ */} - **Cargo Registries: Unauthenticated **`config.json`** Returns 401 Error When Anonymous Access is Off** For Cargo repositories with Anonymous Access disabled, Artifactory now returns HTTP 401 for unauthenticated requests to the registry `config.json`, so the Cargo client can follow the RFC 3139 flow and retry with credentials instead of receiving a 200 without logging in. Repositories that allow Anonymous Access are unchanged and still serve `config.json` without authentication. {/* _added by Ze'ev RTDEV-66186 _ */} - **Improved npm Indexing Performance** Indexing for npm has been enhanced, after identifying and improving inefficient per-artifact property retrieval during metadata generation. **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFE-5068 | User Interface | Medium | Fixed an issue whereby the Artifactory UI tree resolved the wrong path for package types with !-encoded path segments or with path segments that contained a period. | | RTDEV-83240 | Builds | High | Fixed an issue whereby a Build Cleanup Policy failed to delete builds if the build name contained spaces. | | RTDEV-82339 | Packages | High | Fixed an issue whereby Artifactory could not resolve Go modules with a major version (v2 and later) from a virtual repository with a remote link to GitHub. | | RTDEV-82119 | Packages | Medium | Fixed an issue whereby a smart remote npm Repository failed to resolve GitHub packages. | | RTDEV-80563 | Release Lifecycle Management | Critical | Fixed an issue whereby concurrent RBv2 promotions of the same artifact to the same target repository caused an HTTP 500 error. After the fix, concurrent promotions that include the same artifact complete successfully without error. | | JFUI-20497 | User Interface | High | Fixed an issue whereby users could not review Xray logs via the JFrog platform UI. | | JFUI-20056 | Platform Management | High | Fixed an issue related to the JFrog Platform UI whereby users with the platform auditor role were unable to view Xray scan results | ## Artifactory 7.148 This section includes all the Artifactory 7.148 releases. ### Artifactory 7.148.0 SaaS Released: 19 April 2026 **Feature Enhancements** - **Added negative caching for PyPI local repositories** A negative cache has been added for PyPI simple-index lookups on local repositories. Repeated requests for non-existent package indexes now skip the database query, significantly reducing database load under high miss traffic. **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :-------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-82854 | Packages | High | Fixed an issue whereby npm version metadata signatures were stripped from the response after the package tarball was cached, causing installation failures during signature verification. | | RTDEV-82256 | Packages | Medium | Fixed an issue whereby Go submodule zip downloads could be repacked from the wrong directory when the submodule name matched multiple folder paths in the source archive. | | RTDEV-80825 | General | Medium | Fixed an issue whereby when a user did not have permission to view a folder in a remote repository (for both smart-remote and regular remote), that user was able to view it in the user interface. | | RTDEV-80481 | General | Medium | Fixed an issue whereby when attempting to perform deployment by checksum for a generic artifact and providing the sha256 in the headers, the user received the message _Client did not publish a checksum value_. | ## Artifactory 7.147 This section includes all the Artifactory 7.147 releases. ### Artifactory 7.147.1 SaaS Released: 13 April 2026 **Feature Enhancements** - **Define stages in Retention policies** You can now limit the scope of Retention policies (Cleanup policies for packages and Smart Archiving policies) to specific lifecycle stages. For example, you can define a Cleanup policy that removes all Docker images more than 2 weeks old from the DEV stage only. Docker images at other stages, such as QA, would be left undisturbed. This new capability makes it possible to tailor your Retention policies to the requirements of each phase of your software development lifecycle. - **Define path patterns in Retention policies** You can now refine the scope of package cleanup policies and Smart Archive policies by optionally defining one or more path patterns (as an addition to the mandatory repository patterns). The use of a wildcard at the beginning or end of each path pattern is supported. - **PyPI Curation Performance Improvements** PyPI Curation Service performance has been improved by implementing an internal caching mechanism for package index responses. This significantly reduces latency and improves build speeds for curated PyPI repositories. **Resolved Issues** | Jira | Component | Severity | Description | | :-------------------------------------------------------------- | :-------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [RTFACT-31147](https://jfrog.atlassian.net/browse/RTFACT-31147) | Packages | Medium | Fixed an issue whereby smart remote PyPI repository requests used an unexpected cache path. | | RTDEV-82040 | Packages | High | Fixed an issue whereby, after zapping the NuGet metadata cache, a race condition occurred when curation was enabled with Scan from Cache (On-Demand). This caused Artifactory to call Xray with an empty `DownloadURL`, resulting in 400 errors and blocked downloads. | | RTDEV-81817 | Packages | Medium | Fixed an issue whereby a 401 response was received when using Hugging Face smart remote repositories with the XET protocol enabled. | | RTDEV-81767 | Packages | Medium | Fixed an issue whereby Go builds failed with a checksum mismatch error when fetching modules from Bitbucket Cloud using tags that contain slashes. | ## Artifactory 7.146 This section includes all the Artifactory 7.146 releases. ### Artifactory 7.146.0 SaaS Released: 7 April 2026 **Feature Enhancements** - **Batch deletion in Skills repositories** For Artifactory instances with AI Catalog and semantic scanning enabled in Skills repositories, a new batch deletion feature deletes blocked skills every 30 minutes. - **Support for Resource Management Granularity in Projects** The JFrog Platform now supports additional granularity when setting project admin privileges: it is now possible to assign create/update or delete permissions for remote, local, and Virtual repositories separately. - **Support for Red Hat Ansible Automation Hub** Ansible remote repositories now support proxying Red Hat Ansible Automation Hub. This enhancement lets you cache and serve certified and validated Ansible content collections from Automation Hub through Artifactory, while applying your own access controls and governance policies. For more information about this capability, see [Proxying Red Hat Ansible Automation Hub](/artifactory/docs/ansible-repositories#proxying-red-hat-ansible-automation-hub). - **Support Added for Custom HTTP Headers in Remote Repositories** Custom HTTP headers can now be configured for all remote repositories directly through Artifactory, without requiring external proxy workarounds. For more information, see [Remote Repository JSON Configuration](https://docs.jfrog.com/integrations/docs/configuration-json-files#remote-repository-1) and [Repositories Configurations in Artifactory YAML](https://docs.jfrog.com/installation/docs/repositories-configurations-in-artifactory-yaml). {/* Added by Ze'ev, per Gal's request as part of RTDEV-71304 */} - **Support Added for Smart Remote Repositories over JFrog Bridge Connections** Smart remote repositories are now fully supported over JFrog Bridge connections in hybrid environments. Smart remote repository detection occurs when the upstream repository is accessed via a bridge connection, and properties are properly synced when downloading artifacts through a Smart Remote repository over a bridge. {/* Added by Ze'ev, RTDEV-71727 */} - **Artifactory Edge APIs now support Release Bundle v2** The following REST APIs, which were developed for Release Bundle v1, can now be used to retrieve information about Release Bundle v2 (RBv2) versions as well: - `GET /api/release/bundles?type=target` - `GET /api/release/bundles/{name}?type=target` - `GET /api/release/bundles/{name}/{version}?type=target&format={format}` - `GET /api/release/bundles/{name}/{version}/status?type=target` - `GET /api/release/bundles/{name}/{version}/artifacts` - `DELETE /api/release/bundles/{name}/{version} ` This feature enhancement is intended for users who have existing CI/CD processes that include calls to these endpoints and who now require RBv2 support. Users who do not already use these endpoints should use the standard RBv2 endpoints, as described in the Release Lifecycle Management API reference. - **Improved Indexing Process for Opkg Repositories** The indexing process for Opkg repositories has been improved such that a full reindex no longer occurs when adding or deleting packages to/from an Opkg repository, and only the affected package entries are added to or removed from the Opkg index file when adding or deleting a package. {/* Added by Ze'ev, RTDEV-60333 */} - **Upgrade to Apache Tomcat 11.0.x** The Apache Tomcat version bundled with Artifactory has been upgraded to version 11.0. {/* Added by Ze'ev, RTDEV-81301 */} **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :-------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTDEV-81215 | Packages | Medium | Fixed an issue whereby when a Debian virtual repository included both a local repo with a "main" component and a debian-security remote, packages from the remote were silently excluded from the merged index due to unsupported compound component names (e.g., updates/main) in the remote's Release file. | | RTDEV-81105 | Storage | High | Fixed an issue whereby deleting a folder from a repository incorrectly cleared unrelated items from the trash can if they shared a parent path. | | RTDEV-78662 | Repositories | Medium | Fixed an issue whereby remote repository operations could time out or fail due to DNS resolution when following redirects from the upstream server. | | RTDEV-66255 | General | Medium | Fixed an issue whereby objects used by the RubyGems package implementation did not release their memory allocation, leading to potential Out of Memory (OOM) errors. | | RTFE-4905 | General | Low | Fixed an issue that prevented access to the patterns in Tour and Trial environments that describe basic Release Lifecycle Management workflows. | | JA-20273 | User Management | High | Fixed an issue with Access Federation where enabling `allow-partial-entity-sync` could cause permanent permission and user group divergence during full broadcast (syncBaseline) operations. | ## Artifactory 7.144 This section includes all the Artifactory 7.144 releases. ### Artifactory 7.144.2 SaaS Released: 31 March 2026 **Update to Metadata Cache Retrieval Period** On 5 May 2026, a minimum Metadata Retrieval Cache Period of 30 seconds will be enforced for remote repositories in Artifactory SaaS. This change will provide resource optimization and performance improvements. To take proactive action ahead of this enforcement, update remote repositories with a Metadata Retrieval Cache Period below the minimum to a value of 30 or over. The 30 second minimum does not apply to smart remote repositories, and they can continue to have a value lower than 30. For more information, see [Cache Settings for Remote Repositories](/artifactory/docs/remote-repositories#cache-settings-for-remote-repositories). **New Features** - **Skills Local Repositories** Skills repositories are now available in Artifactory as an open beta. You can use Skills repositories as a private skill registry for AI agent capabilities, allowing you to publish, discover, and install skills from one controlled place. Skills repositories offer full integration with JFrog CLI (`jf skills`) v2.98.0 or newer, and a ClawHub v1–compatible REST API for seamless and secure publish and resolve flows. For Artifactory instances with JFrog AI Catalog, you can optionally enable semantic scanning to help catch malicious skills before distribution, adding a supply-chain gate to your AI skill lifecycle. For more information, see [Skills Repositories](/artifactory/docs/skills-repositories). **Feature Enhancements** - **Build Content Displayed in Platform UI** The platform UI now contains a Content tab that provides a list of all the packages and standalone artifacts (known collectively as releasables) included in the build. For more information, see View Build Number Information. - **Strict Tag Overwrite Enforcement Configuration** Docker, OCI, and Helm OCI repositories now have a **Enforce Strict Tag Overwrite** configuration setting. When enabled, this configuration requires explicit Delete/Overwrite permissions when pushing images with an existing name and tag. This enforcement prevents multiple manifest types under the same tag, maintaining stricter registry integrity. - **Enhanced Hugging Face Compatibility for Xet 1.3.0 Clients** Added support for the `/v1/` CAS API path prefix to ensure compatibility with `hf_xet` client version 1.3.0. This update enables successful file reconstruction and xorb chunk retrieval by correctly processing versioned endpoint paths. - **Evidence attachments** You can now attach a single, unstructured file — such as a PDF — during the evidence creation process. This feature provides a tamper-proof, signed container for both your structured evidence and unstructured data, ensuring a complete end-to-end audit trail. For more information, see Add an Attachment to Evidence. - **Evidence distribution for Release Bundle v2 versions** JFrog Distribution and Artifactory now support the optional distribution of evidence attached to Release Bundle v2 versions (including package and artifact evidence), allowing security and compliance metadata to be delivered directly to Edge nodes. This ensures that every artifact reaches its destination with a complete, verifiable record of its quality and security posture. This feature completes the "chain of trust" by enabling the relevant users at the Edge to verify signatures, test reports, and compliance data before consumption. **Important** The ability to distribute evidence requires the enhanced distribution engine (introduced in JFrog Distribution [release 2.28.1](/releases/docs/distribution-release-notes#distribution-2281) ). You must also enable the configuration parameter `evidence-distribution-enable`. **Resolved Issues** | Jira | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFE-4889 | Repositories | Low | Fixed an issue whereby, when creating a smart remote repository with an incorrect URL format, the error message displayed in the UI presented an option to fix the URL with the correct format, but it was actually not the correct URL path. | | RTDEV-81145 | Release Lifecycle Management | High | Fixed an issue whereby Release Bundle v2 versions created from a build, including its dependencies, could result in the platform UI linking to an invalid URL for a particular dependency artifact. | | RTDEV-81046 | Repositories | Medium | Fixed an issue whereby pushing Docker images through a virtual repository returned a `403 Forbidden` instead of a `404 Not Found` during tag existence checks if the user lacked read permissions on some aggregated repositories. | | RTDEV-80918 | Packages | Medium | Fixed an issue whereby pulling Docker images from `registry.navops.io` failed due to a URL parsing error. | | RTDEV-80569 | Repositories | Medium | Fixed an issue whereby Artifactory Edge did not send the configured client TLS certificate during Smart Remote repository creation. | | RTDEV-79614 | Packages | Medium | Fixed an issue whereby the header **x-artifactory-curation-request-waiver** was not forwarded when a smart remote repository was pointing to a remote repository. | | RTDEV-79597 | Release Lifecycle Management | Medium | Fixed an issue whereby a draft Release Bundle v2 version update would fail if any of the added sources are invalid. The new behavior in sync mode returns an error but keeps the version status as DRAFT. In async mode, the version status still changes to FAILED. | | RTDEV-79314 | Packages | Low | Fixed an issue whereby when creating a CocoaPods remote repository and the podsCdnUrl field contained a trailing space, outbound requests for CDN resources produced a doubled URL that always returned a 404 error from the upstream. | | RTDEV-74757 | Repositories | Medium | Fixed an issue whereby Maven, Gradle, and SBT artifacts were sometimes duplicated during cleanup policy execution, leading to failed deletion attempts and "node not found" errors. | | RTDEV-73812 | General | High | Fixed an issue whereby CPU usage using AQL tended to increase due to inefficient internal methods. | | JA-19972 | General | Medium | Fixed an issue related to tokens whereby, when using a non-JFrog JWT token as a Bearer token against Artifactory, the JFrog Platform returned a 500 error instead of a 401 error. | | JA-19924 | General | Medium | Fixed an issue related to one-time passwords whereby when trying to use an OTP, it was not displayed in the verification email as expected. | | JA-19910 | General | High | Fixed an issue related to Access whereby, under certain circumstances, a Netty buffer problem caused latency issues in gRPC endpoints. | | JA-19661 | User Management | Low | Fixed an issue related to the JFrog Platform UI whereby, under certain circumstances, when trying to access the User Profile page as an external user, the JFrog Platform returned a Forbidden error. | | JA-20323 | Authentication Providers | Low | Fixed an issue related to SCIM whereby, the SCIM Get Service Provider Configuration endpoint was incorrectly exposed at the pluralized path `/ServiceProviderConfigs`. | ## Artifactory 7.141 This section includes all the Artifactory 7.141 releases. ### Artifactory 7.141.0 SaaS Released: 10 March, 2026 **New Features** - **Add Platform Auditor Role in REST API** The JFrog Platform now supports assigning users the Platform Auditor role via the user management REST API endpoints. For more information, see [Create User](https://docs.jfrog.com/administration/reference/createuser), [Update User](https://docs.jfrog.com/administration/reference/updateuser), and [Get User Details](https://docs.jfrog.com/administration/reference/getuserdetails). **Feature Enhancements** - **Platform UI searches support Release Bundles v2** The global search bar at the top of the platform UI now includes support for Release Bundles v2. A toggle switch makes it easy to choose between searching for Release Bundles v1 and Release Bundles v2 (v2 is the default). This enhancement makes it easy to find any Release Bundle quickly without first navigating to a specific window in the application. For more information, see [Release Bundles Search](https://docs.jfrog.com/artifactory/docs/supported-search-methods#release-bundles-search). - **Improved performance of Release Bundles v2 page** To improve the user experience, the platform UI page for Release Bundles v2 has been optimized, especially when displaying a long list of Release Bundles. - **AQL search results now respect repository include and exclude patterns** AQL search results now respect repository include and exclude patterns for local, remote, and virtual repositories. Items that do not match a repository's patterns are filtered out for non-admin users, so AQL results align with repository access rules and other search methods. For more information, see [Artifactory Query Language](https://docs.jfrog.com/artifactory/docs/artifactory-query-language). - **Cleanup policies can skip promoted artifacts** Package cleanup policies can now skip artifacts that are part of a promoted Release Bundle v2. Such cases are now treated as a warning instead of an error, which enables the cleanup of other packages to proceed smoothly. For more information, see [Work with Cleanup](/administration/docs/cleanup-policies#work-with-cleanup). **Resolved Issues** | Jira Issue | Component | Severity | Description | | :---------- | :----------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFE-4702 | Repositories | Medium | Fixed an issue whereby remote repositories failed to appear during the initial creation of a virtual repository when External Dependency Rewrite is enabled. | | RTDEV-74459 | Packages | Medium | Fixed an issue in which an incorrect README was displayed for an npm package in the Artifactory Packages view. | | RTDEV-73398 | General | Medium | Fixed an issue whereby, when executing a curl command through a remote RPM repository to an empty folder in the upstream, Artifactory returned a 404 error message and an OK message. | | RTDEV-37129 | Repositories | High | Fixed an issue whereby directory requests were not forwarded with their query parameters to the upstream server by generic remote repositories when the propagate query parameter was enabled, and instead returned Artifactory's directory listing. | ## Artifactory 7.139 This section includes all the Artifactory 7.139 releases. ### Artifactory 7.139.1 SaaS Released: 24 February, 2026 **New Features** - **Support for Nix Package Type** You can now use Nix repositories in Artifactory as a high-performance binary cache to ensure fast, reliable, and reproducible builds. This integration allows you to proxy and cache NixOS Search , while also providing a secure platform to host and publish custom internal channels. Artifactory enhances the Nix ecosystem by providing unified access through virtual repositories, and global distribution via federated repositories to synchronize artifacts across locations. Artifactory also provides native metadata calculation to logically group related artifacts, improving discoverability and artifact management without compromising Nix's core content-addressed reproducibility. For more information, see [Nix Repositories](https://docs.jfrog.com/artifactory/docs/nix-repositories). - **NuGet Enforce Layout** This version of Artifactory introduces NuGet Enforce Layout. By enabling NuGet Enforce Layout, you will avoid package duplication and bring Artifactory closer in alignment with the nuget.org registry. NuGet Enforce Layout has three main uses: - It allows access to the PackageBaseAddress service, which speeds up NuGet restore operations. - It normalizes the names of the packages that you deploy based on SemVer, according to the NuGet Normalized Version Numbers convention, supported in NuGet versions 3.4 and above. - It prevents the upload of duplicate versions or several package versions that are identical according to the Normalized Version Numbers rules. For more information, see [NuGet Enforce Layout](https://docs.jfrog.com/artifactory/docs/nuget-repositories#nuget-enforce-layout-enabling-packagebaseaddress-api). **Note** NuGet Enforce Layout is available only if your Artifactory version has the NuGet Package Handler activated. - **API for returning all Release Bundle v2 cleanup policies** A new REST API returns a list of all existing Release Bundle v2 cleanup policies for either a specific project or for the entire system. For more information, see [Get All Cleanup Bundle Policies API.](/administration/reference/getallreleasebundlecleanuppolicies) **Feature Enhancements** - **Xet Protocol in Remote Hugging Face Repositories** Remote Hugging Face repositories now support Xet protocol, providing enhanced download performance and handling files larger than 50 GB. Xet is supported for repositories that use the new Machine Learning layout. Migrate legacy Hugging Face repositories to the new layout to use Xet. For more information, see [Enable Xet Protocol for Hugging Face Repositories](https://docs.jfrog.com/artifactory/docs/hugging-face-repositories#enable-xet-protocol-for-hugging-face-repositories). - **Support for JSON Indexing with PyPI Simple JSON API** Artifactory now supports the PyPI Simple JSON API to provide a modernized alternative to traditional HTML-based package metadata. This opt-in feature enables JSON indexing for PyPI repositories via the Accept header, allowing for faster and more efficient dependency resolution by modern Python package managers. For more information, see [Enable JSON Indexing in PyPI Repositories](https://docs.jfrog.com/artifactory/docs/pypi-repositories#enable-json-indexing-in-pypi-repositories). - **Added a Warning Message When Deleting a SCIM Token** The JFrog Platform now displays a warning message when attempting to delete a SCIM token, as deletion might disconnect authentication provider integrations. - **Updated POM Validation Log Level** Log entries for POM deployment path mismatches have been updated from Error to Warning to better reflect that these issues typically are not caused by system failure. This change reduces noise in monitoring tools while still reporting incorrect POM metadata. - **Cleanup policies available for Enterprise X subscriptions** JFrog [cleanup policies](https://docs.jfrog.com/administration/docs/cleanup-policies) are now available to users with an Enterprise X subscription, in addition to those with Enterprise +. Cleanup removes unnecessary files, applications, and configurations to free up storage and improve system performance. - **Fail-Open Mode for Curation Unavailability** A new system-level configuration allows administrators to control download behavior from remote repositories when Curation is unavailable. By default, Artifactory blocks downloads if Curation cannot be reached (fail-close). With this new configuration, administrators can switch to a fail-open mode that allows downloads to continue, ensuring business continuity during Curation outages. The setting can be managed using the `GET` and `PUT` `/api/curation/interfaceSettings `REST API endpoints. **Resolved Issues** | Jira Issue | Component | Severity | Description | | :-------------------------------------------------------------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTFE-4576 | Builds | High | Fixed an issue that potentially allowed malicious insiders to exploit a stored XSS vulnerability. | | [RTFACT-31423](https://jfrog.atlassian.net/browse/RTFACT-31423) | Packages | Medium | Fixed an issue whereby when an Opkg package was deployed by a user who did not have delete or overwrite permissions, temporary folders were not deleted after indexing. | | RTDEV-77242 | Packages | High | Fixed an issue whereby AI-Editor Extensions asset URLs from the “latest” metadata endpoint were not rewritten via Artifactory. | | RTDEV-76892 | Repositories | Medium | Fixed an issue whereby HEAD requests for Docker manifests failed if the remote registry returned an incorrect or missing content type. | | RTDEV-76067 | General | Medium | Fixed an issue whereby AQL returned an empty array for a valid build domain query for an admin user. | | RTDEV-73816 | Release Lifecycle Management | High | Fixed an issue that potentially allowed malicious insiders to exploit a stored XSS vulnerability. | | JA-19681 | User Management | Medium | Fixed an issue with projects whereby, when generating a project admin token from a project scope via the JFrog Platform UI, the JFrog Platform returned a 401 error. | | JA-19632 | User Management | High | Fixed an issue whereby, when trying to upgrade Artifactory while using LDAP groups, under certain circumstances, the JFrog Platform returned an error. | | JA-19609 | Projects | High | Fixed an issue whereby OIDC Identity Mappings with a defined Project scope incorrectly appended a User scope, causing authentication tokens to bypass Project-level permissions and result in 403 errors. | | JA-19606 | User Management | Medium | Fixed an issue related to LDAP whereby, under certain circumstances, when configuring a SAML setting containing multiple LDAP group settings that reference several LDAP servers, the group synchronization fails to associate groups. | | JA-19319 | General | Medium | Fixed an issue related to Access Federation whereby, under certain circumstances, metrics were not displayed in the JFrog Platform UI as expected. | | JA-18804 | User Management | Medium | Fixed an issue related to Projects whereby, when trying to create an access token for other users as a project admin, the JFrog Platform returned a 403 error not as expected. | | JA-16022 | User Management | High | Fixed an issue whereby, when a user is part of a group with Manage Resources permission, and that group is included in a Permission Target with Manage permissions, the user could only see that specific Permission Target and was unable to see all other permission targets as expected. | ## Artifactory 7.137 This section includes all the Artifactory 7.137 releases. ### Artifactory 7.137.0 SaaS Released: 12 February, 2026 **Intended Change in Artifactory’s Response to Improper Configuration of a Smart Remote Repository** To properly configure a smart remote repository using the [Create Repository API,](https://docs.jfrog.com/artifactory/reference/createrepository) the URL of an Artifactory instance must be used as the URL of the remote repository, and the attribute **contentSynchronisation** must have **enabled = true** in the [Repository Configuration JSON](https://docs.jfrog.com/integrations/docs/configuration-json-files#repository-configuration-json). Currently, if a user wants to create a smart remote repository and enables **contentSynchronisation**, but does not set the URL of an Artifactory instance as the URL of the remote repository, Artifactory responds by creating a regular (not smart) remote repository, sends a 200 success message, and disables **contentSynchronisation**. The user does not receive any indication that the smart remote repository that the user tried to create is actually a regular remote repository or that **contentSynchronisation** is disabled. Starting from May 12, 2026, Artifactory will respond differently to this scenario. Instead of creating a regular remote repository, Artifactory will respond with a 400 error message, and no repository will be created. **Artifactory to Stop Allowing Importing a Backup of Repositories with the -cache Suffix** Artifactory does not allow creating a repository with the **-cache** suffix, because **-cache** is a reserved string that Artifactory uses internally to create a **-cache** repository for every remote repository. However, currently Artifactory allows importing a backup of repositories even if there are repositories in that backup with a **-cache** suffix. Starting from May 12, 2026, Artifactory will no longer allow a backup of repositories if there are repositories in that backup containing the **-cache** suffix. Ensure that by May 12, 2026, you do not have any repositories with the **-cache** suffix to be backed up for the backup to run successfully. **Note:** Renaming existing repositories is not possible. Therefore, if you need to rename a repository because it has the **-cache** suffix, the most efficient way to do this is to create a new repository, copy the contents of the repository with the **-cache** suffix into it, then delete the old repository. **Feature Enhancements** - **Additions to the Artifactory Request Log and Outbound Request Log** The Artifactory Request Log (JSON only) and Outbound Request Log (JSON only) have been extended with two new fields that significantly simplify the analysis of traffic patterns: - **repo:** The name of the repository as it appears in the URL - **repo_type:** The type of the repository (one character). Will be one of the following: - **v:** virtual - **l:** local (also for federated) - **r:** remote - **Improved Maven Indexing Performance** Artifactory performance has been improved by optimizing **database indexes for Postgres DB**. By reducing the database load during file upload and deletion operations, this change ensures better system stability and faster response times for Maven repositories. - **npm Metadata Protection** To avoid potential metadata corruption, Artifactory now blocks writing to the **.npm** directory during copy or move operations to paths in that directory. This limitation prevents source metadata from overwriting the destination's system-generated files, ensuring your npm packages remain correctly indexed after the move. - **npm Attestation Support** This version of Artifactory introduces support for native npm provenance and attestations in remote and virtual repositories. When running npm audit signatures, the output now includes signatures and attestations for supported packages. This enhancement allows you to retrieve build-source metadata directly from upstream registries and ensure package authenticity. For more information, see [Use npm Audit](https://docs.jfrog.com/artifactory/docs/npm-repositories#use-npm-audit). - **Support for Webhook Creation Role** The JFrog Platform now supports a role that allows users who are not platform administrators to create and manage Webhooks. For more information, see [Create and Edit Users](/administration/docs/manage-users-2#create-or-edit-users). **Resolved Issues** | Jira Issue | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFE-4259 | Release Lifecycle Management | Medium | Fixed an issue that prevented users with the correct permissions from creating Release Bundles from the Builds page. | | RTDEV-73811 | Packages | Medium | Fixed an issue whereby when the Docker Access Method was configured as a subdomain, the Set Me Up dialogue for Docker generated an incorrect Docker login URL. | ## Artifactory 7.136 This section includes all the Artifactory 7.136 releases. ### Artifactory 7.136.0 SaaS Released: 02 February, 2026 **Hugging Face Repository Layout Deprecation** As of June 2026, the Hugging Face repository layout will be deprecated. All new local and remote Hugging Face repositories use the new [Machine Learning repository layout](https://docs.jfrog.com/artifactory/docs/machine-learning-repositories#machine-learning-repository-structure) by default. Any older repositories must be migrated before June 2026 to preserve complete functionality. For more information, see [Migrate Legacy Hugging Face Repositories](https://docs.jfrog.com/artifactory/docs/hugging-face-repositories#migrate-legacy-hugging-face-repositories). **Feature Enhancements** - **Improved Helm metadata processing** Helm metadata processing has been improved by eliminating redundant version comparison during repository indexing. This optimization reduces CPU overhead during index.yaml generation and virtual repository rewrites, significantly improving performance and scalability for repositories with a large number of chart versions. - **Improved Pub error handling and status codes** For Pub clients older than version 2.15.0, error handling and status codes have been changed to align with proper authorization behavior. When a user without write permissions tries to download a package from a remote, virtual, or smart remote repository, Artifactory will now return HTTP 403 (Forbidden) instead of 404. - **AQL Limit Applied to the Artifactory Server to Protect the Database Server from Overload** An AQL limit has been applied to the Artifactory Server to protect the Database Server from overload caused by excessive AQL search requests issued by end-users. The AQL limit includes concurrency limits at both global and per-user levels. This ensures that the database server has enough remaining capacity to serve other critical activities, such as upload and download. - **Enhanced UI Support for DNF Client in RPM Packages** This release adds the DNF client option to RPM Set Me Up instructions. While Artifactory has long supported both YUM and DNF clients, the Set Me Up instructions previously only displayed YUM option. Artifactory is prioritizing the DNF client to align with modern RPM-based distributions where DNF is the default package manager. - **Draft Release Bundle v2 versions** You can now use the [Create Release Bundle v2 Version REST API ](https://jfrog.com/help/r/artifactory-rest-apis/create-release-bundle-v2-version)to create an unlocked, mutable draft. Use the new [Update Draft Release Bundle v2 Content REST API](https://jfrog.com/help/r/artifactory-rest-apis/update-draft-release-bundle-v2-content) to add sources—such as artifacts, packages, builds, or bundles—as needed. When the draft is final, use the new [Finalize Draft Release Bundle v2 Version REST API](https://jfrog.com/help/r/artifactory-rest-apis/finalize-draft-release-bundle-v2-version) to lock the bundle and make it immutable. Please note that Evidence cannot be added to a draft Release Bundle version until it is finalized. For more information about draft versions, including other limitations, see [Create a Draft Release Bundle v2 Version](/governance/docs/create-a-draft-release-bundle-v2-version). - **Performance improvements when exporting Release Bundle v2 versions** We are excited to announce significant performance improvements to the export Release Bundle v2 feature. This enhancement provides a more efficient and streamlined experience for users in both self-hosted and SaaS environments. Key improvements include: - Faster processing times: Reduced export times for Release Bundles, allowing for quicker access to essential data. - Optimized resource usage: More efficient utilization of system resources during the export process, leading to enhanced overall performance. - Scalability enhancements: Improved handling of larger datasets, ensuring consistent performance with support for big bundles, allowing users to export extensive Release Bundles without performance degradation. **Resolved Issues** | Jira Issue | Component | Severity | Description | | :---------- | :----------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-73702 | Packages | High | Fixed an issue whereby npm virtual metadata ignored the override base URL for the X-Artifactory-Override-Base-Url header for certain packages. | | RTDEV-71255 | Repositories | Medium | Fixed an issue whereby platform-level and Artifactory-level proxy settings were affecting local repository replication settings. | | RTDEV-63325 | General | Medium | Fixed an issue whereby when attempting to download a file via a URL in the native browser, if Allow Anonymous Access was enabled but authorization was still required, a pop-up appeared requesting a username and password to complete the download instead of an auto-redirect to the SAML login page. | ## Artifactory 7.135 This section includes all the Artifactory 7.135 releases. ### Artifactory 7.135.0 SaaS Released: 27 January, 2026 **Feature Enhancements** - **Improved build module performance in platform UI** To enhance the user experience, the time required to display build modules in the platform UI was significantly decreased. This improvement is most noticeable when loading large builds in the UI. - **Support for Setting Maximum Token Expiration Value** The JFrog Platform now supports setting a maximum value for token expiration for Cloud users, enabling self-service management and increased platform security. - **Webhook Management Scoped Tokens** The JFrog Platform now supports creating scoped tokens, allowing access to manage Webhooks endpoints. For more information, see [Create Scoped Token](https://docs.jfrog.com/administration/reference/createtoken). **Resolved Issues** | Jira Issue | Component | Severity | Description | | :-------------------------------------------------------------- | :------------------ | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFE-4320 | Storage | Medium | Fixed an issue in the repositories storage summary whereby sorting by the number of files, folders, or items gave incorrect results. | | [RTFACT-31392](https://jfrog.atlassian.net/browse/RTFACT-31392) | Repositories | Medium | Fixed an issue with the REST API for checking the status of a repository replication, where it was returning an OK status and updating the 'last completed' details, when in fact there was a mismatch of artifacts and the remote repository URL resulted in a 404 error. | | RTDEV-65623 | Platform Management | Low | Fixed an issue where errors occurred during the backup of a federated repository when there was a binary that was not fully federated. | | RPG-2028 | General | Medium | Fixed an issue related to the JFrog Platform UI whereby, when trying to delete a node in the Monitor Service page while Topology is enabled, the JFrog Platform returned an error. | | JFUI-20068 | User Interface | Medium | Fixed an issue whereby the **Xray Is Unavailable** status messages appeared in the user interface, even though builds were correctly indexed and scanned by Xray. | ## Artifactory 7.134 This section includes all the Artifactory 7.134 releases. ### Artifactory 7.134.0 SaaS Released: 20 January, 2026 **Feature Enhancements** - **Added Support for Project Admin Permissions** The JFrog Platform now supports more granular control over project admin permissions, allowing you to grant project admins **Manage Resources** permissions, but prevent them from creating or managing remote repositories. **Resolved Issues** | Jira Issue | Component | Severity | Description | | :---------- | :------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTDEV-72622 | User Interface | Medium | Fixed an issue whereby repositories of type Build Info were not displayed in the repositories page in the UI. | | RTDEV-70357 | Builds | High | Fixed an issue that prevented Xray from scanning artifacts in builds deployed using the Artifactory Jenkins Plugin (v4.0.8). Builds deployed using the JFrog CLI and the Jenkins JFrog Plugin were not affected by this issue. | | RTDEV-69075 | General | Medium | Fixed an issue whereby when customers upgraded Artifactory HA versions, the error message "Could not authenticate through LDAP server" appeared for some LDAP users, even though those LDAP users were still able to log in and access repositories as usual. | | RTDEV-68641 | Packages | Medium | Fixed an issue whereby the REST API for retrieving a list versions for a RubyGem package ( ` https://artifactory/api/gems//api/v1/versions/` was not updated with the latest version. | | RTDEV-70372 | Packages | High | Fixed an issue whereby an older retention tag time could have been incorrectly used as the modification time for a later parent image, resulting in premature deletion. | | RTDEV-66866 | General | Medium | Fixed an issue whereby a request for a package that was not scanned by Xray, and had Block Unscanned enabled, was taking twice as long as the Block Unscanned Artifacts Timeout before receiving the 403 error. | | JFUI-19766 | User Interface | Medium | Fixed an issue whereby a user assigned the Platform Auditor role was not able to view Distribution historical data. | | JA-8432 | General | Medium | Fixed an issue related to Access Federation whereby, when using the default configuration for timeout which is not used anymore in platform, the JFrog Platform logs unnecessary warnings not as expected. | ## Artifactory 7.133 This section includes all the Artifactory 7.133 releases. ### Artifactory 7.133.2 SaaS Released: 13 January, 2026 **Feature Enhancements** - **Added a Warning Message When Deleting a SCIM Token** The JFrog Platform now displays a warning message when attempting to delete a SCIM token, as deletion might disconnect authentication provider integrations. - **Evidence system enhancements:** - **Cosign v3:** The Evidence system now supports automatic evidence creation using the Sigstore bundle format. This includes compatibility with both the `cosign sign` and `cosign attest` commands with the `new-bundle-format` flag. Support remains in place for in-toto attestations (DSSE) created with the legacy Cosign v2 `attest` command. - **PSS padding:** To simply integration with different systems that produce attestations, the Evidence system now supports secure PSS (Probabilistic Signature Scheme) padding for signatures when creating evidence with the [Create Evidence REST APIs](/governance/docs/create-evidence-using-rest-apis). PKCS#1 v1.5 padding is still supported. - **Base64 URL encoding:** The Evidence system now supports Base64 URL encoding for the DSSE signature. Standard Base64 encoding is still supported. - **Support for .dsc Source Packages in Local Debian Repositories** Local Debian repositories now support Debian source packages. After configuring your sources.list file for source packages, you can deploy the component source package files one by one to your local repository and resolve them as a single package using apt-get source. For more information, see [Connect Debian to Artifactory](https://docs.jfrog.com/artifactory/docs/debian-repositories#connect-debian-to-artifactory). **Resolved Issues** | Jira Issue | Component | Severity | Description | | :---------- | :----------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-70880 | Storage | Medium | Fixed an issue whereby AWS SDK v2 with the KMS client-side failed to decrypt large objects. | | RTDEV-70712 | Packages | Medium | Fixed an issue whereby the Artifactory Maven indexer left indexer files open on the JVM even after they were deleted. | | RTDEV-70121 | Packages | Medium | Fixed an issue whereby Go repositories failed to resolve nested submodules hosted in a monorepo structure on GitHub. | | RTDEV-69867 | General | Medium | Fixed an issue whereby the JFConnect client did not adhere to the custom router port configuration, thus causing Artifactory to fail upon initialization when the custom router port was set. | | RTDEV-65263 | General | Medium | Fixed an issue whereby restoring the root folder of a repository deleted any properties that were set on the root folder. | | RTDEV-64246 | Storage | Low | Fixed an issue whereby binaries pruning was not running when the **rootFoldersNameLength** wasn't set as the default. | | RPG-1994 | General | Medium | Fixed an issue whereby, when using the router metrics REST API endpoint, the JFrog Platform did not include the `content-type` header in the response. | | JA-19208 | Authentication Providers | Medium | Fixed an issue related to the OIDC integration whereby, when setting two identity mappings with the same name, the JFrog Platform returned a 500 error. | | JA-18801 | User Management | Medium | Fixed an issue related to the Administration module on the JFrog Platform UI whereby, when a non-admin user with Manage Resources permissions attempted to access the Permissions page, the JFrog Platform returned an error. | | JA-18797 | User Interface | Medium | Fixed an issue related to LDAP whereby, when trying to set up a repository as an LDAP user, the JFrog Platform returned a Forbidden error. | | JA-18497 | General | Low | Fixed an issue related to logging whereby, after upgrading Artifactory to version 7.117.16 or later, a warning was logged in the Artifactory log file related to **BeforeTokenExpiryWorkerNotifyTask** that was unnecessary. | ## Artifactory 7.132 This section includes all the Artifactory 7.132 releases. ### Artifactory 7.132.1 SaaS Released: 7 January, 2026 **Feature Enhancements** - **URL Auto-Correct Added to Procedure for Creating a Smart Remote Repository** An auto-correct feature was added to the procedure for creating a smart remote repository for certain package types, to ensure that a correct URL is used. For more information, see [Configure a Smart Remote Repository](https://docs.jfrog.com/artifactory/docs/smart-remote-repositories#configure-a-smart-remote-repository). - **Bridge URLs in Remote Repositories** Bridge URLs can now be used in remote repositories without additional configuration. - **Updated Payload Code Sample for "Before Download Request Worker"** The payload code sample for Before Download Request Worker has been updated for backward compatibility and to avoid compilation errors. The redundant `repoPath` object has been removed from the root of the event request, and the `headers` object is now identified as `requestHeaders`. For more information, see [Before Download Request Worker Code Sample](https://docs.jfrog.com/administration/docs/configure-workers-for-custom-flows#before-download-request-worker-code-sample). **Resolved Issues** | Jira Issue | Component | Severity | Description | | :---------- | :----------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-70709 | Packages | High | Fixed an issue whereby Artifactory was downloading an empty **.zip** file to a Go directory in a GitLab project, which resulted in the Go client receiving an empty **.zip** file when requesting a package. | | RTDEV-69778 | General | High | Fixed an issue where it was possible to create a permission with an empty Repositories list. | | RTDEV-69690 | Packages | High | Fixed an issue whereby the download from a Smart Repository was performed using the actual Smart Repository and not the remote repository that it refers to. | | RTDEV-67058 | General | Medium | Fixed an issue whereby the Hex package dependency appeared as ‘null’ for the opentelemetry package. | | JA-18771 | Authentication Providers | High | Fixed an issue related to CI integration with OIDC in the Access service whereby, when using group mapping and dynamic user mapping, the access token was generated without the `applied-permissions/user` scope. | | INST-11384 | Installation | Medium | Fixed an issue whereby the **docker-compose-all.yaml** template did not expose Nginx ports by default. | ## Artifactory 7.131 This section includes all the Artifactory 7.131 releases. ### Artifactory 7.131.0 SaaS Released: 30 December, 2025 **Feature Enhancements** - **Release Bundle v2 creation dry run** You can now use the[ Create Release Bundle v2 Version REST API](/governance/reference/createbundleversion) to perform a dry run, which simulates the creation of the Release Bundle and performs all the necessary validations, but without persistence. For more information, see [Perform a Release Bundle v2 Creation Dry Run](https://docs.jfrog.com/governance/docs/perform-a-release-bundle-v2-creation-dry-run). - **Curation Support Added for PHP Composer Remote Repositories** Artifactory now ensures security compliance for Composer repositories protected by JFrog Curation. If a package is blocked by security policy, Artifactory automatically prevents the Composer client from falling back to external source URLs to download. This feature requires Xray version 3.137.0 or above. - **Logging of Administration Configuration Changes** The JFrog Platform now supports logging of any changes made to the access configuration, such as enabling anonymous access, in the Access [audit trail log](https://docs.jfrog.com/administration/docs/audit-trail-log). **Resolved Issues** | Jira Issue | Component | Severity | Description | | ----------- | ---------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-69828 | Release Lifecycle Management | Low | Fixed an issue that prevented users from using multiple filters to exclude specific packages when patching a Release Bundle. | | RTDEV-69500 | Repositories | Medium | Fixed an issue whereby attempting to delete a non-existing artifact resulted in status code 204 (No Content) rather than 404 (Not Found). | | RTDEV-68382 | Packages | Medium | Fixed an issue in which Docker range uploads returned an incorrect range start offset. | | RTDEV-67140 | Builds | Medium | Fixed an issue that prevented Project Administrators from defining webhooks for build events within their assigned project. | | RTDEV-66745 | Packages | Medium | Fixed an issue whereby Helm layout enforcement was not working on federated Helm repositories. | | RTDEV-65894 | Packages | Medium | Fixed an issue in which a user could retrieve certain metadata files from a Debian virtual repository using the anonymous user, even though the user lacked proper permissions. |
## Artifactory 7.130 This section includes all the Artifactory 7.130 releases. ### Artifactory 7.130.0 SaaS Released: 23 December, 2025 **Feature Enhancements** - **Support for Regex in OIDC Integration Dynamic Mapping** The JFrog Platform OIDC integration now supports dynamic mapping creation using more advanced patterns, which automate and streamline the process for various use cases. For more information, see [Dynamic Mappings](/administration/docs/openid-connect-integration#dynamic-mapping). **Resolved Issues** | Jira Issue | Component | Severity | Description | | ----------- | ---------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-69072 | Federated Repositories | Medium | Fixed an issue whereby it was not possible to remove a disabled federation member. | | RTDEV-68592 | Release Lifecycle Management | Medium | Fixed an issue whereby promotion rollbacks were not displayed correctly in the version timeline. After the fix, the timeline adds an event indicating the rollback succeeded and crosses out the previous event that recorded the promotion. | | RTDEV-68310 | Release Lifecycle Management | Medium | Fixed an issue whereby Release Bundle v2 promotion would sometimes fail due to HTTP 404 errors. | | RTDEV-65879 | General | Medium | Fixed an issue where it was not possible to download a file inside an archive from the UI when the URL contained a period (“.”). | | RTDEV-65239 | Release Lifecycle Management | Medium | Fixed an issue whereby the contents of multi-arch Docker/OCI images were sometimes not displayed in the platform UI. After the fix, the contents are displayed correctly. | | JA-18497 | General | Low | Fixed an issue related to logging whereby, after upgrading Artifactory to version 7.117.16 or later, a warning was logged in the Artifactory log file related to `BeforeTokenExpiryWorkerNotifyTask` that was unnecessary. | ## Artifactory 7.129 This section includes all the Artifactory 7.129 releases. ### Artifactory 7.129.1 SaaS Released: 16 December 2025 **New Features** - **New REST API for preparing evidence for deployment to Artifactory** The new [Prepare Evidence for Signing REST API](https://docs.jfrog.com/governance/reference/prepareevidence) simplifies the evidence creation process for users who do not use the JFrog CLI. The API request contains the [predicate](/governance/docs/evidence-predicate), which is a JSON containing claims about the defined evidence subject (for example, a build or artifact), and can include an optional markdown version. The API returns a payload that conforms to the in-toto attestation standard used by the JFrog platform. After signing the payload, you can deploy the evidence to the JFrog platform using the [Deploy Evidence REST API](https://docs.jfrog.com/governance/reference/deployevidence) . For more information, see [Create Evidence using REST APIs](/governance/docs/create-evidence-using-rest-apis). **Feature Enhancements** - **Significantly Improved Package Details User Interface** The Package Details user interface (UI) has been significantly improved, and now displays valuable information about package versions in a more user-friendly format, including: - When the Package Details view is initially displayed, details on the latest version or tag of the package appear. - Use of native terminology, based on the package context (for example, tags for Docker/OCI packages, versions for other package types). - Quick selection of a package version, allowing you to easily find the version you need. - An All Versions view, allowing quick impact analysis across all versions to see vulnerabilities and where versions are stored. - Multi-client install commands: Installation commands are provided for all officially supported clients in every package type. - More install commands for more package types: The new UI introduces 35 new install commands to help developers use the packages they are looking for. - Context-sensitive Information tabs, displaying important version information according to the package type. For more information, see [The Package Details User Interface](/artifactory/docs/viewing-packages#the-package-details-user-interface). - **Support for Kiro with AI Editor Extension repositories** You can now set up AI Editor Extension Repositories in Artifactory to securely proxy and cache the Kiro extension marketplace, and configure your Kiro IDE to download extensions from the Artifactory cache. For more information, see [Get Started with AI Editor Extensions](https://docs.jfrog.com/artifactory/docs/ai-editor-extension-repositories#get-started-with-ai-editor-extensions). - **JFrog CLI commands for setting up IDEs with AI Editor Extension repositories** The new `jf ide setup` command automates the process of connecting your IDE to an AI Editor Extensions repository in Artifactory. You can run the single command to configure any supported client, instead of manually granting permissions and editing configuration files. For more information, see [Connect your IDE to Artifactory](/artifactory/docs/ai-editor-extension-repositories#connect-your-ide-to-artifactory). - **Improved performance when creating Release Bundles from builds with dependencies** To enhance the user experience, we have implemented significant performance enhancements when creating Release Bundle v2 versions from builds that contain dependencies. - **Include & exclude filters for patching Release Bundle v2 versions** Users can now define include and exclude filters for patching a Release Bundle v2 version via the REST API. These new options provide great flexibility and fine-grained control over the contents of the Release Bundle. For example, you can now patch an existing Release Bundle by replacing a specific package. The new filters also enable you to create a new Release Bundle version that contains a subset of the previous version's content, for example to create a version for a specific architecture. For more information, see [Create Release Bundle v2 Version API](/governance/reference/createBundleVersion). - **New REST APIs for evidence queries** Two new REST APIs are available for performing evidence queries. They are intended for users who prefer traditional REST APIs for integration with their existing automation tools instead of using GraphQL. For more information, see [Search Evidence API](/governance/reference/searchevidence) and [Get Evidence by ID API](/governance/reference/getevidencebyid). - **Evidence GraphQL API for returning evidence by ID** You can now use GraphQL to return the details of a specific evidence item using its ID instead of using its path. For more information, see [Get Evidence by ID GraphQL API](/integrations/docs/get-evidence-graphql). - **Improved the Run reports generated by Retention Policies for packages (Cleanup and Smart Archiving)** The reports now include **Package Path**, **Created Date**, **Modified Date**, and **Last Downloaded Date** columns under **Run Detailed Summary** to facilitate better validation and auditing of deleted or archived packages. For more information, see [Smart Archiving Run Report Overview](/administration/docs/archive#smart-archiving-run-report-overview), [Restore Run Report Overview](/administration/docs/archive#restore-run-report-overview) and [Cleanup Run Report Overview](/administration/docs/cleanup-policies#cleanup-run-report-overview). - **Granular Lifecycle Control - Retention Policies** You can now combine Time-based and Property-based conditions using a logical `AND` in your Cleanup and Smart Archiving policies. This allows for sophisticated rules, such as archiving packages that are "older than 1 year AND tagged as PROD," giving you precise control over your packages in Local and Federated repositories. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | ----------- | ---------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-68303 | Release Lifecycle Management | Low | Fixed an issue that prevented the Content Graph from displaying correct information after promotion rollback is performed. After the fix, the graph displays the results of the rollback accurately. | | RTDEV-67129 | Federated Repositories | Medium | Fixed an issue whereby replication creation or update could fail at runtime with a “value too long for type character varying” error by adding upfront validation that blocks configurations when the combined include/exclude pattern length exceeds the supported database limit. | | RTDEV-66254 | Release Lifecycle Mangement | Medium | Fixed an issue whereby Release Bundle v2 creation failed due to a duplicate key error. This error occurred when a Docker image in the Release Bundle contained both a manifest.json and a list.manifest.json. After the fix, Artifactory can handle the duplicate key correctly and create the Release Bundle. | | RTDEV-66109 | Release Lifecycle Management | Medium | Fixed an issue whereby an attempt to create a Release Bundle v2 version with a non-existing artifact resulted in a 500 status code. After the fix, this type of error will result in the expected 404 error, "Release Bundle source artifact not found". | | RTFE-4040 | Packages | Medium | Fixed an issue whereby SaaS instances using the Sub-Domain method with CNAME showed incorrect Set Me Up instructions for Docker, OCI, and Helm OCI. | | RTDEV-65854 | Packages | Medium | Fixed an issue whereby a RubyGems virtual repository intermittently returned the **versions** file that included only versions from aggregated local repositories because **UnsupportedReentrantLockException** disrupted metadata calculation and caused the remote handler to fail. | | RTDEV-65622 | Packages | Medium | Fixed an issue where Nuget package downloads through a virtual repository could fail when parent and child virtual repositories used different repository layouts. | | RTDEV-64090 | General | Medium | Fixed an issue whereby when an artifact that was marked as filtered was deployed to a repository with password retrieval, the artifact obtained via cURL download contained an encrypted password, whereas the artifact downloaded through the UI did not. | | RTDEV-61860 | Release Lifecycle Management | Medium | Fixed an issue that prevented users from federating Release Bundle v2 repositories when using the Artifactory Federation Service (RTFS). After the fix, these repositories can be federated without incident. | | JA-18797 | User Interface (UI) | Medium | Fixed an issue related to LDAP whereby, when trying to set up a repository as an LDAP user, the JFrog Platform returned a Forbidden error. | | RTDEV-54345 | General | High | Fixed an issue whereby during HA cluster startup, a node which acquired the so-called “HA init lock” in order to perform exclusive init operations crashed, leaving the lock in place and blocking other nodes from starting, thus leaving the entire HA cluster in downtime. | | INST-11555 | Installation | High | Fixed an issue whereby the command to perform a graceful shutdown was not working for **Jfconfig** and **Topology** services in certain negative scenarios, specifically when the Artifactory service hadn't fully started. This meant these services would sometimes remain active despite a stop command. | | EVT-2194 | General | Medium | Fixed an issue related to webhooks whereby, when creating a webhook using a proxy and then editing it to remove the proxy, the JFrog Platform prevented leaving the Proxy field empty. | ## Artifactory 7.128 This section includes all the Artifactory 7.128 releases. ### Artifactory 7.128.0 SaaS Released: 01 December, 2025 **New Features** - **Application metrics now available to SaaS users** Users working in SaaS environments can now receive a wide variety of application-related metrics (based on the Open Metrics standard) using a new REST API. For more information, see [Get Artifactory Application Metrics](/administration/docs/open-metrics). **Feature Enhancements** - **Significant Improvements in the Repositories User Interface** The Repositories user interface has been significantly re-designed, making it much more user-friendly and efficient. When initially opening the Repositories list, there are options to view the 20 most recently viewed repositories and to view inactive repositories. Filtering capability has been added, so that you can now filter the Repositories list according to Repository type, package type, URL (for remote repositories), Project association, stage, and repositories that have a replication (for local and remote repositories). For more information, see [View Repositories](/artifactory/docs/view-repositories). - **Support for **`pnpm`** client with npm repositories** You can now configure the `pnpm` client to connect to npm repositories in Artifactory and use it to manage npm packages. For more information, see [pnpm](/artifactory/docs/npm-repositories#pnpm). - **Support for **`uv`** client with PyPI repositories** You can now configure the `uv` client to connect to PyPI repositories in Artifactory and use it to manage Python packages. For more information, see [uv Client](/artifactory/docs/pypi-repositories#uv-client). - **Support for Yarn Modern with npm repositories** Artifactory now supports natively managing npm packages with Yarn V2+ (Modern). For more information, see [Connect Yarn to Artifactory](/artifactory/docs/npm-repositories#connect-yarn-to-artifactory). - **Audit trail maintained when promoting duplicate Release Bundle artifacts** Previously during Release Bundle v2 promotions, the system skipped artifacts that already existed in the target stage. This behavior prevented the target stage from being updated with evidence associated with those artifacts. This enhancement guarantees that all associated evidence is copied to the target stage, ensuring a complete and verifiable audit trail throughout your SDLC. - **Improved performance of Build Versions page in platform UI** Pagination has been added to the Build Versions page in the platform UI, which makes it faster and more convenient to use when the selected build contains many existing versions. - **Date picker to improve Builds page performance** To improve performance, the Builds page now features a date picker that displays only those builds within a defined timeframe. The default value is the last 7 days. Users can choose a different timeframe as needed. - **New Support for Password Control Via REST API** The JFrog Platform Access service now enables you to expire and un-expire all passwords via REST API. For more information, see [Expire Password for All Users API](/administration/reference/expirePasswordForAllUsers) and [Un-Expire Password for All Users API](/administration/reference/unexpirePasswordForAllUsers). - **Added Support for the Range Header in Download Requests for PyPI Repositories** Artifactory now supports **Range** requests when downloading Python packages from local, remote, and virtual PyPI repositories. This improves compatibility with the UV package manager and prevents redundant full-package downloads, reduces unnecessary download counts, and improves performance. - **Added Support for Proxying the GitHub Enterprise Cloud Private Registry for Go Remote Repositories** Support has been added for proxying the GitHub Enterprise Cloud private registry (``ghe.com) for Go remote repositories. - **Optimized node event deletion performance in Artifactory when using an Oracle Database** Optimized the performance of node event deletion in Artifactory when using an Oracle Database by adding an optional system property to utilize the primary key index. See [Oracle for Artifactory](/installation/docs/configure-artifactory-to-use-oracle) - **User Management - Permissions** Updated the tooltip for the **Include All Builds** checkbox to clarify that selecting this option includes all builds and preserves any defined exclude patterns. - **Optimized Artifactory Database Maintenance Performance with Bulk Insert Refactoring** Optimized Artifactory's shift events operation by refactoring the internal database process to use bulk inserts, significantly reducing database round-trip and improving performance. - **Added Roles Support via REST API** Added support for the Watch manager, Policy manager, reports manager, and resource manager roles in the user and group management REST API. For more information, see [Security](/security/docs/set-user-roles-and-permissions). - **Support for Webhook Target Validation** The JFrog Platform now supports creating a whitelist to allow private domains or IP addresses to be used as Webhook targets without needing to disable Artifactory validation. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :-------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-66665 | Artifactory | Medium | Fixed an issue whereby, event-based push replication configured on a federated repository in the config descriptor could lead to an infinite cyclic event. | | JA-18806 | User Interface | Medium | Fixed an issue related to the JFrog Platform UI whereby, when a user logs in via SAML SSO, the Email Address field in their Profile page appears as empty and uneditable. | | JA-18600 | User Management | High | Fixed an issue related to API key whereby, when upgrading from Artifactory version 7.104.14 to 7.117.17 and attempting to regenerate the API Key via the JFrog Platform UI, the JFrog Platform returned an error. | | JA-18498 | General | Low | Fixed an issue whereby users in view-only mode could click a link that incorrectly opened an OIDC integration/mapping drawer in edit mode, leading to an error when they attempted to save unauthorized changes. | | JA-18318 | Projects | Medium | Fixed an issue related to the JFrog Platform WebUI whereby, when sorting the results in the Project page by storage quota, the JFrog Platform did not perform as expected. | | JA-18290 | User Interface | Medium | Fixed an issue whereby it was not possible to revoke the OIDC exchange Access token created with the Project Roles scope. | | JA-18099 | User Management | Low | Fixed an issue whereby, when using the create or update Groups REST API and providing a string exceeding the maximum length, the JFrog Platform returned an incorrect error message. | | JA-18768 | User Management | Medium | Fixed an issue whereby, when users with Manage Permissions as the permission target navigate to the Administration module, the JFrog Platform returned an error. | | JA-17499 | General | Medium | Fixed an issue related to access tokens whereby, under certain circumstances, the `last_updated` time for a reference token was not updated in the payload as expected. | | INST-15707 | Installation | Low | Fixed an issue related to installing Artifactory using Helm/Docker installation whereby an internal process auto-retries to call a deprecated Artifactory endpoint, leading to egress errors. | | JFUI-19464 | User Interface | Critical | Fixed an issue related to the JFrog Platform UI whereby, when navigating directly to the Administration module and then trying to open the Application module, the JFrog Platform did not function as expected. | ## Artifactory 7.127 This section includes all the Artifactory 7.127 releases. ### Artifactory 7.127.0 SaaS Released: 17 November, 2025 **Feature Enhancements** - **New REST APIs for VCS Remote Repositories to Obtain Data from Subgroup Repositories** New REST APIs have been added for VCS remote repositories to obtain data from subgroup repositories. Four new APIs have been added that allow you to: - [Download a VCS Branch from a Subgroup Repository](/artifactory/reference/downloadVcsBranchFromSubgroupRepository) - [Download a VCS Tag from a Subgroup Repository](/artifactory/reference/downloadVcsTagFromSubgroupRepository) - [Download a File in a VCS Branch in a Subgroup Repository](/artifactory/reference/downloadFileInVcsBranchInSubgroupRepository) - [Download a File in a VCS Tag in a Subgroup Repository](/artifactory/reference/downloadFileInVcsTagInSubgroupRepository) Also, the legacy APIs [Get VCS Tags](/artifactory/reference/getVcsTags) and [Get VCS Branches](/artifactory/reference/getVcsBranches) can be used to obtain VCS tags and branches from subgroup repositories. Currently, branches and tags can be downloaded only in the **tar.gz** format. In this Artifactory version, these APIs can be used to obtain data from the Google Source Git Provider. - **Google Source Git Provider for VCS Remote Repositories** Support has been added in the Artifactory user interface for the Google Source Git Provider for VCS remote repositories. For more information, see [Use VCS To Proxy Git Providers](/artifactory/docs/vcs-repositories#use-vcs-to-proxy-git-providers). - **Improvements in VCS Remote Repositories APIs** The user organization can now be used as the repository for downloading VCS tags, branches, files in a tag, and files in a branch. For more information, see [Download a VCS Tag](/artifactory/reference/downloadVcsTag), [Download a VCS Branch](/artifactory/reference/downloadVcsBranch), [Download File within a VCS Tag](/artifactory/reference/downloadFileWithinVcsTag), and [Download File within a VCS Branch](/artifactory/reference/downloadFileWithinVcsBranch). - **Support for New SCIM REST API Endpoints** The JFrog Platform now supports getting more information about your SCIM configuration and schemas via REST API. For more information, see [Get Resource Types](/administration/reference/getScimResourceTypes), [Get Service Provider Configuration](/administration/reference/getScimServiceProviderConfig), [Get Schemas](/administration/reference/getScimSchemas), and [Get Schema by ID](/administration/reference/getScimSchemaById). - **Support Added for Decompressing .xz and tar.xz Files** Artifactory now supports decompressing **.xz** and **tar.xz** files, similar to the already supported decompression for **.zip**, **.tar**, and **.gz** files. - **RLM promotion rollback from platform UI** To improve the user experience, you can now roll back a Release Bundle v2 version promotion from the platform UI. For more information, see [Promotion Rollback](/governance/docs/promotion-rollback). Please note that the UI icon for deleting a promotion has been removed, as rollback replaces this functionality. - **Improved the Builds page performance** The pagination performance of the Builds page has been improved significantly to enhance the user experience. - **Retention Policies - Package Version Pattern Filtering** Cleanup and Smart Archiving retention policies now support Include and Exclude Package Version Patterns. For more information, see [Cleanup Policies](/administration/docs/cleanup-policies) and [Smart Archiving](/administration/docs/archive#smart-archiving). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-65895 | Packages | High | Fixed an issue whereby a race condition in the Debian indexing code was causing automatic indexing to not occur, which resulted in packages missing from the metadata. | | RTDEV-64461 | General | Medium | Fixed an issue whereby Artifactory was not following the RFC 9110 standard regarding the precedence of the precondition headers **If-None-Match** and **If-Modified-Since**. | | RTDEV-64026 | Packages | Medium | Fixed an issue whereby the npm remote repository with Curation complain version selection enabled would sometimes return the un-curated metadata ETAG header, which caused the npm client to not fetch the curated metadata from the registry even though the metadata was curated and changed. | | RTDEV-61244 | General | Medium | Fixed an issue whereby there was unauthenticated access to a Docker API when anonymous access was disabled. | | RTDEV-59638 | Release Lifecycle Management | Medium | Fixed an issue whereby deleting the last version of a Release Bundle did not remove the empty folder from the Release Bundle repository. | | JA-18099 | User management | Low | Fixed an issue whereby, when using the create or update Groups REST API and providing a string exceeding the maximum length, the JFrog Platform returned an incorrect error message. | ## Artifactory 7.126 This section includes all the Artifactory 7.126 releases. ### Artifactory 7.126.0 SaaS Released: 3 November, 2025 **Feature Enhancements** - **New REST API for deleting the tag from a Release Bundle v2 version** To improve the user experience, you can use a new, dedicated REST API to delete a tag from a Release Bundle v2 version. For more information, see [Delete Release Bundle v2 Version Tag](/governance/reference/deleteBundleTag). - **Query parameter for returning all errors during Release Bundle v2 creation** To help debug issues you may encounter during Release Bundle v2 creation, a new `fail_fast` query parameter has been added to the [REST API](/governance/reference/createBundleVersion). When set to `false`, the API will return validation errors that occur during creation as a group instead of failing after the first error. For more information, see [Release Bundle v2 Creation Errors Collected by System](https://docs.jfrog.com/governance/docs/create-a-release-bundle-v2-using-the-rest-api#release-bundle-v2-creation-errors-collected-by-system). - **Support for Filtering Tokens by Scope via REST API** The JFrog Platform now supports filtering the results of the Get Tokens REST API using the scope parameter to get token results for a specific scope, such as group. For more information, see [Get Tokens](/administration/reference/getTokens). - **Support for Easier Management of OIDC Identity Mappings** The JFrog Platform now supports adding identity mapping claims to OIDC integrations as values in addition to the JSON file format for easier entry. For more information, see [Configure Identity Mappings](/administration/docs/openid-connect-integration#configure-identity-mappings). - **Support for New SCIM REST API Endpoints** The JFrog platform now supports getting more information about your SCIM configuration and schemas via REST API, such as your resource type, service provider configuration, and schema definitions. - **Enhanced Cleanup and Archiving Policy Logic** Cleanup and smart archiving now supports logical AND operators, allowing you to combine time-based and property-based conditions for more granular management. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :----------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-64188 | Packages | Medium | Fixed an issue whereby the displayed download count for Conan packages on the Packages tab did not increase when packages were downloaded, and remained 0. | | RTDEV-63511 | Packages | Low | Fixed an issue whereby the **Downloads** and **Last Downloaded** fields were not updated when converting an existing non-v1 Docker manifest to v1 manifest in a local Docker repository. | | RTDEV-63395 | Repositories | Medium | Fixed an issue whereby when importing a repository to Artifactory, artifact file statistics, such as downloadCount, lastDownloaded, lastDownloadedBy, were not merged for artifacts that already existed in the target instance. | | RTDEV-62756 | Repositories | Low | Fixed an issue whereby the Create Repository REST API allowed adding a repository of any type (local, remote, or virtual) to a virtual repository with a specific package type (not generic), when the added repository was for a package type that did not match the virtual repository’s package type. | | JA-18318 | Projects | Medium | Fixed an issue related to the JFrog Platform WebUI whereby, when sorting the results in the Project page by storage quota, the JFrog Platform did not perform as expected. | ## Artifactory 7.125 This section includes all the Artifactory 7.125 releases. ### Artifactory 7.125.3 SaaS Released: 23 October, 2025 **New Features** - **Cleanup - Builds** Artifactory now supports a build cleanup policy to delete unintended builds. For more information, see [Cleanup Policies](/administration/docs/cleanup-policies). - **New Remote Repository Types for IDE Plugins** Two new remote repository types, [AI Editor Extensions](/artifactory/docs/ai-editor-extension-repositories) and [JetBrains Plugins](/artifactory/docs/jetbrains-plugins-repositories), are now available to proxy IDE plugin marketplaces. The AI Editor Extensions repository supports proxying extension marketplaces for VSCode, Cursor, and Windsurf. This repository type is integrated with JFrog Curation to enable policy-based blocking of unwanted plugins. The JetBrains Plugins repository supports proxying the JetBrains Marketplace for JetBrains IDEs such as IntelliJ IDEA and PyCharm. With both repository types, you can browse and install extensions and plugins natively within each IDE. The repositories are available to customers with an Ultimate bundle subscription. - **New Remote Repository Type for Bazel Modules** The new Bazel Modules remote repository type supports caching and proxying the Bazel Central Registry (BCR) in Artifactory. This repository type is designed to support module dependency management in accordance with Bazel 9 requirements. Maintaining a secure cache and proxy of the BCR ensures that developers pull only approved and vetted dependencies, enhancing security and streamlining the development process. For more information, see [Bazel Modules Repositories](/artifactory/docs/bazel-modules-repositories). - **Artifactory Now Natively Supports the Terraform Provider Registry Protocol** Artifactory now natively supports the HashiCorp Terraform Provider Registry Protocol, acting as a fully compliant **Provider Origin Registry** for both Terraform and OpenTofu. This enhancement simplifies client configuration, enhances security with GPG verification, and provides smarter protocol-aware proxying. This new method applies to local, virtual, and federated repositories and adds to the `network_mirror` approach. For more information, see [Terraform Documentation](/artifactory/docs/terraform-opentofu-and-terraform-backend-repositories). - **Update Password Policy Via REST API** The JFrog Platform now supports creating and updating your instance’s password policy via REST API, for easier access for SaaS instances. For more information, see [Password Policy](/administration/reference/createPasswordPolicy). - **system properties to enable/disable** Introduced new configuration options via system properties to manage Federation Auto-Healing email notifications: `artifactory.auto.healing.send.mail.notifications`: Set to false to disable all Auto-Healing email notifications (default is true). `artifactory.auto.healing.send.mail.interval.hour`: Set the minimum interval in hours between notification emails for the same mirror recovery (default is 1). **Feature Enhancements** - **Redesigned platform UI for Release Lifecycle Management** The platform UI for Release Lifecycle Management has been redesigned to provide a clearer, more consolidated view of your Release Bundles. The new design centralizes all critical information for each Release Bundle version, including its timeline, contents, security scans, evidence, and properties, in an accessible and intuitive interface. For more information, see [Release Lifecycle Management](/governance/docs/release-lifecycle-management). - **Release Bundle v2 versions now associated with stages and lifecycles** This version replaces environments with the concept of stages and lifecycles, to provide users with more flexibility and control over their SDLC. Administrators can create global and project stages as needed and assign them to different SDLC categories, such as Code and Promote. The administrator then adds selected stages to the lifecycle to represent the progression of release candidates through your SDLC. For more information, see [Stages & Lifecycle](/administration/docs/stages-lifecycle). - **Support for webhooks for project-related Release Bundles** Artifactory now supports the creation of [webhooks](/administration/docs/webhooks) for Release Bundle v2 versions associated with specific [projects](/projects/docs/projects). This enables you to receive notifications whenever a Release Bundle in a particular project is uploaded, promoted, or deleted. To create a Release Bundle webhook for a specific project, you must be working within the scope of the project (as opposed to All Projects). For guidelines about creating a Release Bundle v2 webhook for a specific project, see [Domain: Release Bundle v2](https://docs.jfrog.com/integrations/docs/webhook-event-types#domain-release-bundle-v2). - **Created-by information provided for Sigstore evidence** To improve understanding and traceability, the API response when creating and deploying Sigstore evidence now includes the username associated with the JFrog token instead of ‘internal’. - **More accurate error messages during Release Bundle promotion** To improve user understanding, validation errors during the Release Bundle v2 promotion process will now return a BAD REQUEST error message (HTTP 400) rather than a generic HTTP 500 error. - **Release Bundle v2 auto-creation feature removed** The Release Bundle v2 auto-creation feature, which was introduced to help customers transition from build promotion to the expanded feature set offered by [Release Lifecycle Management](/governance/docs/release-lifecycle-management), has been removed from the platform UI after having served its purpose. - **Support for Easy Copying of Administration Values** The JFrog Platform WebUI now supports a **Copy** button, allowing you to copy values in the Administration module pages with a single click. The following values will now be easily copiable: - Token ID under Access Tokens - Name under Projects, Users, Groups, Permissions, Project Members, Webhooks, and Manage Integrations - Auth URL under OAuthSSO - URL under Webhooks - Group Name under Crowd/ Jira - Provider URL under Manage Integrations - Project Key under Projects - **Support for Updating the Access Bootstrap YAML File** The JFrog Platform now supports making changes to the access.security.bootstrap.yml file without creating a new configuration or modifying the existing Artifactory YAML file. For more information, see [Access Bootstrap YAML File](/installation/docs/access-bootstrap-yaml-file). - **Improved Artifact Lifecycle Management** Artifactory now updates the creation timestamp of an artifact when it is copied or moved to a new repository to the current date and time of the operation. Previously, the original creation timestamp was retained when moving or copying an artifact to another repository, which led to incorrect assumptions about the artifact's age and relevance in the new location. The "last modified" timestamp remains unchanged to preserve the integrity of the artifact's last update. This enhancement helps in the effective adoption of cleanup policies and aligns with industry standards. To ensure backward compatibility, this feature is implemented behind a feature flag and is disabled by default. - **Additional Configuration for GCP Internal Actions** The ability to configure readTimeout was added to Google Cloud Platform (GCP) internal actions. - **New Setting Added to Complete a List Manifest Image Overwrite** A new setting has been added under Package Settings called **Complete list manifest image overwrite**. When this setting is enabled, overwriting a list manifest image will asynchronously overwrite all of its sub-manifests. - **Improved Resolving of Subgroups When Accessing Subgroups in Gitlab with Go Remote Repositories** When accessing subgroups in GitLab with Go remote repositories (by selecting the Resolve Subgroups checkbox, as explained [here](/artifactory/docs/go-modules#proxy-github-with-go)), Artifactory now resolves the correct dependency version even if the URL contents contain both subgroups and submodules. - **Optimized Nuget Version** Tightened validation to require all NuGet packages to use strict Semantic Versioning (SemVer 2.0). See specification. - **Nuget Packages - Rate Limit** Introduced a new rate-limiting mechanism for search APIs to prevent excessive calls and ensure service stability. - **Viewing Release Bundles distributed to Edge nodes** To align the platform UI with the REST API, only admin users are permitted to view distributed Release Bundle versions (v1 and v2) in the **Received** tab on Edge nodes. For more information, see [View Release Bundles on Edge Nodes](/artifactory/docs/view-release-bundles-on-edge-nodes). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFE-3619 | Repositories | Low | Fixed an issue whereby pressing the Delete button to delete a repository multiple times caused multiple popups. | | RTDEV-64552 | Release Lifecycle Management | High | Fixed an issue whereby build dependencies were extracted during Release Bundle v2 creation even when the `include_dependencies` option was set to `false`. | | RTDEV-64239 | Release Lifecycle Management | High | Fixed an issue that affected the build promotions process. Previously, when multiple dependencies had the same SHA, only one file would be promoted and the rest would be ignored. Now all dependencies are promoted, even if the files have the same SHA. | | RTDEV-64189 | Repositories | Medium | Fixed an issue whereby it was not possible to enable the **List Remote Artifacts** checkbox for Conda smart remote repositories. | | RTDEV-64039 | Packages | Low | Fixed an issue whereby an incorrect icon for Docker images was displayed in Docker virtual repositories. | | RTDEV-63869 | General | Medium | Fixed an issue whereby a virtual RPM repository was unable to merge metadata when it contained an upstream remote RPM repository with Zstandard compression index files and a local repository containing RPM packages. | | RTDEV-63693 | General | Low | Fixed an issue whereby inconsistent token validation behavior was observed when calling the system/version API with anonymous access enabled. | | RTDEV-62683 | General | Medium | Fixed an issue whereby it was not possible to display HTML contents of a zip file if the zip file name contained the German umlaut character (for example, **ä**). | | RTDEV-62472 | General | High | Fixed an issue where a policy for cleaning up unused cached artifacts failed to cleanup any files. | | RTDEV-62248 | Repositories | Low | Fixed an issue whereby the file-list API would return a 404 error for nested virtual repositories when setting the parameter **?list\&deep=1**. | | RTDEV-39704 | Release Lifecycle Management | Medium | Fixed an issue that caused builds to be deleted during build promotion if the customer’s storage quota exceeded the configured limit. The status change operation in the build promotion process will now fail if the storage quota has been reached. | | JA-17841 | General | Medium | Fixed an issue whereby include/exclude patterns in the Per Repository tab incorrectly displayed the default value ‘\*\*\*\*\*\*’ when navigating between the All Repositories and Per Repository tabs in the Permission Target UI. | | JFMC-6058 | User Interface (UI) | Low | Fixed an issue related to the JFrog Platform WebUI, where, when accessing the JPDs page in the JFrog Platform with the commonProjects feature disabled, the list of JPDs was not displayed as expected. | | RTDEV-65195 | Replication/Federation | High | Fixed an issue whereby, the heartbeat job failed to trigger for legacy Artifactory customers who had the Repo Config V2 flag (artifactory.federated.repo.config.sync.v2.enabled) enabled. This prevented the auto-healing recovery of federation queues, leading to replication issues. | | RTDEV-48780 | Federation | Medium | Fixed an issue whereby, Artifactory users were unable to control or disable email notifications for Federation Auto-Healing, leading to excessive notification volume. | ## Artifactory 7.124 This section includes all the Artifactory 7.124 releases. ### Artifactory 7.124.1 SaaS Released: 29 September, 2025 **Feature Enhancements** - **Expanded support for distributing and exporting Release Bundle v2 versions** To make distributing and exporting Release Bundle v2 versions easier, you can now use JFrog Distribution with Release Bundle v2 versions signed with the default key in Artifactory. To support this change, the default key type has been changed from RSA to GPG, and the name of the default key has been changed to **default-lifecycle-key**. For more information, see [Create Signing Keys for Release Bundles (v2)](/governance/docs/release-lifecycle-management-setup#create-signing-keys-for-release-bundles-v2). - **Improved visibility for nested Release Bundles** The Release Bundle v2 content graph now provides a clear, visual representation of nested Release Bundles. Seeing the complete hierarchy enables you to understand how the Release Bundle is constructed, even when it contains other Release Bundles. For more information, see [View Release Bundle v2 Evidence](/governance/docs/view-evidence). - **Improved aggregated Release Bundle creation** Artifactory has improved its handling of aggregated Release Bundles (meaning, a Release Bundle v2 version that is comprised of other Release Bundle versions). If the Release Bundle version you are trying to create contains multiple Release Bundles with the same artifact but different metadata (evidence or properties), Artifactory will create the version successfully using the newer version of the artifact. - **Change of status code when creating Release Bundle v2 from build with missing artifact** To improve reporting accuracy, errors caused by missing artifacts during Release Bundle v2 creation will be returned as a 422 error (SC_UNPROCESSABLE_ENTITY) rather than a different status code that triggered unnecessary monitoring alerts. The 422 status code represents the event more accurately as it is the expected behavior when an artifact cannot be found. - **Evidence for artifacts in virtual repositories displayed in Artifacts tree** You can now view evidence related to artifacts in a virtual repository in the Artifacts tree. This is particularly useful when attaching evidence to a Docker image created in a tool such as GitHub Actions. In such cases, users typically work with the Docker image as part of a virtual repository in Artifactory. The virtual repository must contain at least one local repository to house the evidence. For more information, see [View the Artifact Evidence Table](/governance/docs/view-evidence). - **Enhanced Support for npm Audit** In addition to npm virtual repositories, npm Audit is now also enabled by default on npm remote repositories that support npm Audit directly. For more information, see [Use npm Audit](/artifactory/docs/npm-repositories#use-npm-audit). - **Updated Artifactory Worker Events** Updated the following Worker Events with `repoType` Input Parameter: - Before Property Replication - Before File Replication - Before Statistics Replication - Before Directory Replication - Before Delete Replication - **Run Cleanup policies and Garbage Collection (GC) Simultaneously** Enabled cleanup policies to run more reliably by making them health-aware. Jobs will now run concurrently with other tasks only if the system is `HEALTHY` and will automatically stop if load increases, ensuring system stability. This can be toggled by the system property: `artifactory.retention.system.health.aware.job.enabled`. Reach out to the Customer Support to get this enabled. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :-------------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-31288 | Release Lifecycle Managment | Medium | Fixed an issue whereby, when viewing a build’s dependencies within an Artifactory project and selecting Show in Tree for a dependency, the UI redirected to a repository that was not included in the project. | | RTDEV-62997 | User Interface | Low | Fixed an issue in the Storage Monitoring UI, whereby when clicking the sort icon in the Percentage column to display the results in ascending order, the results were displayed in descending order (and vice versa). | | RTDEV-62995 | User Interface | Low | Fixed an issue whereby in the Monitoring Storage UI, there was an unexpected appearance of the backtick character. | | RTDEV-62985 | Packages | Medium | Fixed an issue whereby when deploying a **.pom** file for Maven or Gradle repository types that start with an empty line or used UTF-8 non-breaking spaces in an XML structure, a 409 error was encountered. | | RTDEV-63240 | Packages | Medium | Fixed an issue whereby, copying or moving a Debian package to a path where a package with the same filename but a different checksum already existed caused metadata duplication. | | RTDEV-62928 | General | Medium | Fixed an issue whereby Artifactory would fail to start with a partial GPG key configuration. | | JFUI-18973 | General | Medium | Fixed an issue whereby the **Show offline node** checkbox under **Administration > Monitoring > Service Status** was not working and preventing users from viewing offline nodes in an HA cluster. | | JFUI-18972 | General | Medium | Fixed an issue where setting up log rotation for frontend metrics logs in Artifactory's **system.yaml** file didn't work, as the logs did not rotate after a service restart. | | JA-18101 | User Interface | Medium | Fixed an issue related to the OIDC integration configuration in the JFrog Platform WebUI whereby, when reopening the Identity Mapping configuration following initial setup and saving it again without making any changes, group names containing spaces were not displayed as expected. | | JA-18337 | General | Medium | Fixed an issue whereby the empty-state image was missing when navigating to Access MFE pages in the JFrog Platform Web UI. | ## Artifactory 7.123 This section includes all the Artifactory 7.123 releases. ### Artifactory 7.123.0 SaaS Released: 15 September, 2025 **New Features** - **Support for Sigstore bundle attestations** Artifactory now supports the automatic conversion of OCI Sigstore bundle attestations into JFrog evidence. **Feature Enhancements** - **Upgraded Gradle Set Me Up Wizard** The Gradle Set Me Up wizard has been upgraded to support Gradle 9. - **Virtual Repositories for Hugging Face Packages** Virtual repositories can now be created for Hugging Face packages. - Local and remote Hugging Face repositories that are associated with a virtual Hugging Face repository must have the [Machine Learning Repository Structure](/artifactory/docs/machine-learning-repositories#machine-learning-repository-structure). - Hugging Face datasets and models can be resolved from a virtual Hugging Face repository only with the snapshot\_download API and not by using libraries. For more information, see [Create a Hugging Face Repository](/artifactory/docs/hugging-face-repositories#create-a-hugging-face-repository) and [Resolve Hugging Face Packages](/artifactory/docs/hugging-face-repositories#resolve-hugging-face-packages). - **Performance Improvement in Release Bundle v2 Promotion Flow** The performance of the promotion flow for Release Bundle v2 versions has been improved. - **Enhanced metadata propagation during RTFS Full Sync operations** The Artifactory Federation Service (RTFS) now supports the propagation of artifact creation time metadata during a Full Sync operation. To enable this feature: 1. Set the following Artifactory system property to `true` on the target members: `artifactory.federated.mirror.events.upload.info.propagate.enabled` 2. Use a new REST API to enable the propagation of this specific metadata. For more information, see [Propagate Creation Time Metadata during Full Sync](https://docs.jfrog.com/artifactory/reference/propagatecreationtimemetadataduringfullsync). - **Improved visibility of OCI/Docker multi-arch images in the platform UI** To reduce visual clutter and improve comprehension, Artifactory now makes it easier to manage OCI/Docker multi-arch images in the platform UI. For example, if you have a multi-arch image called **my-image:1.0.0** that supports amd64 and arm64 architectures, Artifactory contains 3 distinct package versions, one for the manifest list and one for each architecture: - my-image:1.0.0 - my-image:sha256__f2ca1bb6c7.... - my-image:sha256__1a8a5828e8.... Artifactory now displays the version for the manifest list only in the platform UI and suppresses the individual architecture versions (named according to their image tags). This enables you to focus on the multi-arch image as a single entity. Please note that all package versions will be returned when listing the content via the REST APIs. - **Updated Artifactory Worker Events** Updated the following Worker Events: - **Before Download Request**: The following fields are added in the response: `modifiedRepoPath`, `expired` and `headers`. - **Before Create**: The following fields are removed from the Sample Payload: `contentLength`, `trustServerChecksums`, `servletContextUrl`, `skipJarIndexing` and `disableRedirect`. - **Before Copy**: The following fields are removed from the Sample Payload: `contentLength`, `trustServerChecksums`, `servletContextUrl`, `skipJarIndexing` and `disableRedirect`. - **Before Property Create**: The following fields are removed from the Sample Payload: `contentLength`, `trustServerChecksums`, `servletContextUrl`, `skipJarIndexing` and `disableRedirect`. - **Before Property Delete**: The following fields are removed from the Sample Payload: `contentLength`, `trustServerChecksums`, `servletContextUrl`, `skipJarIndexing` and `disableRedirect`. - **After Property Delete**: The following fields are removed from the Sample Payload: `contentLength`, `trustServerChecksums`, `servletContextUrl`, `skipJarIndexing` and `disableRedirect`. - **Smart Archiving - Skips Restore of Artifacts with the Same Name and Path** The restore process now skips any artifact that already exists in the target location, preventing accidental overwrites. The existing file will be preserved, and the skipped operation will be noted in the logs and the CSV report. - **Smart Archiving - Supported Archive Packages Search for Project Admins** Project Admins will now see and be able to use the Archive Search feature. The search results are automatically scoped, ensuring they can only view archived packages that belong to the projects they manage. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTFE-3639 | User Interface | Medium | Fixed an issue whereby when navigating to a Storage project in the UI, the Package Type for **npm** appeared as “N/A” instead of displaying **npm**. | | RTFACT-31250 | Packages | Medium | Fixed an issue whereby Artifactory was not able to cache the the **drupal/nouislider_js** module and other modules from **git.drupalcode.org**. | | RTFACT-31214 | Packages | Medium | Fixed an issue whereby the Artifactory SaaS platform did not update the `` tag in **maven-metadata.xml** upon deployment. | | RTDEV-62449 | Packages | Medium | Fixed an issue whereby passing the **X-JFrog-Override-Base-URL** header during the npm install process from a virtual repository was not always respected. | | RTDEV-62157 | Federated Repositories | High | Fixed an issue that caused the Federation to fail if a proxy was defined at the platform level but the Federated repository was set to `no_proxy`. | | RTDEV-61861 | Packages | Critical | Fixed an issue whereby cleanup policies were incorrectly deleting Helm packages with the same prefix name. | | RTDEV-61687 | Archiving/Cold Storage | Low | Fixed an issue whereby the Next Run section for Retention Policies (both Cleanup and Archive) sometimes did not update correctly. | | RTDEV-61672 | Release Lifecycle Management | Medium | Fixed an issue whereby publishing build-info with an empty statuses section caused a 500 error. | | RTDEV-61647 | Archiving/Cold Storage | Medium | Fixed an issue whereby inconsistent naming and compression format for artifactory-cleanup-audit logs caused sync failures and misclassification of logs. | | RTDEV-61500 | Archiving/Cold Storage | Medium | Fixed an issue whereby a cleanup policy would stop running when encountering certain directories. | | RTDEV-61165 | Repositories | Medium | Fixed an issue whereby the [Get All Repository Configurations](/artifactory/reference/getallrepositoryconfigurations) API, in certain cases, returned an empty response when using the JSON accept header. | | RTDEV-60864 | User Interface | Medium | Fixed an issue whereby the Artifactory native UI did not display the contents of a VCS remote repository when an include pattern was set. | | RTDEV-56935 | Packages | Medium | Fixed an issue whereby after saving an NIM remote repository configuration, the test connection failed. | | RTDEV-55886 | General | Medium | Fixed an issue whereby when sending a request to **ui/api/v1/ui/artifactactions/view** with an empty path, the API returned a 500 error and this led to the disclosure of Java exceptions that described some of the application internals. | | JA-17902 | Authentication Providers | Medium | Fixed an issue whereby a SCIM PATCH request succeeded despite containing an invalid operation. | ## Artifactory 7.122 This section includes all the Artifactory 7.122 releases. ### Artifactory 7.122.2 SaaS Released: 29 August, 2025 **Feature Enhancements** - **Support for webhooks for project-related builds** Artifactory now supports the creation of [webhooks](/administration/docs/webhooks) for builds associated with specific [projects](/projects/docs/projects). This enables you to receive notifications whenever a build in a particular project is uploaded, promoted, or deleted. To create a build webhook for a specific project, you must be working within the scope of the project (as opposed to All Projects). For specific guidelines about creating a build webhook for a specific project, see [Domain: Build](/administration/docs/event-types#domain-build). - **Change in API response for Release Bundle v2 tags** To correct inconsistent behavior, the following API endpoints have changed the response for Release Bundle v2 tags from `bundle_tag` and `release_bundle_tag` to a standard response of `tag`: - [Create Release Bundle v2 Version](/governance/reference/createBundleVersion) - [Assign Tag to Release Bundle v2 Version API](https://docs.jfrog.com/governance/reference/setbundletag) - [Get Release Bundle v2 Versions API](/governance/reference/getbundleversions) - **Evidence propagation to Federation members** This release enhances the [Evidence](/governance/docs/evidence-management) service to enable evidence propagation to all Federation members, regardless of whether they contain the relevant public key for verification. Evidence verification, however, is performed only on those members that have the public key. For more information, see Verify Evidence. - **RPM Package Settings** Added support for Administrators to enable/disable RPM package settings for the following: - Recommends Tags - SHA256 For enabling/disabling these settings, see [Enable/Disable RPM Package Settings](/artifactory/docs/rpm-repositories#enabledisable-rpm-package-settings). - **Curation Support for NuGet Virtual Repositories** Extended JFrog Curation capabilities to support NuGet virtual repositories, providing a powerful, centralized way to secure your NuGet package consumption. - **UI Support for Debian Source Package Search** Added support for **Debian Source** package search. - **Improvement in VCS Remote Repositories** The GitHub Server option for Git providers was added for VCS remote repositories. For more information, see [Additional Settings for VCS Remote Repositories](/artifactory/docs/vcs-repositories#create-a-vcs-repository). - **Improvement to the Vendor Folder for the Private Go Registry and the Go Proxy** Checksums in the private Go registry and the Go proxy are now aligned for the Go version 1.24 vendor folder. - **Updated Artifactory Worker Events** Updated the following Worker Events: - **[After Copy](/administration/docs/configure-workers-for-custom-flows#after-copy-worker-code-sample)**: The following fields are removed from the Sample Payload: `contentLength`, `trustServerChecksums`, `servletContextUrl`, `skipJarIndexing` and `disableRedirect`. - **[After Delete](/administration/docs/configure-workers-for-custom-flows#after-delete-worker-code-sample)** The following field is removed from the Sample Payload: `headers` - **[After Property Create](/administration/docs/configure-workers-for-custom-flows#after-create-worker-code-sample)**: The following fields are removed from the Sample Payload: `contentLength`, `trustServerChecksums`, `servletContextUrl`, `skipJarIndexing`, `disableRedirect` and `headers`. - **[After Move](/administration/docs/configure-workers-for-custom-flows#after-move-worker-code-sample)**: The following fields are removed from the Sample Payload: `contentLength`, `trustServerChecksums`, `servletContextUrl`, `skipJarIndexing` and `disableRedirect`. - **[Before Move](/administration/docs/configure-workers-for-custom-flows#before-move-worker-code-sample)**: The following fields are removed from the Sample Payload: `contentLength`, `trustServerChecksums`, `servletContextUrl`, `skipJarIndexing` and `disableRedirect`. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTFE-3636 | Packages | Medium | Fixed an issue whereby the Set Me Up repositories list was not showing an empty virtual Maven repository. | | RTFE-3634 | Federated Repositories | Low | Fixed an issue whereby when converting a local repository to a federated repository, a warning message appeared that “This operation cannot be undone” even though the federated repository can be reverted back to a local repository. | | RTFE-3603 | Projects | Medium | Fixed an issue whereby the "Read Only" check box was not saved when sharing a repository with a project. | | RTFE-3546 | User Interface | High | Fixed an issue whereby the warning “`` could not be found“ was incorrectly appearing in the UI when switching projects. | | RTFACT-31245 | General | Medium | Fixed an issue whereby when Artifactory attempted to authenticate a remote Sonatype Nexus repository using Basic Authentication, the request failed with a 401 Unauthorized error if the username contained non-ASCII characters. | | RTDEV-61511 | Release Lifecycle Management | Medium | Fixed an issue whereby promotion to a specific repository would fail due to a race condition caused by the creation of an unrelated repository in the same environment. | | RTDEV-61351 | Release Lifecycle Management | Medium | Fixed an issue whereby creating a Release Bundle containing two builds with different tags but identical content resulted in the inclusion of just one build. | | RTDEV-61209 | Release Lifecycle Management | High | Fixed an issue whereby the Get Release Bundle v2 Versions in a Specific Environment API would return data that did not reflect the version's current environment. | | RTDEV-61179 | General | Medium | Fixed an issue whereby Support Bundle status in the UI was reported as **FAILURE** despite successful Support Bundle generation. | | RTDEV-59071 | Packages | Medium | Fixed an issue where an external user could obtain an API key instead of an Identity Token in the Maven Set Me Up tool. | | RTDEV-58946 | Release Lifecycle Management | Medium | Fixed an issue where creating a Release Bundle would incorrectly discard duplicate artifacts from different modules. If a build contained the same artifact in multiple paths, only one copy was kept. The process now correctly includes all instances of the artifact, preserving each one in the final Release Bundle. | | JFUI-18900 | General | Medium | Fixed an issue whereby a custom message enabled in the UI would cause the "The Federated repository settings are not synchronized between these repositories" notification to negatively impact the user experience by expanding and blocking other elements. | | JA-18037 | User Management | High | Fixed an issue whereby clicking **Unlock** on the Edit Profile page was throwing a 403 Forbidden error. | ## Artifactory 7.120 This section includes all the Artifactory 7.120 releases. ### Artifactory 7.120.3 SaaS Released: 18 August, 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :---------------------------------------------------------------------------------------------- | | RTDEV-62012 | Release Lifecycle Management | Medium | Fixed the checksum calculation for Release Bundle (RBv2) by adding an explicit ORDER BY clause. | ### Artifactory 7.120.2 SaaS Released: 15 August, 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :-------- | :------- | :------------------------------------------------- | | RTDEV-62074 | General | Medium | Fixed an issue where redundant errors were logged. | ### Artifactory 7.120.1 SaaS Released: 13 August, 2025 **New Features** - **Support for signed attestations in OCI images** The [Evidence Collection](/governance/docs/evidence-management) service can take signed, 3rd-party attestations uploaded to Artifactory as OCI images and convert them automatically into JFrog evidence. For example, this new feature can successfully convert attestations created using the **cosign attest** command. For the automatic conversion to work, the attestations must conform to both the DSSE and in-toto standards. **Feature Enhancements** - **Filtering added to Get All Repository Configurations API** You can now use query parameters to filter the results of the [Get All Repository Configurations API](https://docs.jfrog.com/artifactory/reference/getallrepositoryconfigurations). You can filter by package type (for example, docker, maven) and repository type (for example, local or remote). - **Context retention in Artifacts browser** When you copy or move artifacts in the Artifacts browser, the UI no longer moves automatically to the destination path of the operation but remains in its original context. To move to the destination path after the copy or move operation is complete, click the **Go to path** link in the confirmation message.

- **Added Enforcement of Custom Configurations for Certain Remote Docker Repositories** When creating a remote Docker repository for an Azure Container Registry (\*.azurecr.io) or a Microsoft Container Registry ([https://mcr.microsoft.com/](https://mcr.microsoft.com/)), Artifactory makes the following default configuration: - **Disable URL Normalization = true** When creating a remote Docker repository for a Chainguard Registry ([http://cgr.dev/chainguard](http://cgr.dev/chainguard)), Artifactory makes the following default configuration: - **Block Mismatching Mime Types = true** These default configurations are set upon remote repository creation and can be canceled afterwards. For more information, see [Other Advanced Settings for Remote Repositories](/artifactory/docs/remote-repositories#additional-remote-repository-settings-for-specific-package-types). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-31211 | Repositories | Low | Fixed an issue whereby attempts to test the connection to a remote repository using token authentication fail. | | RTDEV-61309 | Release Lifecycle Management | Critical | Fixed an issue whereby Artifactory was unable to collect all the multi-arch Docker images from a remote cache repository. | | RTDEV-61209 | Release Lifecycle Management | High | Fixed an issue whereby the Get Release Bundle v2 Versions in a Specific Environment API would return data that did not reflect the version's current environment. | | RTDEV-60343 | Packages | Medium | Fixed an issue whereby Conan federation did not sync all package properties. | | RTDEV-58791 | Archiving/Cold Storage | High | Fixed an issue with failed upgrades from Artifactory versions earlier than 7.97 to version 7.97 or later when using a non-enterprise MSSQL license. | | RTDEV-58782 | Archiving/Cold Storage | Medium | Fixed an issue whereby a project admin could not successfully call the **Get all Package Cleanup Policies API** and received a 403 error. | | RTDEV-57893 | Repositories | Medium | Fixed an issue whereby artifacts failed to appear in the UI browser after defining an include pattern on the virtual repository. | | JA-17899 | General | Medium | Fixed an issue whereby Access was throwing errors during startup. | | JA-17939 | General | Critical | Fixed an issue related to the role `Project-Admin` whereby, when generating an access token and then trying to perform an action, the JFrog Platform did not perform as expected. | | INST-11808 | Installation | Medium | Fixed an issue where setting a custom `shared.database.url` for embedded DerbyDB in system.yaml led to inconsistent configurations, causing startup failures. To prevent this, a new validation now runs during Artifactory startup, ensuring that if a custom Derby database URL is specified for `shared`, custom URLs must also be provided for all database-connected services (access, topology, jfconfig). This maintains uniform Derby database configuration across the platform. | | EVT-1706 | General | Medium | Fixed an issue whereby a webhook would fail if any of the repositories it was configured to listen to were deleted from the system. | ## Artifactory 7.119 This section includes all the Artifactory 7.119 releases. ### Artifactory 7.119.1 SaaS Released: August 3, 2025 This is a maintenance release with no fixes to report and no effect on customers. ### Artifactory 7.119.0 SaaS Released: 30 July, 2025 **New Features** - **New Parent Manifests API** A Parent Manifests API has been added, which allows you to discover all parent manifest lists associated with a specific Docker manifest. For more information, see [Find Parent Manifest Lists API](/artifactory/reference/findParentManifestLists). - **New JFrog for GitHub App** The JFrog Platform now supports the JFrog for GitHub App, which allows you to connect GitHub repositories to the JFrog platform. This integration enables a scalable setup, allowing you to create a centralized OIDC configuration and automate Frogbot deployment. For more information, see [Integration With GitHub App](/administration/docs/openid-connect-integration#integration-with-github-app). **Feature Enhancements** - **Improved npm Search** It is now possible to search for up to three search terms in npm local repositories when using the "npm search" command. - **Improved Change Artifacts count UI widget caching mechanism** Improvements were made to the Change Artifacts count UI widget caching mechanism. - **Improved Configuration Descriptor Validation** Configuration descriptor validation was improved to increase system stability. - **Redesigned presentation of Release Bundle v2 contents** The Content tab for Release Bundle v2 versions has been redesigned to show each package and standalone artifact included in the version (known as "releasables") and their source (for example, a build or a different Release Bundle). For more information, see [View the Contents of a Release Bundle v2 Version](/governance/docs/view-the-contents-of-a-release-bundle-v2-version). - **Improvements to evidence graph** The design of the Release Bundle evidence graph has been improved to make it easier to distinguish between the various elements (builds, packages, etc.) that comprise the Release Bundle. For more information, see [View Release Bundle v2 Evidence](/governance/docs/view-evidence). - **Platform UI support for displaying larger evidence files** The platform UI can now display evidence files up to a maximum size of 3000 lines (compared to 1500 lines in previous versions). Larger evidence files can be downloaded with a single click. For more information, see [View Evidence](/governance/docs/view-evidence). - **Adding days/weeks selection for Time-based Policy Condition - Cleanup Release Bundle V2** Enhanced RB V2 cleanup functionality with the addition of **days/weeks** selection for policy condition. You can now configure cleanup conditions, specifying **days/weeks** for the RB V2. For more information, see [Create Cleanup Policy - Release Bundle V2](/administration/docs/cleanup-policies#create-cleanup-policy---release-bundle-v2). **Resolved Issues**

JIRA Issue	Component	Severity	Description
RTFE-3459	Packages	Medium	Fixed an issue whereby the setting Enable Token Authentication was always checked (set TRUE) for a Helm OCI remote repository and a Docker remote repository, even if the actual value for this setting was false.
RTFE-3332	User Interface	Medium	Fixed an issue whereby the Artifactory UI displayed an option to delete properties from virtual repositories, even though it is not possible to delete these properties.
RTDEV-60768	General	Medium	Fixed an issue whereby when configuring Artifactory to work with a MySQL database, an unnecessary warning message was received indicating that “No NativeDbLocksService implementation bean exists for DB type".
RTDEV-60689	Packages	Medium	Fixed an issue where Artifactory was not honoring include/exclude patterns on a Go remote GitHub repository for .info artifacts.
RTDEV-60496	Repositories	High	Fixed an issue whereby the .jfrog system folder could not be deleted from local repositories or remote caches.
RTDEV-59666	General	Low	Fixed an issue whereby when setting up Apache as a reverse proxy for Artifactory, the default configuration that was generated from the Artifactory UI did not forward the original user IP address.
RTDEV-58806	Packages	Medium	Fixed an issue whereby the removal of a child repository from an RPM virtual repository did not trigger metadata calculation.
RTDEV-58624	Repositories	Medium	Fixed an issue whereby the following APIs were accessible to admins only: - [Delete Item From Trash Can API](https://docs.jfrog.com/artifactory/reference/deleteitemfromtrashcan) - [Restore Item from Trash Can API](https://docs.jfrog.com/artifactory/reference/restoreitemfromtrashcan) Now, after the fix, these APIs can be accessed by non-admins with the appropriate permissions.
JA-7750	User Management	Medium	Fixed an issue in user creation whereby, when using a numeric value in the Username field, the JFrog Platform could not accept a value of over 3 digits.
JA-17727	Authentication Providers	Low	Fixed an issue where authentication attempts with invalid tokens caused temporary login suspension. Only basic credentials authentication attempts should count toward login suspension.

## Artifactory 7.118 This section includes all the Artifactory 7.118 release notes. ### Artifactory 7.118.2 SaaS Released: 24 July, 2025 **Feature Enhancements** - **New Metadata Properties Added to the manifest.json** Metadata properties for the operating system and the operating system architecture will now be added to the **manifest.json** after pushing or caching a new image. These new properties are set in **docker.os** and **docker.architecture**, respectively. - **Prevent accidental removal of referenced sub-architectures in multi-arch images** Starting from this Artifactory version, when deleting a multi-architecture image, any sub-architecture variant that is still referenced by another image will be preserved. - **Source environment included in Release Bundle v2 promotion GET API results** The Get Release Bundle v2 Promotions API and Get Release Bundle v2 Version Promotions API REST APIs now include the source environment in their responses. This enables you to see at a glance the name of the environment from which the Release Bundle version was promoted. - **Improved Get Federation Sync State REST API performance** The performance of the Get Federation Sync State REST AP that returns the synchronization state of all Federated repositories in the JPD has been improved. **Note** This API endpoint is relevant for users operating the legacy Federation service, not the Artifactory Federation Service (RTFS). - **NuGet Package - Now Supports .NET CLI** NuGet packages now include support for the .NET CLI. - **Retention Policies - Cleanup & Smart Archiving** The **Stop All Runs** action is now restricted to Platform Admins only. Project Admins no longer have access to this action. - **Added Support for Terraform Remote Repositories** Terraform remote repositories now support proxy GitLab and Terraform Cloud registries. For more information, see [Create Terraform/OpenTofu and Terraform Backend Repository](/artifactory/docs/terraform-opentofu-and-terraform-backend-repositories#create-terraformopentofu-and-terraform-backend-repository). **Resolved Issues**

JIRA Issue	Component	Severity	Description
WKS-1799	Workers	Medium	Fixed an issue in the Workers Page in the JFrog Platform WebUI whereby, when creating or editing an event-driven Worker, selecting a timezone, and saving the configuration, the timezone was not saved as expected.
RTDEV-60193	Packages	Critical	Fixed an issue whereby the Go module download process encountered a failure when the MCRP limit was reached, which resulted in an unsuccessful request to the remote resource, and attempts to serve from the cache also failed.
RTDEV-59712	Release Lifecycle Management	Medium	Fixed an issue whereby the same event displayed different timestamps in the kanban view and in the timeline.
RTDEV-59525	Release Lifecycle Management	Medium	Fixed an issue whereby creating a Release Bundle with a non-existent project key returned a 500 error. It now returns a 400 error.
RTDEV-58433	Builds	Medium	Fixed an issue whereby artifacts with different names but the same checksums showed the wrong repository path in the build browser.
RTDEV-57821	Release Lifecycle Management	Medium	Fixed an issue whereby attempts to delete, move, or overwrite a promoted artifact returned a 403 error code (Forbidden). These actions will now return a 409 error code (Conflict).
RTDEV-57769	General	Medium	Fixed an issue whereby flat copy returned a 409 status code for almost any error.
RTDEV-57737	Repositories	High	Fixed an issue whereby: - When attempting to delete a repository, an unfound artifact caused the deletion to fail. - When attempting to delete a bulk of repositories, an unfound repository caused the deletion to fail.
RTDEV-57244	Repositories	Medium	Fixed an issue whereby attempting to create a remote repository with an encrypted password from another Artifactory instance failed with a 500 BadPaddingException.
JA-17875	User Management	High	Fixed an issue with the Projects user REST API, where a project admin received a 403 error when attempting to retrieve project user details.
TOPO-592	User Interface (UI)	High	Fixed an issue related to monitoring whereby, under certain circumstances, the Service Status page in the JFrog Platform WebUI displayed inaccurate uptime information for services.

## Artifactory 7.117 This section includes all the Artifactory 7.117 releases. ### Artifactory 7.117.5 SaaS Released: 18 July, 2025 **Feature Enhancements** - **Release Bundle v2 version supports plus sign character** You can now include a plus sign (+) when defining the version of a Release Bundle v2. This change was made to achieve alignment with the SemVer 2.0.0 specification. For more information, see [Create Release Bundle v2 Version](/governance/docs/create-release-bundles-v2). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :-------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-57406 | General | Low | Fixed an issue whereby an error warning was received when converting a RepoDescriptor URL to URI when the upstream URL in the remote repository settings had a ‘/’ at the end of the URL. | ### Artifactory 7.117.3 SaaS Released: 14 July, 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :----------- | :------- | :---------------------------------------------------------------------------------------------------------------------------- | | RTDEV-60496 | Repositories | High | Fixed an issue whereby the **.jfrog** system folder could not be deleted from local repositories or remote caches. | | RTDEV-59631 | Packages | Medium | Fixed an issue whereby Docker referrers were not passed to the federated repository. | | RTDEV-58470 | General | Medium | Fixed an issue whereby when the client requested an incorrect HTTP range, Artifactory returned an invalid HTTP content range. | ### Artifactory 7.117.2 SaaS Released: 04 July, 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------- | :-------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | JA-17762 | Projects | Critical | Fixed an issue whereby the Access schema migration **AbstractV7_1130_0_2__MigrateProjectUsers** was failing due to a duplicate entry exception on a composite primary key during batch insertion (relevant for project users and project groups). | ### Artifactory 7.117.1 SaaS Released: 30 June, 2025 **Breaking Change for Access REST APIs** From this version, Access REST API responses will be returned as compact JSON and not as pretty-printed JSON. Note that some automatic parsers that rely on the formatting will require an update. **New Features** - **New REST API: Get Projects List for a Global Role** The JFrog Platform now supports getting a paginated list of projects where a specific global role is used. For more information, see [Get Project List for a Global Role API](https://docs.jfrog.com/projects/reference/getprojectsforrole). **Feature Enhancements** - **API Run Summary Reports for Cleanup and Smart Archiving** Added new API endpoints for cleanup and smart archiving that provide detailed run summary reports in JSON format. For more details, refer to [View Package Cleanup Policy Run Summary Report API](/administration/reference/viewcleanuppolicyrunsummaryreport) and [View Smart Archiving Policy Run Summary Report API](/administration/reference/viewsmartarchivingpolicyrunsummaryreport). - **Smart Archiving Packages: Evidence** Added support for the archival of evidence associated with any packages. This enhancement ensures that relevant evidence is preserved as part of your archiving strategy, streamlining your package management process. For more information, refer to [Smart Archiving](/administration/docs/archive#smart-archiving). - **Property-based Policy Condition - Smart Archiving Packages** Enhanced package-archivie functionality with the addition of a property-based policy condition. You can now include or exclude specific package versions from archive by applying a property-based policy condition. This allows for more granular control over which packages are retained or archived during archive actions. For more information, see [Create Smart Archiving Policy](/administration/docs/archive#create-smart-archiving-policy). - **Filter Users and Groups by Role Within a Repository Via REST API** The JFrog Platform now supports filtering users and groups by role within a specific repository via REST API. For example, you can easily retrieve a list of admins for a specific repository to streamline permissions management. For more information, see [Get User List API](/administration/reference/getuserlist) and [Get a List of Groups API](/administration/reference/getgrouplist). - **Allow Granting Manage Permissions in Permissions V2** The JFrog Platform now supports allowing users with `manage` permissions to grant `manage` and other permissions to other users in Permissions V2, although it is not recommended. For more information, see [Permissions](/administration/docs/permissions). - **Support for Reading Permissions Scoped Tokens** It is now possible for non-admin users to use the [Get Repository Configuration API](/artifactory/reference/getrepositoryconfiguration) REST API endpoint using a scoped token. For more information, see Create Scoped Token API. - **Add Unlimited Groups to a Reference Token in SAML** The JFrog Platform now supports adding an unlimited number of groups in SAML user-scoped reference tokens, as the number of groups does not affect the payload. For more information, see [Create Token API](/administration/reference/createToken). - **Removal and Backup of Mission Control Plugins** The following Mission Control plugins, which were created during the initial days specifically for Mission Control, are no longer required by any JFrog products. As a result, these plugins will be removed in this version and backup files are created with a `.backup` extension. - `internalUser.groovy` - `ldapSettingsConfig.groovy` - `ldapGroupsConfig.groovy` - `haClusterDump.groovy` - `repoLayoutsConfig.groovy` - `proxiesConfig.groovy` - `propertySetsConfig.groovy` - `requestRouting.groovy` - `httpSsoConfig.groovy` - `pluginsConfig.groovy` For more information, see [User Plugins](/integrations/docs/user-plugins) documentation. - **Release Bundle v2 promotion rollback** You can now use the [Roll Back Release Bundle v2 Version Promotion API](/governance/reference/rollbackpromotion) to roll back the latest promotion of a Release Bundle v2 version. Rollback deletes the contents of the latest promotion (including its artifacts, properties, and evidence) and restores the version to its previous environment, including the properties and evidence it contained when the version was first created. For more information, see [Promotion Rollback](/governance/docs/promotion-rollback). - **Assigning a tag when creating a Release Bundle v2 version** You can now assign a tag when creating a Release Bundle v2 version with the [REST API](/governance/reference/createBundleVersion). Use the tag to identify the version quickly. For example, you can create tags such as nightly-build, release-candidate, bugfix-2025-33124, and so on. The tag will appear on the card for the Release Bundle version on the Release Lifecycle stages board. **Note** You can continue using the Assign Tag API REST API to tag existing Release Bundle versions. - **Version counter on Release Lifecycle kanban board** The Release Lifecycle kanban board now includes a counter so that you can see at a glance how many versions of the selected Release Bundle currently exist. - **Improved error codes during Release Bundle v2 creation** Artifactory will now return 404 when an artifact or package is missing from the defined artifact or package list during Release Bundle v2 creation. In addition, Artifactory will return 403 when an artifact or package is filtered out due to a user permissions issue. - **Evidence provider logo displayed on kanban board** Each evidence item displayed on the Release Lifecycle kanban board now includes a logo to indicate the provider of that evidence, whether it is evidence provided by the JFrog platform or evidence originating from other providers, such as GitHub or Sonar. The logo is also displayed prominently when the contents of the evidence item are opened. - **Improvement in Promoting Docker Images** Starting from this Artifactory version, when Docker image promotion overrides an existing image tag in the target repository, shared layers from other tags of the same image will not be deleted. In versions prior to 7.117.1, these shared layers may be deleted. - **CocoaPods Smart Repositories** The **CocoaPods Settings** section has been removed from the smart repository creation page. Smart repositories automatically inherit configuration from their source repository, making manual settings unnecessary. - **Improved Robustness of Binary Uploads to Google Cloud Storage (GCS)** The robustness of binary uploads to GCS has been improved by enhancing recovery mechanisms. - **Cocoapods CDN Smart Repository Support** Added smart repositories support for CocoaPods CDN. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-57859 | Packages | Medium | Fixed an issue whereby, the SAX parser failed when parsing filtered XML resources. | | RTDEV-57293 | General | Medium | Fixed an issue whereby an AQL transitive query on a virtual repository failed and returned a HTTP 500 response when the query was performed on a virtual repository that had an offline remote repository. | | RTDEV-57265 | Evidence Management | High | Fixed an issue that prevented users from deleting a repository containing evidence files. | | RTDEV-57055 | Release Lifecycle Management | Medium | Fixed an issue that caused the build cleanup procedure to fail after the associated project was deleted. | | RTDEV-56440 | General | Medium | Fixed an issue whereby the internal repository **jfrog-usage-logs** was included by default in the system backup, and was excluded from export/import repositories and export/import system flows. | | RTDEV-54817 | Release Lifecycle Management | Medium | Fixed an issue that prevented webhook notifications from being triggered for each artifact in a Release Bundle v2 promotion. After the fix, users who have configured artifact copy/move webhook notifications (and include `-release-bundles-v2` repositories) will receive notifications about each artifact when Release Bundles are promoted. | | RTDEV-45715 | Release Lifecycle Management | Medium | Fixed an issue whereby a build rename failed (because the build was not found in the defined project), but the operation was still reported as successful. After the fix, an error message is returned if a build with the specified name is not found in the defined project. | | RPG-1799 | General | High | Fixed an issue whereby when upgrading Artifactory in Windows to newer versions, Xray was unavailable. | | JA-18312 | Repositories | Medium | Fixed an issue related to repositories whereby, under certain circumstances, an extra '0' character appeared incorrectly next to the repository counter in the project tab in the JFrog Platform WebUI. | | JA-7684 | Archiving/Cold Storage | Medium | Fixed an issue whereby SaaS customers were able to execute the Access Export API. | | JA-16404 | Repositories | Medium | Fixed an issue related to Generic Repository Set-Me-Up whereby, when creating an identity token, the JFrog Platform did not include all required scopes. | | INST-9279 | Installation | Medium | Fixed an issue where the **serviceName** in the **artifactory-statefulset.yaml** and the **artifactory-service.yaml** files were not identical, causing DNS resolution failures. | ## Artifactory 7.116 This section includes all the Artifactory 7.116 releases. **Removal and Backup of Mission Control Plugins** The following Mission Control plugins, which were created during the initial days specifically for Mission Control, are no longer required by any JFrog products. As a result, these plugins will be removed in the upcoming version 7.117 and backup files are created with a `.backup` extension. - `internalUser.groovy` - `ldapSettingsConfig.groovy` - `ldapGroupsConfig.groovy` - `haClusterDump.groovy` - `repoLayoutsConfig.groovy` - `proxiesConfig.groovy` - `propertySetsConfig.groovy` - `requestRouting.groovy` - `httpSsoConfig.groovy` - `pluginsConfig.groovy` For more information, see [User Plugins](/integrations/docs/user-plugins) documentation. ### Artifactory 7.116.3 SaaS Released: 22 June, 2025 **Feature Enhancements** - **Release Bundle v2 creation using items in remote-cache repositories** You can now create a Release Bundle v2 version that includes packages and artifacts located in remote-cache repositories. For more information about Release Bundle creation, see [Create Release Bundle v2 Version](/governance/docs/create-release-bundles-v2). - **SBOMs containing remote-cache dependencies** Release Bundle v2 versions created from [build-info](/integrations/docs/about-build-info) can now include build dependencies located in remote-cache repositories, provided you have used the option for including dependencies in the Release Bundle. If this option has not been used, the remote-cache dependencies will not be included in the Release Bundle, but the SBOM used by Xray will still contain metadata about those dependencies. - **Source environment of Release Bundle v2 promotions** The source environment of a Release Bundle v2 promotion is now included in the API response, making it easier for users to identify the start and end points of the promotion. For more information about promotion, see [Promote Release Bundle v2 Version](https://docs.jfrog.com/jfrog-sandbox/reference/createpromotion). - **Additions to Artifactory Request Log (JSON version)** The JSON version of the Artifactory request log has been enhanced to include additional metrics for improved tracking of request and response performance. These enhancements provide insights into response timing, data size, processing duration, and request specifications. - **Support for New Package Type in Cleanup Policies and Smart Archiving** Cleanup Policies and Smart Archiving now support Composer package type. - **Daily Notification Emails for Token Expiration** The JFrog Platform now supports setting intervals for email notifications about tokens that are about to expire, either once or daily during the notice period. For more information, see [Token Expiration Notification](/administration/docs/security-configuration#token-expiration). - **JFrog Platform WebUI Breadcrumbs** From Artifactory version 7.116.3, breadcrumbs allowing you to orient yourself in the JFrog Platform WebUI will gradually be rolled out to all pages. For more information, see [JFrog Platform Navigation](/administration/docs/jfrog-platform-navigation). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFE-3191 | User Interface | High | Fixed an issue whereby the Trash Can could not re-enabled after disabling it via the User Interface. | | RTFACT-31188 | General | Low | Fixed an issue whereby, a new permission target called INTERNAL_default appeared in the list of Permission Targets after upgrading Artifactory. | | RTFACT-30732 | Repositories | Medium | Fixed an issue whereby, when setting members in a virtual repository the order in the YAML configuration file was not maintained. | | RTDEV-59330 | Release Lifecycle Management | High | Fixed an issue that caused artifacts to be deleted when a Release Bundle was promoted using the `move` option to the environment in which it already resides. | | RTDEV-57267 | General | High | Fixed an issue whereby Artifactory was still picking up the https port for router registration, and did not pick up the port from system configuration. | | RTDEV-57123 | General | Medium | Fixed an issue whereby when creating or updating properties for a package with an emoji, if the database did not support emojis the action failed with 500 error message and the user was navigated to the 500 error page. Now, the user will receive a 422 error code and the properties will not be created/updated. | ## Artifactory 7.115 This section includes all the Artifactory 7.115 releases. ### Artifactory 7.115.5 SaaS Released: 22 June 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTDEV-59330 | Release Lifecycle Management | High | Fixed an issue that caused artifacts to be deleted when a Release Bundle was promoted using the `move` option to the environment in which it already resides. | ### Artifactory 7.115.4 SaaS Released: 18 June, 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :-------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-58640 | Packages | Medium | Fixed an issue whereby some versions of certain composer packages were not listed or downloadable when using a composer remote repository configured with default settings. | ### Artifactory 7.115.3 SaaS Released: 12 June, 2025 **Feature Enhancements** - **Support for N versions in Retention Policies** Cleanup Policies and Smart Archiving now support N versions for Docker, OCI and Helm OCI. For more information, see [Cleanup Supported Packages](/administration/docs/cleanup-policies#cleanup-supported-packages) and [Smart Archiving Supported Packages](/administration/docs/archive#smart-archiving-supported-packages). - **Creating a Release Bundle v2 version from packages** You can now create a Release Bundle v2 version by defining one or more packages to include in the Release Bundle. The Release Bundle can include packages of every type supported by Artifactory. For more information, see [Create Release Bundle v2 Version API](/governance/reference/createBundleVersion). - **Expanded support for scoped tokens in Deploy Evidence API** The [Deploy Evidence](/governance/docs/evidence-service-cli) REST API now supports scoped tokens based on specified artifacts in addition to its previous support for scoped tokens based on a specified repository. In both cases, the scoped token must include the Annotate action. For more information, see Create Scoped Token API. - **Get Worker Code Samples with Worker Code Gallery** The JFrog Platform now supports populating new Workers with GitHub code samples, directly from the JFrog Platform WebUI. For more information, see [Configure Workers in the UI](/administration/docs/configure-workers-for-custom-flows#configure-workers-in-the-ui). - **Rerun Worker Runs** The JFrog Platform now supports a Rerun feature to troubleshoot Worker runs. For more information, see [Workers Troubleshooting](/administration/docs/workers-troubleshooting). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :----------------------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-31181 | Packages | Low | Fixed an issue whereby an exclamation mark incorrectly appeared in the code snippet for manually setting credentials in the Set Me Up procedure for OCI repositories. | | RTFE-3107 | Packages | Medium | Fixed an issue whereby the option to “Enable Indexing in Xray” appeared in the configuration of Machine Learning repositories. | | RTFE-2989 | Authentication Providers | Medium | Fixed an issue whereby, it was possible to generate a valid token on the Set Me Up page when entering any password in the Password field when logging in by means of Authentication Provider. | | RTDEV-57815 | Packages | Medium | Fixed an issue in the max unique tags Docker cleanup feature where tags were removed out of order. | | RTDEV-57187 | Packages | Medium | Fixed an issue whereby a 500 error was received when executing the Get RubyGem Version List REST API on a virtual repository. | | RTDEV-57071 | Packages | Medium | Fixed an issue whereby the **nuget search** command returned an empty response when searching for packages in a NuGet virtual repository that contained a remote GitHub packages repository. | | RTDEV-57047 | User Management | Medium | Fixed an issue whereby an access project scoped token with the "Viewer" role allowed artifact deployment. | | JA-17258 | User Interface | High | Fixed an issue whereby, when creating a group via the JFrog Platform WebUI, the **Read Policy** role was not displayed. | | JA-17278 | Platform Management | Medium | Fixed the issue whereby a global role created at the Platform level was unexpectedly automatically appearing under project roles. | | JA-17192 | User Interface | Low | Fixed an issue whereby the **Disable Internal Password Login** setting was not functioning correctly when configured globally. | ## Artifactory 7.114 This section includes all the Artifactory 7.114 releases. ### Artifactory 7.114.3 SaaS Released: 2 June 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :-------- | :------- | :---------------------------------------------------------------------------------- | | RTDEV-58355 | Packages | High | Fixed an issue whereby the upload of large files failed with Azure cloud providers. | ### Artifactory 7.114.2 SaaS Released: 26 May, 2025 **Feature Enhancements** - **Support for Reading Permissions Scoped Tokens** It is now possible for non-admin users to use the Get HA License Information API and [Get Storage Summary Info API](https://docs.jfrog.com/artifactory/reference/getstoragesummaryinfo) endpoints using a scoped token. For more information, see Create Scoped Token API. - **Default Socket Timeout for Federated Repositories** The default socket timeout for Federated repositories has been changed to 300000 milliseconds (5 minutes). This value can be adjusted, if required, using an Artifactory system property. For more information, see Increase the Predefined Socket Timeout for Larger Repositories. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-31184 | Release Lifecycle Management | High | Fixed an issue that prevented the creation of a Release Bundle v2 version from a build containing multiple images that share a layer. | | RTFACT-31120 | Repositories | Medium | Fixed an issue whereby when a Smart-Remote repository on Edge was pointing to another Artifactory instance and had artifacts in the cache, if the Main instance was up but had returned an unexpected error code, artifacts could not be resolved even if they were in the cache. | | RTFACT-31234 | Platform management | Low | Fixed an issue related to logging whereby, when using Atlassian Crowd authentication provider, the console.log displayed unecessary exception messages. | | RTDEV-57309 | Packages | Medium | Fixed an issue whereby it was not possible to delete an improper **list.manifest.json** in a Docker repository. | | RTDEV-56961 | Archiving/Cold Storage | Medium | Fixed an issue whereby the next token was included in the Maven/Gradle cleanup results even if the number of results was less than the limit. | | RTDEV-56651 | Packages | Medium | Fixed an issue whereby an empty string in the **noarch** element in the Conda **repodata.json** metadata file caused a failure when downloading artifacts from a Conda repository with a pixi client. | | RTDEV-56347 | Release Lifecycle Management | Medium | Fixed an issue whereby only the latest piece of evidence was preserved when promoting a release bundle with Move. | | RTDEV-55094 | Repositories | Low | Fixed an issue whereby, when a remote repository pointed to a blocked URL, the **Disable Artifact Resolution in Repository** setting could not be disabled even though the update request returned a 200 status code. | | RTDEV-54362 | General | High | Fixed an issue whereby when calling the zap cache API, the zap repository cache was holding all artifact locks in a single long transaction. | | JA-17177 | Projects | High | Fixed an issue whereby project-level access tokens were circumventing the Read-Only restriction in a shared repository. | | JA-17040 | User Management | Medium | Fixed a issue with synchronization in Access Federation for groups containing the 'anonymous' user, as the user's membership wasn't getting replicated. | | JA-16308 | Authentication Providers | Medium | Fixed an issue whereby the JFrog CLI refresh token was failing for non-admin SAML users when their token scope included additional permissions beyond the default. | ## Artifactory 7.113 ### Artifactory 7.113.4 SaaS Released: 20 May 2025 **Feature Enhancements** Several improvements to the user experience. ### Artifactory 7.113.0 SaaS Released: 6 May, 2025 **Breaking Change** As part of security hardening, the scope of permissions around existing repositories using access tokens has been updated. As a result, builds across some package types may result in "forbidden" or "unauthorized" errors. To resolve this, update the token scope by assigning the required permissions to the specific group or users that requires them. **Feature Enhancements** - **Improved Builds table** The Builds table features two important enhancements: - The maximum of 100 builds displayed in the table has been removed. The table can now display all the builds that exist in your Artifactory instance. - A search window has been added to make it easier to focus on the builds of greatest importance to you. (This new search window works in coordination with the platform search window at the top of the UI.) - **Create Release Bundle v2 version from multiple sources** You can now create a Release Bundle v2 version from multiple sources, for example, a combination of artifacts, builds, and existing Release Bundles. For more information, see [Create Release Bundle v2 Version API](/governance/reference/createBundleVersion). - **Release Bundle v2 – support for SBOMs with remote dependencies** Previously, Release Bundle v2 did not include information about dependencies from remote repositories, which prevented the generation of a complete SBOM (software bill of materials) by Xray. This limitation has now been removed, which means that information about these dependencies will be included in the SBOM, and Xray (version 3.121.7 and above) can scan them. Having a complete SBOM increases transparency and security by providing insight into all components involved in the Release Bundle, and helps with auditing and compliance. **Note** Although information about remote dependencies is included in the SBOM, the dependencies themselves are not included in the Release Bundle in the current version. - **Updated Type Definitions for Event-Driven Workers' Response** Refined TypeScript type definitions for event-driven workers' response to improve the developer experience. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-57054 | General | Low | Fixed an issue whereby the Audit Event popup that is displayed in the Curation User Interface was showing a name for the Origin Server that was sometimes a random string of characters, which was not useful to the user. | | RTDEV-56222 | Authentication Providers | Medium | Fixed an issue whereby customers could sometimes mistakenly deploy artifacts using a FULL ACCESS TOKEN because the FULL ACCESS TOKEN did not take into account the scoped group of the token. | | RTDEV-56117 | Release Lifecycle Management | Medium | Fixed an issue that caused the platform UI to show an inaccurate number of items inside the packages contained in a Release Bundle. | | RTDEV-56101 | Packages | Medium | Fixed an issue whereby corrupted cache from an npm remote repository was breaking the resolution of packages. | | RTDEV-56028 | Packages | Medium | Fixed an issue whereby the npm search on an npm repository with more than 20 artifacts did not provide the correct latest version. | | RTDEV-55064 | Packages | Medium | Fixed an issue whereby a _Signature Verification Failed_ error was received when attempting to retrieve dependencies from a Hex Repository after metadata expiration. | | META-1873 | General | Medium | Fixed an issue whereby metadata was unable to handle non-existent packages requested by Xray. | ## Artifactory 7.112 This section includes all the Artifactory 7.112 releases. ### Artifactory 7.112.0 SaaS Released: 23 April, 2025 **Feature Enhancements** - **Adding properties to Release Bundle v2 versions** You can now add [properties](/artifactory/docs/jfrog-properties#add-properties-to-items) and [property sets](/artifactory/docs/jfrog-properties#create-property-set) to Release Bundle v2 versions. Properties are user-defined, key-value pairs that are added to the Release Bundle v2 version's manifest file. For more information, see [Add Properties to a Release Bundle v2 Version](/governance/docs/add-properties-to-a-release-bundle-v2-version). - **New search and filtering options for Release Lifecycle Management kanban board** The Release Lifecycle Management kanban board now features options for searching through and filtering the displayed Release Bundle versions. These options make it easier for you to focus on the versions of greatest interest. - **Support for New Package Types in Cleanup Policies** Cleanup Policies now support Chef and Puppet package types. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-31100 | Repositories | Low | Fixed an issue whereby, when trying to create a repository using the Create Repository Rest API without an "include pattern" in the input JSON, the repository was created with an empty string for the "include pattern" field. | | RTFACT-31097 | General | Medium | Fixed an issue whereby, when searching for artifacts using the underscore (\_) , the underscore was considered a wildcard and lead to undesirable results. This has been changed so that when using the underscore, it will be treated as an underscore character and not a wildcard. | | RTDEV-55756 | Repositories | Medium | Fixed an issue where, after encountering a connection error with a remote repository, Artifactory prematurely reset the repository's offline status before completing an online check. | | RTDEV-55520 | Packages | High | Fixed an issue whereby after resolving the release or InRelease file using a Debian virtual repository, the merged release file didn't include components from all repositories aggregated in the virtual repository. | | RTDEV-55410 | Release Lifecycle Management | Medium | Fixed an issue whereby when trying to append an artifact to an empty build via the Build Append REST API, an error was encountered. | | RTDEV-55125 | Federated Repositories | Low | Fixed an issue whereby when using the JMX exporter to see mBean metrics, errors were encountered. | | JFUI-18147 | User Interface | Medium | Fixed an issue whereby after clicking a URL to a specific package and needing to log in, users were directed to the general package page instead of the package referred to in the URL. | | JA-17181 | General | High | Fixed an issue whereby the OIDC token exchange would fail when the Organization field was set and the Enable Permissive Configuration setting was disabled. | | JA-17058 | User Management | Medium | Fixed an issue whereby when creating a user scoped token in the UI, then changes it during creation to a group scoped token, the token is created including the username previously selected (in user scoped token UI) instead of the logged in user's username required for group scoped token. | ## Artifactory 7.111 This section includes all the Artifactory 7.111 releases. ### Artifactory 7.111.2 SaaS Released: 11 April 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTDEV-55410 | Release Lifecycle Management | Medium | Fixed an issue whereby when trying to append an artifact to an empty build via the Build Append REST API, an error was encountered. | | RTDEV-55275 | General | Medium | Fixed an issue whereby when searching for artifacts using the underscore (\_) , the underscore was considered a wildcard and lead to undesirable results. This has been changed so when using the underscore, it will be treated as an underscore character and not a wildcard. | | RTDEV-55298 | Repositories | Low | Fixed an issue whereby when trying to create a repository using the Create Repository Rest API without an "include pattern" in the input JSON, the repository was created with an empty string for the "include pattern" field. | | RTDEV-55125 | Federated Repositories | Low | Fixed an issue whereby when using the JMX exporter to see mBean metrics, errors were encountered. | ### Artifactory 7.111.1 SaaS Released: 09 April, 2025 **New Features** - **Retention Policies: Smart Archiving** The Smart Archiving Retention Policies feature is designed to streamline the management of stale artifacts in Artifactory. This new functionality facilitates the seamless movement of inactive or less frequently accessed packages from an active Artifactory instance to an archive instance connected to a low-cost, cost-effective storage solution. For more information, see [Archive](/administration/docs/archive). **Feature Enhancements** - **New Machine Learning Layout for Hugging Face Repositories** All new Hugging Face repositories are now created with the new unified Machine Learning layout. Users can also migrate legacy Hugging Face repositories to the new Machine Learning layout on a manual basis. The Hugging Face repositories legacy layout will be deprecated in September 2025 when all repositories with the legacy layout will be automatically upgraded to the Machine Learning layout. For more information, click [here](/artifactory/docs/machine-learning-repositories#machine-learning-repository-structure). - **Docker Repository Key Length Limitation on SaaS Platforms** Artifactory SaaS customers using the Docker Subdomain method will now receive a warning when creating a repository if their repository key is too long for DNS record creation. This could lead to accessibility issues if DNS is not managed internally. However, exceeding the character count does not prevent creating the repository. For more information, click [here](/artifactory/docs/docker-repositories#docker-limitations-in-artifactory). - **Release Bundle v2 auto-creation enhancements** The following enhancements are now available for the Release Bundle v2 auto-creation feature introduced in Artifactory 7.107.1: - **Creating project-specific environments during build promotion** When [promoting a build](/integrations/docs/manage-builds#promote-a-build), if the target repository (`targetRepo`) is part of a [project](/projects/docs/projects), a project-specific [environment](/administration/docs/environments) is created for the auto-created Release Bundle v2. The environment is named after the `status` value of the build. - **Giving build status priority over an existing target environment during build promotion** If the `status` is defined for a build, the [environment](/administration/docs/environments) represented by that status is always given priority during [promotion](/integrations/docs/manage-builds#promote-a-build). For example, if an environment assigned to the `targetRepo` matches the `status`, the auto-created Release Bundle v2 is promoted to that environment. (That is, it is given priority over other environments that might also be assigned to the `targetRepo`.) If no environment exists for the `status`, a new environment is created for the promoted Release Bundle v2 with the name of the status, even when other environments are available. - **Increased limits for Release Bundle v2 names and versions** The maximum length of the name (`release_bundle_name`), version (`release_bundle_version`), and creator (`created_by`) of a Release Bundle v2 has been increased to 255 characters when working with the [REST API](/governance/reference/createBundleVersion). - **Get Release Bundle v2 Versions API returns tag information** The [Get Release Bundle v2 Versions API](https://docs.jfrog.com/governance/reference/getbundleversions) now returns the descriptive tag assigned to a Release Bundle version. For more information about tagging, see [Assign Tag to Release Bundle v2 Version API](/governance/docs/tag-a-release-bundle-v2-version). - **Support for SemVer sorting in Release Bundle v2 APIs** SemVer sorting support has been added to the [Get Release Bundle v2 Versions API](https://docs.jfrog.com/governance/reference/getbundleversions) and [Get Release Bundle v2 Versions in a Specific Environment API](/governance/reference/getbundlesbyenvironment). This support is limited to the 1000 latest records and does not support pagination. This option pulls the latest 1000 records only and does not support pagination. Versions that do not conform to SemVer rules are sorted afterward lexicographically. - **New Worker Event: Before Token Expiry** JFrog now supports creating event-driven workers to trigger before a token expires. [Learn more](/administration/docs/configure-workers-for-custom-flows#before-token-expiry-worker-code-sample) - **Up to 30 environments supported** The number of environments the JFrog Platform supports has been increased from 10 to 30 global and project environments. - **Properties Tab for RPM Remote Packages** Added functionality to calculate and display the properties of an RPM package after it is downloaded from a remote RPM repository. The package properties are now shown in the **Properties** tab on the UI. For more information, see [Search by Property](/artifactory/docs/supported-search-methods#property-search) - **Policy Conditions - Cleanup Packages** - **Adding Property-based Policy Condition** Enhanced package-cleanup functionality with the addition of a **property-based** policy condition. You can now include or exclude specific package versions from cleanup by applying a property-based policy condition. This allows for more granular control over which packages are retained or removed during cleanup actions. For more information, see Create Cleanup Policy - Package. - **Adding days/weeks selection for Time-based Policy Condition** Enhanced package-cleanup functionality with the addition of **days/weeks** selection for **Time-based** policy condition. You can now configure by specifying **Time-based** cleanup conditions based on days/weeks for the packages. For more information, see Create Cleanup Policy - Package. - **Improved Performance of the Repository Selection Field in Set-Me-Up** The performance of the repository selection field in Set-Me-Up has been improved by promoting a search-first approach. - **Improved Access for Go Remote Repositories** Go remote repositories now support the ability to access subgroups in GitLab. For more information, click [here](/artifactory/docs/go-modules#proxy-gitlab-with-go). - **Added Support for Chocolatey and PowerShell Clients in Nuget Repositories** - Added support for PowerShell (minimum version 1.0.5) to interact with NuGet repositories. - Added support for Chocolatey (minimum version 1.2.0) to interact with Nuget repositories. For more information, see [NuGet Repositories](/artifactory/docs/nuget-repositories). - **Added Support for Listing Folder Items in Conan Smart Remote Repositories** - A new setting, **List Folder Items**, is now available for Conan Smart Remote Repositories. - Enabling the **List Remote Artifacts** checkbox during repository creation allows folder items to be listed. - **Hex Repositories** Artifactory now supports Hex Virtual Repository. A Hex virtual repository aggregates Hex local and remote repositories, enabling more efficient package management. To learn more, see [Hex Repositories](/artifactory/docs/hex-repositories). - **Easier Configuration of the NimModel Redirect Download Form** The NimModel redirect download form can now be configured through the User Interface. **Resolved Issues**

JIRA Issue	Component	Severity	Description
RTFACT-31075	Repositories	Low	Fixed the following two issues related to using Delete Content on a repository: - When a user with delete permissions on a repository attempted to use Delete Content on the repository, the user was denied permission to delete. - When a project admin attempted to use Delete Content on a repository shared into a project, the project admin was denied permission to delete.
RTFACT-31012	Packages	Medium	Fixed an issue whereby when switching from Recently Viewed packages to a packages custom view, the custom view was not applied and instead all packages were listed.
RTFE-1637	Packages	Medium	The Graph view was removed from the Packages tab.
RTDEV-55696	Packages	High	Fixed an issue whereby triggering indexing in a nested virtual Debian repository also triggered indexing in all parent virtual repositories.
RTDEV-55754	Packages	High	Fixed an issue whereby when trying to override an image with the exact same image, by a user without delete permission, a 403 error was encountered.
RTDEV-55692	Release LIfecycle Management	Medium	Fixed an issue whereby the Xray scan of a Release Bundle v2 version would fail if any item in the Release Bundle contained a property whose value included a surrogate pair (a way to represent special characters in UTF-16, such as an emoji). Artifactory now normalizes the surrogate pair into a string that Xray can process.
RTDEV-55463	Archiving/Cold Storage	Medium	Fixed an issue whereby Artifacts that were never downloaded from Artifactory were not deleted by Time-Based Cleanup Policies.
RTDEV-55450	Packages	Medium	Fixed an issue whereby the Promote Docker Image API renamed sub-manifest tags according to their architectures.
RTDEV-55270	Packages	Medium	Fixed an issue where maven set-me-up generated settings.xml did not support OIDC integration for use with Github actions.
RTDEV-55266	General	Medium	Fixed an issue whereby when trying to retrieve a package from a remote Maven repository, a 404 Forbidden error was encountered.
RTDEV-55208	General	Low	Fixed an issue whereby the Artifact count temporarily displayed '0' while the HQC was being refreshed.
RTDEV-54891	Packages	Medium	Fixed an issue whereby ‘symbols.nupkg’ was getting indexed post calling reindex endpoint and then restarting the Artifactory instance.
RTDEV-54831	Storage	Low	Fixed an issue whereby when attempting to perform multipart upload with the wrong repository key, the upload would get stuck when getting the upload URLs and would not complete.
RTDEV-54283	Builds	High	Fixed an issue that caused Build Uploaded and Build Deleted webhook notifications to be sent when these operations began instead of waiting for the operations to complete. This meant that if the operations failed and were rolled back, the rollback occurred after the notification indicating completion was already sent.
RTDEV-53825	Storage	Medium	Fixed an issue whereby when using Artifactory with S3 storage, enabling redirect download in the binarystore.xml file and setting signedUrlExpirySeconds to 0 or a negative value sometimes resulted in download failure.
JA-16710	Projects	Medium	Fixed an issue whereby when calling the Update Existing Project Properties REST API, the project storage quota was set to 0 and the project description was removed.

## Artifactory 7.110 This section includes all the Artifactory 7.110 releases. ### Artifactory 7.110.5 SaaS Released: 10 April 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :-------- | :------- | :-------------------------------------------------------------------------------------------------------------------- | | RTDEV-56287 | Packages | Critical | Fixed an issue whereby when attempting to upload or copy a POM file with ISO-8859-1 encoding, error were encountered. | ### Artifactory 7.110.1 SaaS Released: 25 March, 2025 **Feature Enhancements** - **New API for adding tags to Release Bundle v2 versions** You can now add a descriptive tag to a Release Bundle v2 version via REST API to help identify Release Bundle versions quickly. The tag will appear on the stages board in the platform UI to enhance visibility and organization. For example, you can create tags such as `nightly-build`, `release-candidate`, `bugfix-2025-33124`, and so on. For more information, see [Assign Tag to Release Bundle v2 Version API](https://docs.jfrog.com/governance/reference/setbundletag). - **New promotion icons on RLM Kanban board and timeline** New icons have been introduced to the Release Lifecycle Management stages board and [timeline](/governance/docs/use-the-release-bundle-version-timeline). These icons indicate at a glance what type of Release Bundle promotion was performed (copy artifacts or move artifacts). Hovering over the icon provides a tooltip reminder. For more information, see [Promote a Release Bundle v2 Version in the Platform UI](/governance/docs/promote-a-release-bundle-v2-version-in-the-platform-ui). - **Organization Enforcement for OIDC GitHub Configuration** Artifactory now supports increased security for the OIDC GitHub integration by limiting authentication to a specified organization. You can avoid using this feature by selecting the **Enable Permissive Configuration** checkbox when configuring a new OIDC integration. For more information, see [Configure an OIDC Integration](/administration/docs/openid-connect-integration#configure-an-oidc-integration). - **SCIM Token Expiry Configuration** The JFrog Platform now supports the creation of SCIM tokens with configurable expiry times. To learn more, see [Generate a Scoped Token for SCIM](/administration/docs/scim#generate-a-scoped-token-for-scim). - **Additional Support for the PyPI JSON API** Artifactory now supports PyPI’s JSON API in virtual repositories. - **Remote Repositories** Added Bearer Authentication support for remote repositories. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :------------------ | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-31104 | Packages | Medium | Fixed an issue whereby triggering the Recalculation Index on an empty Conan local repository resulted in an error, increased the Conan metadata stuck tasks, and all packages that were uploaded after the reindexing were not indexed. | | RTFACT-31082 | Packages | Medium | Fixed an issue whereby when retrieving the Packages.gz file from a virtual repository, sometimes old package information was retrieved, which lead to certain tools reporting old packages that no longer existed in the upstream. | | RTFACT-31023 | Packages | Medium | Fixed an issue whereby when configuring a NuGet Remote Repository targeting **community.chocolatey.org**, no metadata was cached when executing the "choco outdated" command. | | RTFACT-30931 | General | Medium | Fixed an issue whereby when a non-admin user using an include pattern would attempt to delete or overwrite a repository with an artifact in it that is already in the trash can, the action would fail. | | RTDEV-51247 | Packages | High | Fixed an issue that prevented locally-generated properties of various package types from being replicated. | | RTDEV-54260 | Packages | Medium | Fixed an issue whereby non-admin users were unable to create a Debian snapshot for a virtual repository. | | RTDEV-54091 | Packages | Medium | Fixed an issue whereby a user who does not have delete permissions would receive a 200 successful status code when calling the Promote Docker Image API with a copy:false parameter, even though certain artifacts were not removed from the source repository. Now, when this happens, the API returns a 206 status code, indicating partial success because the promotion was executed successfully but insufficient permissions prevented the deletion of certain artifacts from the origin repository. | | JA-16503 | General | Medium | Fixed an issue whereby when the Authentication provider name contained a space character it did not render the configuration page. | | JA-16359 | General | Medium | Fixed an issue whereby group information for a selected user was not displayed. | | JA-16274 | Platform Management | Medium | Fixed an issue where project access tokens were not getting revoked when the user who created them was removed. | | JA-16151 | Projects | Medium | Fixed an issue whereby project scope access tokens were visible from the Project Admins profile. | | JA-16046 | Platform Management | Medium | Fixed an issue whereby federated reference token authentication was not working correctly in Event APIs. | | JA-15292 | User Interface | Medium | Fixed an issue whereby there was no syntax validation for the OIDC provider URL. | | JA-13245 | User Interface | Medium | Fixed an issue whereby a Crowd user would get an internal server error when trying to unlock a user profile with a dummy or incorrect password. | ## Artifactory 7.109 This section includes all the Artifactory 7.109 releases. ### Artifactory 7.109.2 SaaS Released: 19 March, 2025 **Feature Enhancements** - **Improved Project Navigation** The Projects navigation menu now includes UI usability enhancements: it is now located in the sidebar and highlights Projects filtering to clarify context switching between Project and All Projects scope. - **SCIM Token Expiry Configuration** The JFrog Platform now supports the creation of SCIM tokens with configurable expiry times. To learn more, see [Generate a Scoped Token for SCIM](/administration/docs/scim#generate-a-scoped-token-for-scim). - **Blocking Blob Uploads If a Digest Does Not Match the Blob’s SHA-256 Checksum** Added a flag to block blob uploads if a provided digest does not match the blob’s SHA-256 checksum. This flag is disabled by default but can be enabled as needed. - **Permissions Added for Using Zapping Cache on Remote Repositories** The Zapping Cache action on remote repositories now requires **Manage** or **Delete** permissions, either via the UI or API. This change is backward-compatible. For more information on UI changes, see [Zapping Cahces](/artifactory/docs/remote-repositories#zapping-caches), and for API changes, see [Zap Cache API](https://docs.jfrog.com/artifactory/reference/zapcache). - **RPM Repositories - SHA-256 checksums have been integrated into Local and Virtual repositories** Added SHA-256 checksums to the `repomd.xml` files of local and virtual repositories. This improvement ensures package integrity verification aligns with remote repositories' security standards. Local repositories previously do not have SHA-256 checksums in their `repomd.xml` files, increasing the risk of undetected package tampering or corruption. - **Support for Vagrant and Hex in Cleanup and Archive** - Vagrant packages are now supported in Cleanup and Archive. - Hex packages are now supported in Cleanup and Archive. - **Maximum placed on bad checksum search responses** Responses to the Bad Checksum Search Bad Checksum Search API are now limited to a maximum of 10,000 results. - **Changes to Evidence GraphQL APIs** The `repositoryKey` and `path` fields have been deprecated from the Get Evidence and Search Evidence GraphQL APIs, and `subject` (which contains `repositoryKey`, `path`, `name`, and `sha256`) has been added. - **New API for removing Federation members** A new REST API enables you to remove a member from all repository Federations to which it belongs. This can be used, for example, when a site is taken out of commission. This API removes the member on this site from all the Federations in which it was a part. For more information, see [Remove Federation Member API](/artifactory/reference/removefederationmember). - **Searching for distributed Release Bundle versions containing a specific artifact** The [Get Release Bundle v2 Version Promotions with a Specific Artifact API](/governance/reference/getpromotionsbyartifact) introduced in (7.107.1) has a new query parameter has a new query parameter that can return distributed Release Bundle versions (`origin=target`) containing the artifact in addition to created Release Bundle versions (`origin=source`). This new query parameter makes it possible to run the API on Edge nodes in addition to standard Artifactory instances. - **Access Token Expiry Email Now Points to the CNAME Domain** The JFrog platform will send users Access token expiry reminder emails which include the CNAME URL instead of the JFrog instance URL **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFE-2658 | Packages | Medium | Fixed an issue whereby when using a custom CNAME for a cloud instance configured using the My JFrog Portal, the instructions on the Docker repository’s Set Me Up page had a blank space instead of the URL. | | RTFE-2577 | User Interface | Low | Fixed an issue whereby when switching to compact mode on an expanded folder, an unexpected " file/folder not found" error was thrown, even though the file/folder did exist . | | RTFE-2543 | User Interface | Medium | Fixed an issue whereby the Artifacts search window displayed erratic behavior when interacting with the drop-down menu and scroll bar. | | RTDEV-54909 | Repositories | High | Fixed an issue whereby a remote repository would remain offline even when it appeared to be back online. | | RTDEV-54887 | Release Lifecycle Management | Low | Fixed an issue that caused the evidence graph to fail when the Release Bundle contains an artifact from a build whose **build.number** property contains multiple values. | | RTDEV-54849 | Repositories | Medium | Fixed an issue whereby the Artifactory API for creating a repository would create a Release Bundle repository instead of returning an error if an unknown or misspelled repository type was sent in the input. | | RTDEV-54115 | General | Medium | Fixed an issue whereby multipart uploads were failing to virtual repositories for a non-admin user even if the user had deploy permission. | | RTDEV-53823 | Packages | Medium | Fixed an issue whereby there was inconsistent resolution behavior when multiple remote repositories were aggregated in a Terraform virtual repository. | | RTDEV-53162 | Packages | Medium | Fixed an issue whereby uploading a batch of pub packages sometimes resulted in missing versions within the generated metadata. | ## Artifactory 7.108 This section includes all the Artifactory 7.108 releases. ### Artifactory 7.108.3 SaaS Released: March 3, 2025 **Feature Enhancements** - **Support for Alpine and SBT in Cleanup and Archive** - Alpine packages are now supported in Cleanup and Archive. - SBT packages are now supported in Cleanup and Archive. - **Improved Release Lifecycle Management kanban board** The Release Lifecycle Management kanban board has been redesigned to provide more information at a glance, including clear indications of failed promotions. For more information, see [Promote a Release Bundle v2 Version in the Platform UI](/governance/docs/promote-a-release-bundle-v2-version-in-the-platform-ui). - **Compile list of inconsistent Federated repositories** A new API enables you to return a list of all Federated repositories in your local Artifactory instance that have a configuration mismatch with one or more remote members. After getting the list of mismatches, you can use the [Synchronize Federated Member Configuration API](/artifactory/reference/synchronizeFederatedMemberConfiguration) on each mismatch to synchronize the members. For more information, see [Get List of Inconsistent Federated Repositories API](https://docs.jfrog.com/artifactory/reference/getlistofinconsistentfederatedrepositories). - **Support Added for PyPI JSON API** Artifactory now supports the PyPI JSON API in local repositories with most attributes. The following attributes (JSON keys) are not supported: - Deprecated keys (releases, downloads, has_sig, bugtrack_url) as described in PyPI JSON API - The following info sub keys: description_content_type, dynamic, license_expression, license_files, maintainer, maintainer_email, project_urls, provides_extra, requires_dist - Vulnerabilities key - **Get Token Last Used Information** The JFrog Platform now supports getting a token’s ‘last used’ timestamp when using [Get Tokens API](/administration/reference/getTokens) and Get Token By ID API. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-31044 | Release Lifecycle Management | Medium | Fixed an issue that prevented certain commands from being executed on builds containing the `originalDeploymentRepo` field that were promoted using the `--copy` flag. | | RTFACT-31040 | Packages | Medium | Fixed an issue whereby Cargo repositories failed to calculate the index of the repository if the package name contained more than one hyphen. | | RTFACT-31019 | Packages | Medium | Fixed an issue whereby users could not download NuGet packages from an upstream Beckhoff TwinCAT Package Manager repository through Artifactory. | | RTFE-2714 | Packages | Medium | Fixed an issue whereby when searching for packages and applying a filter, the page flickers and no results are displayed. | | RTFE-2534 | Packages | Medium | Fixed an issue whereby in the All Packages view the same data was loaded infinitely and new data was not displayed. | | RTDEV-54667 | General | Medium | Fixed an issue whereby the email date format was displaying as YYYY instead of yyyy. | | RTDEV-53745 | Packages | Low | Fixed an issue whereby when configuring a Hugging Face smart remote repository with the prefix api/huggingfaceml, clicking the test button resulted in a 404 error even though the test was actually successful. | | RTDEV-53694 | General | Medium | Fixed an issue whereby calling the Create or Update Reverse Proxy Configuration API with invalid data led to a broken Artifactory configuration. | | RTDEV-48643 | General | Medium | Fixed an issue whereby an error was returned after upgrading to the latest Artifactory version, even though the upgrade was successful. | ## Artifactory 7.107 This section includes all the Artifactory 7.107 releases. ### Artifactory 7.107.1 SaaS Released: 12 February, 2025 **New Features** - **Packages: Hex Repositories** Hex repositories in Artifactory allow you to deploy and resolve Hex packages. For more information, refer to [Hex Repositories](/artifactory/docs/hex-repositories). (GA for all customers) - **Packages: NVIDIA NIM Models** JFrog Artifactory now integrates with NVIDIA NIM, allowing you to cache NVIDIA NIM models in Artifactory via a remote repository. NVIDIA NIM is a set of microservices designed to accelerate the deployment of foundation models across any cloud or data center, ensuring data security. It provides production-grade runtimes with ongoing security updates and stable APIs, backed by enterprise-grade support. For more information, refer to [NVIDIA NIM Repositories](/artifactory/docs/nvidia-nim-repositories). - **API Key Deprecation Control** As part of the deprecation process, API Key has reached End of Life in Q4.24. This version includes a checkbox in the JFrog platform UI allowing you to control the API Key usage deprecation. This checkbox will be deselected by default: to block API key usage in your environment, select the **Disable API Key Usage** checkbox under **Administration** > **Security** > **General**. For more information, see [JFrog API Key Deprecation Process](/user-management/docs/api-key#jfrog-api-key-deprecation-process). **Feature Enhancements** - **Auto-creation of Release Bundle v2 versions after build promotion** By default, Artifactory now creates a Release Bundle v2 version automatically when you promote a build using the JFrog CLI or [Promote Build API](/integrations/reference/promoteBuild). It also promotes the Release Bundle to the environment associated with the build's target repository, if defined. Both copy promotions and move promotions are supported. Having a Release Bundle provides better visibility and control over your release candidate as it progresses through your SDLC. - **Attach external evidence to artifacts in the local part of a virtual repository** You can now attach external evidence to artifacts located in a local repository that is aggregated inside a virtual repository. For more information about attaching external evidence, see Evidence Service. - **Viewing Evidence in the Packages Screen** You can now view a list of the [evidence](/governance/docs/evidence-management) files associated with a specific package version in a selected repository. For more information, see [View the Package Evidence Table](/governance/docs/view-evidence). - **New API for returning all Release Bundle v2 versions containing a specified artifact** A new REST API endpoint is available that returns a list of Release Bundle v2 versions containing the specified artifact. For more information, see [Get Release Bundle v2 Versions by Artifact API](https://docs.jfrog.com/governance/reference/getbundlesbyartifact). - **New API for returning all Release Bundle v2 versions in a specified environment** A new REST API endpoint is available that returns all [Release Bundle v2](/governance/docs/understanding-release-bundles-v2) versions associated with a specified [environment](/administration/docs/environments), for example, DEV or PROD. For more information, see [Get Release Bundle v2 Versions in a Specific Environment API](https://docs.jfrog.com/governance/reference/getbundlesbyenvironment). - **Move artifacts during Release Bundle v2 promotion in Platform UI** When promoting a Release Bundle v2 version using the platform UI, you can optionally move the contents of the Release Bundle from the source to the destination instead of copying them (the behavior until now). For example, if you promote a Release Bundle v2 version from the DEV environment to the QA environment and select **Move Artifacts**, the artifacts are removed from the repositories associated with DEV and moved to the repositories associated with QA. For more information, see [Promote a Release Bundle v2 Version in the Platform UI](/governance/docs/promote-a-release-bundle-v2-version-in-the-platform-ui). - **Complete Docker and OCI List Manifest Image Overwrite** When overwriting a **list.manifest** file with a new one, all previous sub-manifests will be removed, enhancing storage efficiency and reducing the need for manual cleanup. For more information, See [Tag Retention Logic](/artifactory/docs/docker-repositories#tag-retention-logic). - **Repositories can now be assigned to more than one environment** For more information, see [Assign Environments to Repositories](/administration/docs/assign-environments-to-repositories). - **Improved Cleanup Release Bundle V2 Report** The Cleanup Release Bundle V2 report has been improved. For more information, refer to [Cleanup Run Report Overview](/administration/docs/cleanup-policies#cleanup-run-report-overview). - **Support for Reading Permissions Scoped Tokens** It is now possible for non-admin users to use the [Get User List API](https://docs.jfrog.com/administration/reference/getuserlist), [Get a List of Groups API](https://docs.jfrog.com/administration/reference/getgrouplist), and [Get All Permissions API](https://docs.jfrog.com/artifactory/reference/getalldistributionpermissions) endpoints using a scoped token. For more information, see [Create Scoped Token API](https://docs.jfrog.com/administration/reference/create-scoped-token). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFE-2648 | Packages | Medium | Fixed an issue whereby when trying to use the Set me up functionality from inside the JFrog Platform Deployment with Pub, Swift, and Terraform package types, configuration options were not displayed. | | RTFE-2641 | Packages | Medium | Fixed an issue whereby when trying to create a repository in the Create a Repository window, Pub, Swift and Terraform repositories were not available. | | RTFE-2586 | Packages | Medium | Fixed an issue whereby when in the Packages window and sorting by the security column, an error would be encountered. | | RTFE-2532 | Packages | Medium | Fixed an issue whereby Gradle repositories did not have the Enable Redirect Download checkbox. | | RTFACT-31013 | Packages | Low | Fixed an issue whereby the "deprecated" field type returned by the npm view via the Artifactory npm repository was inconsistent with the npm source register. | | RTFACT-31005 | User Interface | Low | Fixed an issue whereby the option to select multiple versions to delete in the 'Delete Versions' feature was not available. | | RTFACT-30892 | General | High | Fixed an issue whereby when downloading files with Chinese characters in the file name via the "File URL", a 500 error was received. | | RTDEV-54017 | Federated Repositories | High | Fixed an issue in the legacy Federation service whereby, after an upgrade, repositories that failed Federated Metadata Negotiation had their status updated incorrectly from DISABLED_BY_SYSTEM to DISABLED, which prevented the auto-healing mechanism from performing recovery. | | RTDEV-53914 | Release Lifecycle Management | Medium | Fixed an issue whereby Release Bundle promotion failed when the Release Bundle contained artifacts in a local repository aggregated by a virtual repository. | | RTDEV-53903 | Packages | Medium | Fixed an issue whereby when uploading very large files with 1,000+ parts using multipart upload, the upload would not complete. | | RTDEV-53840 | Packages | Medium | Fixed an issue whereby when performing an Artifactory upgrade, updating of existing Helm local repositories failed with a 400 response code. | | RTDEV-52748 | Repositories | Medium | Fixed an issue where Artifactory only processed the first value for multi-value query parameters in HTTP requests to remote repositories. | | RTDEV-52654 | Packages | Medium | Fixed an issue whereby when the “Hide Existence of Unauthorized Resources” option was enabled on a local repository and Python packages were uploaded to a virtual repository associated with that local repository, a 400 error response was received instead of a 404 error response. | | JFUI-17179 | General | High | Fixed an issue where the Select Log File dropdown list was not displayed properly in the UI when the screen width was too small. | ## Artifactory 7.106 This section includes all the Artifactory 7.106 releases. ### Artifactory 7.106.4 SaaS Released: 5 February 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :-------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-53840 | Packages | Medium | Fixed an issue whereby when performing an Artifactory upgrade, updating of existing Helm local repositories failed with a 400 response code. | ### Artifactory 7.106.3 SaaS Released: 1 February 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :-------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-31038 | Packages | Critical | Fixed an issue whereby an unannounced change that was introduced by Conda Forge upstream impacts Artifactory's ability to resolve package metadata and dependencies with virtual Conda repositories. | ### Artifactory 7.106.2 SaaS Released: 30 January, 2025 **Feature Enhancements** - **Release Bundle v2 version creation using artifacts in virtual repositories** You can now create a Release Bundle v2 version using artifacts located in a [virtual repository](/artifactory/docs/virtual-repositories), provided the source path of the artifacts points to a local repository (not a remote repository) aggregated by the virtual repository. This feature is relevant when creating a Release Bundle version from a list of artifacts. - **Move artifacts during Release Bundle v2 promotion** When [promoting](/governance/docs/promote-a-release-bundle-v2-version-in-the-platform-ui) a Release Bundle v2 version using the REST API, you can optionally move the contents of the Release Bundle from the source to the destination instead of copying them (the behavior until now). For example, if you promote a Release Bundle v2 version from the DEV environment to the QA environment and set the operation to **Move**, the artifacts are removed from the repositories associated with DEV and moved to the repositories associated with QA. For more information, see [Promote Release Bundle v2 Version API](https://docs.jfrog.com/governance/reference/createpromotion). - **New API for finding Release Bundle v2 promotions with a specified artifact** A new REST API endpoint is available that returns promoted Release Bundle v2 versions containing a specified artifact. For more information, see [Get Release Bundle v2 Version Promotions with a Specific Artifact API](https://docs.jfrog.com/governance/reference/getpromotionsbyartifact). - **Added Support for the PyPI JSON API in Remote Repositories** Artifactory now supports PyPI’s JSON API in remote repositories. For more information, click here. - **Added Tags for RPM local repositories** Added support for the `Recommends` and `Suggests` dependency tags in the `primary.xml` metadata of RPM local repositories enhancing package management for clients like `dnf` and `yum` by recognizing optional dependencies. To learn more, refer to [Install RPM Packages Using Yum](/artifactory/docs/rpm-repositories#install-rpm-packages-using-yum). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-31017 | Packages | Medium | Fixed an issue whereby missing Vagrant .box properties caused 500 internal server errors when resolving boxes. | | RTFACT-30794 | Release Lifecycle Management | Medium | Fixed an issue whereby when creating a Release Bundle v2 for an OCI Helm Image, SHA files for layers were missing. | | RTDEV-53176 | General | Medium | Fixed an issue whereby Artifactory could not retrieve an artifact from a remote repository if there were square brackets "\[]" in the artifact name. | | RTDEV-53064 | Database | Medium | Fixed an issue whereby MariaDB JDBC driver 3.4.1 was not working with Artifactory 7.98.9 after upgrading from Artifactory 7.84.21. | | RTDEV-52983 | General | High | Fixed an issue whereby when upload to S3 storage failed for an aritfact, a 200 OK message was entered in the **artifactory-request.log**. | | RTDEV-52844 | Packages | Medium | Fixed an issue whereby all Docker image layers appeared as RUN layers. | | RTDEV-52751 | Storage | Medium | Fixed an issue whereby the cache-fs synchronization process was stopped prematurely if an entry in the cache folder was inaccessible and resulted in the actual cache size being larger than the displayed cache size. | | RTDEV-50452 | Packages | Medium | Fixed an issue whereby Debian virtual metadata requests were triggering extra metadata calculations even if the cache had not expired. | ## Artifactory 7.105 This section includes all the Artifactory 7.105 releases. ### Artifactory 7.105.2 SaaS Released: 21 January 2025 **New Features** - **Packages: Hex Repositories** Hex repositories in Artifactory allow you to deploy and resolve Hex packages. For more information, refer to [Hex Repositories](/artifactory/docs/hex-repositories). (open to selected customers) **Feature Enhancements** - **Support for Triggering Partial Reindexing of Helm Charts** Added support for triggering partial reindexing of Helm charts, enabling more efficient and targeted **index.yaml** updates. This improvement reduces processing time and resource usage. For more information, see [Helm Charts Partial Re-Indexing](/artifactory/docs/kubernetes-helm-chart-repositories#helm-charts-partial-re-indexing), - **Improvement to Maven Set-Me-Up Placeholders** Maven set-me-up placeholders will now automatically populate. - **Support for Conda in Cleanup and Archive** Conda packages are now supported in Cleanup and Archive. - **Supported Worker Features** - `Alt Response` event is now supported. - `Alt All Responses` event is now supported. - `Alt Remote Content` event is now supported. - `After Download Error` event is now supported. - `Before Download Request` event is now supported. - `Before Build Info Save` event is now supported. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :----------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFE-2467 | Packages | Medium | Fixed an issue whereby when the cache retrieval period for metadata was updated via the UI, the values were not applied. | | RTFE-2445 | User Interface (UI) | Low | Fixed an issue whereby when the "filter by" option was selected in the Artifactory Artifacts view, then switching from one project to another, the selection remained but Artifactory did not actually update the filter results as required to reflect the selected project. | | RTDEV-52470 | Builds | Medium | Fixed an issue where by when refreshing the UI, the projects build page would display different results. | | RTDEV-51424 | Builds | Low | Fixed an issue whereby on the Builds Tab of an artifact in the artifacts tree, the "Go to Build" button would not work if the build name contained a slash hyphen (/-). | | RTDEV-51363 | General | Medium | Fixed an issue whereby Apache Tomat version 10.1 that was bundled in Artifactory 7.98.7 contained an issue whereby when sending HEAD requests where the resource size was unknown, the server returned a content-length=0 header instead of omitting the header. | | RTDEV-50987 | Packages | Medium | Fixed an issue whereby when working with a Gems virtual repository and running the API "/api/v1/versions/" a 500 error was displayed. | | RTDEV-50832 | Repositories | Low | Fixed an issue whereby non-admin user selecting "Show All Included" on a virtual repository that contains another virtual repository don’t see the other virtual repository. | | JFUI-17125 | Authentication Providers | Medium | Fixed an issue whereby when using SAML with “Auto Redirect Login Link To SAML Login” enabled, logout from another realm logged you into SAML instead of logging out completely. | ## Artifactory 7.104 This section includes all the Artifactory 7.104 releases. ### Artifactory 7.104.2 SaaS Released: 15 January, 2025 **New Features** - **Evidence Service** JFrog's new Evidence service generates an audit trail that documents all the security, quality, and operational steps taken to produce a production-ready software release. It enriches artifacts, packages, builds, and [Release Bundles](/governance/docs/understanding-release-bundles-v2) with signed attestation metadata (based on the in-toto Attestation Framework) that can be tracked and verified easily for governance and compliance. The Evidence service enables you to seamlessly consolidate information from all the tools and platforms used in software development into a trusted single source of truth. It also integrates seamlessly with [Release Lifecycle Management](/governance/docs/release-lifecycle-management), providing a graphical interface for viewing the evidence generated at each stage of your SDLC. Artifactory creates signed evidence automatically when Release Bundles are [promoted](/governance/docs/promote-a-release-bundle-v2-version-in-the-platform-ui) and [distributed](/governance/docs/distribute-release-bundles-v2). When used in conjunction with JFrog Xray, additional evidence is created in the form of SBOMs and vulnerability reports. In addition, Enterprise+ users can attach externally-produced evidence to artifacts, packages, builds, and Release Bundles using the JFrog CLI. For more information, see [Evidence Management](/governance/docs/evidence-management). - **Artifactory Federation Service** To meet the growing needs of customers, JFrog has moved the [Federated repositories](/artifactory/docs/federated-repositories) feature into a standalone, multi-tenant service to ensure the timely synchronization of huge volumes of artifact metadata between customer sites. The new standalone service offers the following benefits: - **Scalability**: The Federation service is designed from the ground up to grow as the needs of our customers grow. - **Automatic Federation recovery**: The Federation service features an improved auto-healing mechanism that can identify synchronization problems between members due to an exhausted queue (a queue that has exceeded the maximum number of attempts to send metadata events to other members), reset the failed events, and retry synchronization. This capability is particularly useful in the event a Full Sync operation is interrupted by a restart of one of the Artifactory instances that host a Federation member. For more information, see Federation Recovery and Auto-Healing. - **Improved monitoring using the Federation dashboard**: The new Federation dashboard enables you to: - Understand the health status of all your repository Federations at a glance. The dashboard makes it particularly easy to see how many repositories are in error or delayed. For more information, see View the Status of All Repository Federations. - Drill down into a selected Federation to see the state of each member at a glance. For more information, see View the Status of a Selected Repository Federation. - Give selected repositories priority to system resources to help ensure all their metadata events are synchronized with other Federation members. For more information, see [Prioritize Federated Repository](/artifactory/reference/prioritizeFederatedRepository). - **Using the Federation Comparison Tool on Federated Repositories** Users who have the [Artifactory Federation Service](/artifactory/docs/federated-repositories#artifactory-federation-service) installed can use the Federation Comparison Tool to compare the state of a Federated repository with one or more remote members to detect missing artifacts in those remote members. This enables you to simulate the results of a Full Sync operation before you perform it. The Federation Comparison tool is invoked using a new query parameter in the [Federated Repository Full Sync API](/installation/docs/artifactory-federation-service-rtfs). For more information, see Use the Federation Comparison Tool. - **Cleanup Policies: Release Bundle v2** JFrog Cleanup Policies for Release Bundle v2 enable Platform and Project Administrators to define and customize policies based on specific criteria for removing unused Release Bundles across their JFrog platform. This provides optimal system performance. Administrators can customize a repeatable cleanup process that aligns with their organization's requirements by setting specific criteria and rules. For more information, refer to [Cleanup Policies](/administration/docs/cleanup-policies). - **Helm Enforce Layout** Helm Enforce Layout is designed to maintain the integrity and organization of Helm charts within your repositories. It consists of two key functionalities that promote structure and reduce errors during deployments: - Preventing duplicate chart paths: Prevents the deployment of charts with the same name and version to different paths within the same repository, by ensuring that only a single instance of a chart is indexed. This maintains the integrity and accessibility of Helm charts, ensuring that users can easily identify and deploy the desired version without confusion. - Enforcing chart names and versions: Ensures that the chart name and version specified in the packaged file name match the values in Chart.yaml and adhere to Semantic Versioning (SemVer) standards adopted by the Helm official specification. Enforcing these rules promotes uniformity, allowing teams to adopt clear naming conventions that foster better collaboration and understanding of changes across different versions. For more information, see Helm Enforce Layout. **Note** Helm Enforce Layout is forward-compatible only, it will not work on repositories created prior to Artifactory 7.104.2. This means that even if you upgrade to Artifactory 7.104.2, any repositories created prior to the upgrade are not compatible with this feature. Enforcement is set only upon repository creation. **Feature Enhancements** - **Updating multiple repositories using a batch request** It is now possible to update the configuration of multiple repositories using a single batch request. The request can contain a mixture of package types (for example, Docker and Maven) and repository types (for example, local and remote). For more information, see [Update Multiple Repositories](/administration/docs/stages-lifecycle). - **Viewing contents of Release Bundle v2 versions by package type** The window for viewing the contents of a Release Bundle v2 version has been redesigned to organize the contents according to package type. You can drill down from a package type to individual packages and from there, click a link to see the individual artifacts. For more information, see [View the Contents of a Release Bundle v2 Version](/governance/docs/view-the-contents-of-a-release-bundle-v2-version). - **Promoting Release Bundle v2 versions to virtual repositories** You can now promote a Release Bundle v2 version to a virtual repository, provided it contains at least one local repository assigned to the same environment as the virtual repository (or no environment at all). For more information about promotion, see [Promote a Release Bundle v2 Version in the Platform UI](/governance/docs/promote-a-release-bundle-v2-version-in-the-platform-ui). - **Virtual repositories can include repositories not assigned or shared to the same project** You can now edit a virtual repository configuration that contains local and remote repositories which are not [assigned](/projects/docs/assign-multiple-projects-to-resources) to, or [shared](/projects/docs/share-repositories-across-multiple-projects) with, the same [project](/projects/docs/projects) as the virtual repository. If such repositories are aggregated, a message appears in the UI. Click the button next to the message to display a list of these repositories. You can export this list to a CSV file. For more information, see Virtual Repositories and Projects. **Note** Users who can perform actions on the virtual repository (based on their assigned [roles](/projects/docs/manage-project-roles-and-members) in the relevant project) are not automatically granted permissions to aggregated repositories not assigned or shared with the same project. - **Improved Performance for the Fetching Process** Performance of the fetching process has been improved, based on the count of manifests relative to the Max Unique Tags configuration. - **Improvements in Obtaining AQL Results** The Search AQL API was improved such that AQL results are complete and not missing properties. A notification is now provided informing the client when the AQL limit has been reached. For information, see [Artifactory Query Language (AQL) API](https://docs.jfrog.com/artifactory/reference/searchaql). - **Support for Ansible Packages in Cleanup and Archive** - Frog ML models are now supported in Cleanup and Archive. - Ansible packages are now supported in Cleanup and Archive. - **Supported Worker Features** - **Support for Scheduled Workers** JFrog now supports creating scheduled workers to trigger at predefined times or intervals, which you can define using Cron expressions. For more information, see [Configure a Scheduled Worker](/administration/docs/configure-workers-for-custom-flows#configure-scheduled-worker) - `Before Build Info Save` event is now supported. - `Before Download Request` event is now supported. - **OIDC Multiple Token Scopes** The Jfrog Platform now supports adding multiple scopes to OIDC identity mapping tokens, enabling you to use both user and group scopes for the same token. - **Enabling SSO Disables Basic Authentication By Default** Enabling single sign-on authentication now disables internal password authentication by default. For more information, see Disable Basic Authentication Method. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :----------------------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30969 | Packages | Medium | Fixed an issue whereby it was not possible to download and install a Go nested module from a private GitLab using a Go remote repository, and when trying to do this it resulted in a 404 error. | | RTFACT-30928 | Packages | Medium | Fixed an issue whereby webhooks were not being triggered by the npm deprecate command. | | RTFACT-30896 | Packages | Medium | Fixed an issue where reindexing did not happen automatically after distributing a Release Bundle for Cocoapods. | | RTDEV-52453 | Federated Repositories | Medium | Fixed an issue whereby a binary task was sometimes not created for a federated repository. | | RTDEV-51529 | Federated Repositories | Medium | Fixed an issue during pull replications that caused changes to property values to be added to existing property values on the target instead of overriding the existing values. | | RTDEV-51525 | User Interface | Medium | Fixed an issue whereby the trash can could not be disabled through the User Interface with a Pro license. | | RTDEV-51363 | General | Medium | Fixed an issue whereby Apache Tomat version 10.1 that was bundled in Artifactory 7.98.7 contained an issue whereby when sending HEAD requests where the resource size was unknown, the server returned a content-length=0 header instead of omitting the header. | | RTDEV-50220 | Packages | Medium | Fixed an issue whereby a Debian virtual repository was generating a packages metadata file in gz format when requested for a plain text file. | | RTDEV-49674 | Storage | High | Fixed an issue whereby when Artifactory was configured with Cloudfront (AWS CDN), and a file larger than 50 GB was requested, the client received a 400 error. | | RTDEV-49456 | Repositories | Low | Fixed an issue whereby when trying to create a remote Gradle repository with the "Quick Repository Creation" option, the remote repository that was created was a Maven repository instead of Gradle. | | RTDEV-48039 | General | Medium | Fixed an issue whereby the Permission Target and Groups did not appear under the Effective Permissions tab of a remote cache repository. | | JA-15155 | General | Medium | Fixed an issue where certain global roles could not be edited or were grayed out. | | JA-15134 | Authentication Providers | High | Fixed an issue whereby Oauth user was not able to login to Artifactory. | | JA-15109 | User Interface | High | Fixed an issue where the Manage Intergrations (Administration \| General Management \| Manage Integrations) page was unavailable in the UI for hybrid deployments with Edge license. | | JA-14805 | Database | Low | Fixed an issue whereby duplicate resources existed during import and migration. | | JA-14796 | Projects | Medium | Fixed an issue whereby deleting a project caused the read-only access of the shared repository to be reset for other projects as well. | ## Artifactory 7.103 This section includes all the Artifactory 7.103 releases. ### Artifactory 103.1 SaaS Released: 20 December, 2024 **Resolved Issue** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :------------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30981 | User Interface | High | Fixed an issue whereby, in some cases, attempting to deploy an artifact via the "Deploy" option in Artifactory resulted in a list of repositories in the dropdown that was incomplete or empty. This occurred even though the user had the necessary deployment permissions for specific repositories. | ### Artifactory 7.103.0 SaaS Released: 16 December, 2024 **New Features** - **New REST API for Checking Repository Existence** A new REST API has been added to check whether a repository exists based on the project key and repository type. For more information, see [Check if Repository Exists in a Project API](https://docs.jfrog.com/artifactory/reference/checkifrepositoryexists). **Feature Enhancements** - **Converting Federated repositories back to local** You can now convert a Federated repository back to a local repository using a REST API, provided it is not part of a Federation containing additional members. For more information, see [Convert Federated Repository to a Local Repository API](/artifactory/reference/convertFederatedRepositoryToLocal). - **Supported Worker Events** - **Storage: After Copy** event is now supported. - **Storage: After Property Delete** event is now supported. - **Replication: Before Directory Replication** event is now supported. - **Storage: After Property Create** event is now supported. - **Added Clients for PyPI Repositories** PyPI repositories now support Poetry and Twine clients. For more information, See [Connect Your PyPI Client to Artifactory.](/artifactory/docs/pypi-repositories#connect-your-pypi-client-to-artifactory). - **Support for Terraform BE Packages in Cleanup and Archive** Terraform BE packages are now supported in Cleanup and Archive. **Resolved Issues**

JIRA Issue	Component	Severity	Description
RTFACT-30926	Repositories	Medium	Fixed an issue whereby there was no option in the UI to disable the “List Remote Artifacts” option for Maven remote repositories.
RTFACT-30923	Release Lifecycle Management	Medium	Fixed an issue whereby, the REST API Promote Release Bundle v2 Version was missing the included repositories validation.
RTDEV-51199	General	Medium	Fixed an issue whereby when viewing a virtual repository in a tree browser, the message This item is not cached. appeared for an artifact in that repository even though it was cached.
RTDEV-50995	General	Medium	Fixed an issue whereby Artifactory was sending an empty project key instead of the default project key.
RTDEV-49625	General	Medium	Fixed an issue whereby internal users with “Disable Internal Password” enabled were getting password expiration emails.
RTDEV-50824	Release Lifecycle Management	High	Background: Since a Release Bundle v2 cannot resolve dependencies located in a remote cache repository, users must first copy the dependency artifacts to a local repository. Fixed an issue during Release Bundle creation that prevented Artifactory from giving preference to the local repository that contains the dependencies instead of the remote cache repository.

**Known Issue with Pull Replications** There is a [known issue](/releases/docs/artifactory-known-issues#artifactory-7212-known-issues) whereby properties generated locally by Artifactory are deleted during pull replications when the properties are unchanged from the previous replication execution. The current workaround is to add a custom property to the package. This is sufficient to prevent the locally-generated properties from being deleted. ## Artifactory 7.102 This section includes all the Artifactory 7.102 releases. ### Artifactory 7.102.0 SaaS Released: 2 December, 2024 **New Features** - **Machine Learning Repositories** Machine Learning Repositories with the FrogML SDK is a local management framework tailored for machine learning projects, serving as a central storage for models and artifacts, featuring a robust version control system. It offers local repositories and an SDK for effortless model deployment and resolution. Machine Learning Repositories offer the following benefits to your system: - **Secure Storage:** Protect your proprietary information by deploying models and additional resources to Artifactory local repositories, giving you fine-grain control of the access to your models. - **Easy Collaboration:** Share and manage your machine learning projects with your team efficiently. - **Easy Version Control:** The Machine Learning Repositories SDK (FrogML) provides a user-friendly system to track changes to your projects. You can name, categorize (using namespaces), and keep track of different versions of your work. For information on Machine Learning Repositories, click [Machine Learning Repositories](/artifactory/docs/machine-learning-repositories). **Feature Enhancements** - **Improvements to Conan Reindexing Speed on Large Repositories** The process for reindexing large Conan repositories has been optimized and is now half the time from what it was previously. Added Conan packages are available for indexing immediately even during the reindexing process. - **Enhanced Webhook Event Support for OCI and Docker Images** In this release, the Webhook events functionality for Docker images has been expanded to include support for OCI repositories and images. These enhancements made include: - **Support for OCI Repositories:** Webhook events can now be triggered for OCI repositories, broadening the integration capabilities. - **Support for OCI Images:** Events related to OCI images are now fully supported, ensuring that actions on these images are captured. - **New **`image_type`** Key:** A new `image_type` key has been added to the event action payload, indicating whether the action was performed on an OCI or Docker image. For more information, click [Webhooks Domain: Docker](/administration/docs/event-types#domain-docker). - **Additional Keys Added to the Webhook Promoted Event in the Docker Domain** The Image Promotion Webhook in the Docker domain has been expanded with two additional keys: - **targetRepo:** The repository where the image is promoted to. - **targetTag:** The new tag of the promoted image. For more information, click [Domain: Docker](/administration/docs/event-types#domain-docker). - **Support for OCI and Cargo Packages in Cleanup and Archive** - **OCI**: Helm OCI and OCI packages are now supported in Cleanup and Archive. - **Cargo**: Cargo packages are now supported in Cleanup and Archive. - **Supported Worker Events** - **Storage:beforeCreate**: `beforeCreate` event is now supported. - **Storage:beforeCopy**: `beforeCopy` event is now supported. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :------------------ | :------- | :--------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30922 | Packages | Medium | Fixed an issue with RPM packages, whereby if one of the _provides_ versions was '-’, indexing of the package failed. | | RTFACT-30889 | Packages | Low | Fixed an issue whereby, the **/npm/auth** endpoint did not return the user email when using an access token for authentication. | | JA-13448 | Platform Management | High | Fixed an issue whereby unused licenses that were removed from the access configuration were not removed from the platform configuration. | | INST-7815 | Installation | Medium | Fixed an issue whereby the router service was not shutting down gracefully before starting Tomcat. | ## Artifactory 7.101 This section includes all the Artifactory 7.101 releases. ### Artifactory 7.101.2 SaaS Released: 25 November 2024 **Feature Enhancements** - **Support for a default key when creating Release Bundles v2 in the platform UI** It is no longer mandatory to select a signing key when [creating](/governance/docs/create-a-release-bundle-v2-in-the-platform-ui) a Release Bundle v2 with the platform UI. If you do not select a key, Artifactory uses a default GPG key that it creates automatically. The default key is then used for future Release Bundles unless a different key is selected during Release Bundle creation. The default key created by Artifactory is displayed in the Keys Management table. **Note** Support for the default key will be added to the JFrog CLI in an upcoming release. - **New Content tab in Release Lifecycle Management timeline** The Release Lifecycle Management [timeline](/governance/docs/use-the-release-bundle-version-timeline) contains a new Content tab that lists the artifacts in the selected Release Bundle v2 version. For more information, see [View the Contents of a Release Bundle v2 Version](/governance/docs/view-the-contents-of-a-release-bundle-v2-version). - **Enhanced Docker List Tags REST API Compatibility** The Docker List Tags REST API has been enhanced to support both the full and shorthand conventions for referencing official Docker images. Users can now retrieve tags using either the complete path (including /library/) or the shorter version without it. For more information about the API see [List Docker Tags API](/artifactory/reference/listDockerTags). - **Promotion Plugin Upgraded to Groovy 4** Artifactory 7.101 is bundled with Groovy 4. The Promotion Plugin has been updated for Groovy 4 and must be redeployed after upgrading to 7.101 or above. **Note** Other JFrog Supported Plugins (Groovy 3 or older versions) work without redeploying after 7.101 or above upgrade. If you have custom plugins developed before Groovy 4, you must update them to ensure compatibility with Groovy 4, as Artifactory version 7.101 (and above) will come bundled with Groovy 4. Plugins written for earlier versions of Groovy (Groovy 3 or older) may no longer work and will require changes to work correctly from Artifactory version 7.101 (and above). To learn more, refer to User Plugins README. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------------------------------------------------------------------------------------------------- | :----------------------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30871 | Packages | Medium | Fixed an issue whereby failure occurred when clicking Test Connection with OAUTH enabled and using an NPM Smart Remote Repository, and displayed a 500 error. | | RTFACT-30853 | Builds | Medium | Fixed an issue whereby when clicking the build info link in the user interface for a VCS build, the link was inactive. | | RTFACT-30848 | Packages | Medium | Fixed an issue whereby it was not possible to publish an Ansible-Galaxy pre-release collection if it contained a hyphen in the file name. | | RTFACT-308444 | Packages | Medium | Fixed an issue whereby when running the group list command on a YUM/RPM virtual repository that contained both local and remote repositories, no groups were listed. | | RTFACT-30805 | Storage | Medium | Fixed an issue whereby the API for getting a list of failed binary tasks would return a 200 status for non-existing repositories. | | RTDEV-50095 | Packages | High | Fixed an issue whereby when Artifactory is operating on Windows and a user attempted to deploy a Maven project, deployment failed. | | RTDEV-49236 | General | Medium | Fixed an issue whereby the REST API for updating project and environment information for a repository did not update this information. | | RTDEV-49231 | General | Medium | Fixed an issue whereby after unused artifacts cleanup, empty folders in the remote-cache repository were not removed during the empty folder pruning global job. | | META-1854 | User Interface | Medium | Fixed an issue whereby some of Digest IDs for Docker tags did not appear in the packages view in the Artifactory user interface. | | JA-14648 | General | High | Fixed an issue whereby permission targets having “per repository” patterns were not federated properly with Access Federation when having more than 2 repositories with patterns. | | JA-14625 | Authentication Providers | Medium | Fixed an issue whereby the OAuth configuration in cloud instances incorrectly included the **Use Default Proxy Configuration** checkbox, which can only be used in on-prem environments. | | JA-14560 | Authentication Providers | Low | Fixed an issue whereby the LDAP settings got reordered when editing the settings. | | JA-14557 | Authentication Providers | Low | Fixed an issue whereby LDAP users had access to the 'Change Password' option in the Edit Profile page. | | JA-14496 | Authentication Providers | Medium | Fixed an issue whereby attempting to set up Azure OIDC integration with Artifactory resulted in an error message stating, "Failed to find public key matching the kid." | | INST-8369 | Installation | Medium | Fixed an issue related to Helm installation whereby, the ‘cacheProviderDir’ and ‘maxCacheSize’ properties were swapped in the "google-storage-v2-direct" binarystore.xml template. | ## Artifactory 7.100 This section includes all the Artifactory 7.100 releases. ### Artifactory 7.100.2 SaaS Released: 5 November, 2024 **New Features** - **Upgrade to Apache Tomcat 10.1** The Apache Tomcat version bundled with Artifactory has been upgraded to version 10.1. **Feature Enhancements** - **Significant Changes to the Packages User Interface** Significant changes have been made to the Packages User Interface (UI). From the Packages home page, you can now view a list of the most recently viewed packages, and an upgraded filter option has been added that allows you to create refined filters on the packages list to easily see the packages that interest you. After creating the filter, you can save it as a customized view for later use and reference. For more information, click [here](/artifactory/docs/viewing-packages). - **Default key creation for Release Bundles v2** It is now possible to create with the [Release Bundle v2 API](/governance/reference/createBundleVersion) without specifying an existing signing key. In such cases, Artifactory creates a default GPG key that is used to sign the Release Bundle. This default key is then used for future Release Bundles unless a different key is selected during Release Bundle creation. The default key created by Artifactory is displayed in the Keys Management table. **Note** In the current release, a default key is created only when creating the Release Bundle v2 using the REST API. It is still mandatory to select an existing signing key when using the JFrog CLI or [platform UI](/governance/docs/create-a-release-bundle-v2-in-the-platform-ui). - **Maximum Default Value Added to Limit the Search/AQL API Call Response** A fixed value of 500000 was set as the default maximal result set size to limit the search/AQL API call response. - **Support for Hugging Face Packages in Cleanup** Hugging Face packages are now supported in Cleanup. - **Improved Recovery from S3 SlowDown Error** Recovery from an "S3 SlowDown error" that occurrs when uploading files to an S3 bucket was improved. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :----------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30858 | Packages | Medium | Fixed an issue whereby when installing NuGet packages that contain a ‘+’ in the version, the installation failed and 404 error messages were returned. | | RTFACT-30841 | User Interface | Medium | Fixed an issue whereby when configuring a virtual repository, if a repository was the "Default Deployment Repository" and then was removed from the virtual repository, the removed repository remained as the "Default Deployment Repository". | | RTFACT-30838 | General | Medium | Fixed an issue whereby when a user had permission to a repository that was aggregated to a virtual repository, the user was able to see repositories for which he did not have permission in the "Included Repositories" section of the virtual repository. | | RTFACT-30835 | Packages | Medium | Fixed an issue whereby the Cocoapods parser was only able to parse a podspec file when the file was started with 's' and was not able to read the file when it was starting with 'spec'. | | RTFACT-30811 | Packages | Medium | Fixed an issue whereby when using Artifactory as a CDN, packages like PLCrashReporter with additional keys in the podspec 'source' field (alongside HTTP) could not be downloaded. | | RTDEV-49436 | Repositories | Medium | Fixed an issue whereby the Smart Remote Repository options were automatically enabled even after disabling those options in the user interface. | | RTDEV-49391 | Repositories | Medium | Fixed an issue whereby users were unable to add an environment to an existing repository in the Repository Configuration page. | | RTDEV-48758 | Builds | Medium | Fixed an issue whereby when creating a project, deleting it, and creating a new project with the same key as the deleted project, the build-info repository of the deleted project was not associated with the new project that has the same key. | | RTDEV-48363 | Packages | Medium | Fixed an issue whereby when “Block unscanned artifacts” was selected in Xray’s policy and a package had violations, that package did not appear in the Packages list in Artifactory. | | JA-14599 | Authentication Providers | High | Fixed an issue to convert group names to lowercase during synchronization and resolve groups based on their external IDs. | ## Artifactory 7.99 This section includes all the Artifactory 7.99 releases. ### Artifactory 7.99.1 SaaS Released: 21 October 2024 **Feature Enhancements** - **Support for Terraform and CocoaPods Packages in Cleanup** - **Terraform**: Terraform packages are now supported in Cleanup. - **CocoaPods**: CocoaPod packages are now supported in Cleanup. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :----------------------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-48779 | Packages | Critical | Fixed an issue whereby in some packages, X-Artifactory-Xray-Origin: true was not returned correctly for blocked package, resulting in a wrong status code for smart remote repositories | | RTDEV-49156 | Packages | Medium | Fixed an issue whereby Xray failed to scan Hugging Face local models when the model ID was missing from the README file. | | RTDEV-42940 | Packages | Medium | Fixed an issue related to Cargo whereby, under certain circumstances, Artifactory failed to install a package from a local repository after copying it from a remote cache. | | RTDEV-34149 | Packages | Medium | Fixed an issue whereby, when pushing a multi-architecture layer that already exists in the system, Artifactory created a redundant appearance of the layer with its architecture name. | | RTDEV-48522 | General | Medium | Fixed an issue whereby after configuring an include/exclude pattern on a virtual repository, the pattern was not applied and items weren't included in the Artifact tree. | | JA-14599 | Authentication Providers | High | Fixed an issue to convert group names to lowercase during synchronization and resolve groups based on their external IDs. | ## Artifactory 7.98 ### Artifactory 7.98.18 SaaS Released: 27 March 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :-------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-55754 | Packages | High | Fixed an issue whereby when trying to override an image with the exact same image, by a user without delete permission, a 403 error was encountered. | ### Artifactory 7.98.15 SaaS Released: 1 February 2025 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :-------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-31038 | Packages | Critical | Fixed an issue whereby an unannounced change that was introduced by Conda Forge upstream impacts Artifactory's ability to resolve package metadata and dependencies with virtual Conda repositories. | ### Artifactory 7.98.10 SaaS Released: 9 December 2024 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :--------------------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-51064 | Federated Repositories | Medium | Fixed an issue where binary tasks were not being removed correctly when there was no binary present due to unneeded iterations over remote binary providers. | | RTDEV-49625 | General | Medium | Fixed an issue whereby internal users with “Disable Internal Password” enabled were getting password expiration emails. | ### Artifactory 7.98.9 SaaS Released: 25 November 2024 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :----------------------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | JA-14560 | Authentication Providers | Low | Fixed an issue whereby the LDAP settings got reordered when editing the settings. | | JA-14557 | Authentication Providers | Low | Fixed an issue whereby LDAP users had access to the **Change Password** option in the _Edit Profile_ page. | | RTDEV-46982 | Federated Repositories | Medium | Fixed an issue whereby out-of-sync and exhausted Federations were presented as Federated in the Federation Sync Status page. These Federations are now given a status of Delayed. | | RTDEV-49236 | General | Medium | Fixed an issue whereby the REST API for updating project and environment information for a repository did not update this information. | | JA-14648 | General | High | Fixed an issue whereby permission targets having _per repository_ patterns were not federated properly with Access Federation when having more than 2 repositories with patterns. | | INST-9282 | Installation | Medium | Fixed an issue where the `signedUrlExpirySeconds` parameter in the Artifactory Helm Chart defaults to false instead of being a number. | | INST-9289 | Installation | Medium | Fixed an issue where the attribute `encodedSolidusHandling=DECODE` goes missing in the `server.xml` file when Mission Control is enabled. | | INST-9333 | Installation | Low | Fixed an issue where several secrets in the Evidence container of the Artifactory-HA Helm Chart are configured with `artifactory.fullname` instead of `artifactory-ha.fullname`. | | INST-9286 | Installation | Medium | Fixed an issue where the crontab file increases in size with every restart of the Nginx container in a Docker Compose installation, leading to storage issues. | | RTDEV-49209 | Packages | Medium | Fixed an issue whereby when running the group list command on a YUM/RPM virtual repository that contained both local and remote repositories, no groups were listed. | ### Artifactory 7.98.2 SaaS Released: 13 October, 2024 **New Features** - **Cleanup Policies** JFrog Cleanup Policies enable Platform and Project Administrators to define and customize policies based on specific criteria for removing unused binaries from across their JFrog platform. This provides control over storage utilization and ensures optimal system performance. By setting specific criteria and rules, administrators can customize a repeatable cleanup process that aligns with their organization's requirements. For more information, see [Cleanup Policies](/administration/docs/cleanup-policies). - **Support for Multi-Architecture Tag Deletion** Artifactory now supports deleting multi-architecture Docker and OCI image tags with one action. For more information, see [Delete Multi-Architecture Docker Tags](/artifactory/docs/docker-repositories#delete-multi-architecture-docker-tags). **Feature Enhancements** - **Cannot modify or delete files that belong to a promoted Release Bundle v2** To protect the immutability of Release Bundles v2, users are now blocked from modifying or deleting a file that belongs to a [promoted](/governance/docs/promote-a-release-bundle-v2-version-in-the-platform-ui) Release Bundle. Users must first [delete](/governance/docs/promotion-rollback) the promotion or [delete](/governance/docs/delete-a-release-bundle-v2-version) the Release Bundle version altogether before the files can be modified or deleted. - **Release Bundles v2 protected from expired GPG keys** When a user attempts to create, promote, or distribute a Release Bundle v2 version, the action is now blocked if the GPG key has expired. - **Cargo index/config.json API Aligned with the Cargo Specs** The Cargo index/config.json API has been aligned to the Cargo specs so that it now returns a response even if a user has no permissions on a repository and invokes an auth-challenge. - **New worker services** New dedicated workers now support the **BeforePropertyDelete** and **BeforeDelete** events. - **Support for OIDC Forward Proxy Configuration** The JFrog Platform OIDC integration now supports the configuration of a forward proxy. For more information, see [Manage Proxy Servers](/administration/docs/manage-proxy-servers). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :----------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFE-1940 | Repositories | Medium | Fixed an issue whereby the Set Me Up page showed the wrong URL for Docker repositories with a sub-domain method configured in SaaS. | | RTFE-1918 | User Interface | Medium | Fixed an issue whereby the Set Me Up page would get stuck when clicking on “Generate Token & Create Instructions”. | | RTFACT-30801 | General | Medium | Fixed an issue whereby, items were not displayed in a native browser in virtual repositories but were displayed in a native browser in local repositories. | | RTFACT-30784 | Packages | Medium | Fixed an issue whereby a Yum virtual repository was unable to merge data from its repositories when one of the repositories specified the location of index files in **repomd.xml** using end tags instead of self-closing tags. | | RTDEV-48547 | Federated Repositories | Medium | Fixed an issue where the pairing token was using base URL for federated repo binding end point instead of federated base URL. | | RTDEV-48273 | Packages | Medium | Fixed an issue whereby default features in Cargo.toml were overwritten as true when the JSON file was deleted from the .cargo folder in the repository. | | RTDEV-48199 | General | Medium | Fixed an issue whereby requests reaching Artifactory that contained no headers or null values returned a 500 error and “java.lang.NullPointerException” appeared in Tomcat logs. | | RTDEV-47968 | General | High | Fixed an issue whereby after upgrading to 7.90.9, users could not retrieve the latest artifact and would receive a '404 file not found' error. | | RTDEV-47967 | Packages | Medium | Fixed an issue whereby installation of Huggingface modules was not working when using smart repository configuration. | | RTDEV-47671 | Builds | Low | Fixed an issue whereby build promotion failed when the same artifact was used in the build more than once. | | RTDEV-47286 | Packages | Medium | Fixed an internal logging issue with PyPI metadata uploads. | | RTDEV-47144 | Packages | Low | Fixed an issue whereby when attempting to download an artifact from a VCS remote repository in Artifactory with an _exclude/include_ pattern set, the download request failed with a 404 Not Found error but the error message did not state that the artifact was not downloaded due to the _exclude/include_ pattern. | | RTDEV-48582 | Repositories | Critical | When deploying a new chart to helm local repositories, the index.yaml did not update (re-index is not occur). This may happen if the lock time reached the time limit configured in the following system property ha.shift.events.lock.lease.period.minutes (default value is 30 minutes). | | JA-14274 | Authentication Providers | High | Fixed an issue whereby, when mTLS is enabled in Artifactory and the Router port (8082) is accessed, the mTLS user is not created in the Artifactory users list. However, the user is created when accessing the Artifactory port (8081). | | JA-14175 | Authentication Providers | Medium | Fixed an issue whereby the Crowd login failed when the Crowd server was unavailable during Artifactory restart. It may take a few minutes for the Crowd login to become available once the Crowd server restarts. | | INST-8061 | Installation | Medium | Fixed an issue whereby the artifactory-ha chart had hard-corded values of --max-time 1 for livenessProbe and startupProbe. | | EVT-1211 | Builds | Medium | Fixed an issue whereby selecting the Any Build checkbox in the UI caused the complete list of builds to be injected instead of simply setting the **anyBuild** parameter to **true**. | ## Artifactory 7.96 This section includes all the Artifactory 7.96 releases. ### Artifactory 7.96.3 SaaS Released: 30 September, 2024 **Breaking Change when Using Get User Details API for Details of Non-Logged-In Users** When retrieving user details for non-logged-in users via the Rest API, a random date in the distant past was returned, now a `null` value will be returned. Previously, if a user never logged, in the response to the Get User Details API, the value of `last_logged_in` was `1970-01-01T00:00:00.000Z`. Now, if a user never logged in, the value of `last_logged_in` will be `null`. **Feature Enhancements** - **Improved Cargo Status Code Responses** Cargo status code responses are now aligned with the cargo registry according to the Cargo specification. - **The Hugging Face readme.md file is now accessible** The Hugging Face readme.md file can now be viewed with an MD viewer for Hugging Face packages. - **Significant Improvements in Deploying Artifacts from Archives** The _Deploy Artifacts from Archive_ REST API now supports deploying artifacts in parallel threads as well as sequentially, significantly reducing the time it takes to deploy. For more information, see [Deploy Artifacts from Archive API](/artifactory/reference/deployArtifactsFromArchive). - **Adding pagination to Release Bundle v2 Version Details REST API** The [Get Received Release Bundles API](https://docs.jfrog.com/governance/reference/getbundleversion) for getting Release Bundle v2 version details now includes the ability to paginate the results using the `offset` and `limit` query parameters. In addition, the response now includes the `total_artifacts_count`. - **Improved Failure Retry Mechanism when working with Google Cloud Storage** The **google-storage-v2** provider now supports an improved retry mechanism when Google Cloud Storage returns 50x errors. Two new parameters have been added to the provider (`maxRetries` and `retryIntervalMillis`) to allow configuring this. For more information, click [here](/installation/docs/google-storage-binary-provider-native-client-template). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :------------------ | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTFE-1908 | User Interface | Medium | Fixed an issue whereby users could not access the Artifactory->Artifacts tab when upgrading to a new Artifactory version. | | RTFE-1790 | Packages | Medium | Fixed an issue whereby the command to install a Go package on the Package Version Details was incorrect. | | RTFACT-30720 | Packages | Medium | Fixed an issue whereby a Go remote repository was not able to proxy Go providers with package versions similar to v2.0.0-beta.1. | | RTFACT-30701 | Packages | Low | Fixed an issue whereby the Artifactory webhook did not trigger an event for **list.manifest.json** after pushing a multi-arch Docker image. | | RTFACT-30677 | Platform Management | Medium | Fixed an issue whereby the Access REST API returned a "403 Forbidden" error when attempting to delete an AWS IAM Role. | | RTDEV-47642 | Repositories | Medium | Fixed an issue where when using Terraform with remote Terraform repositories and anonymous access enabled, permissions did not behave as expected. This may impact users ability to access these repositories. | | RTDEV-47455 | General | Medium | Fixed an issue whereby certain RPM Packages were not listed in a remote repository when pointing to the Rockylinux registry. | | RTDEV-46817 | General | Medium | Fixed an issue whereby when a storage quota notification could not be sent to a project admin because there was no email address for the project admin, the notification was also not sent to other project members who did have email addresses. | | RTDEV-46671 | Storage | High | Fixed an issue related to S3 Cold Storage whereby Artifactory failed to move packages to the Glacier Tier. | | RTDEV-46343 | Packages | Medium | Fixed an issue whereby Artifactory's "reject invalid jars" feature was incorrectly rejecting archives with a payload before the zip structure. | | JA-14387 | General | Medium | Fixed an issue whereby when creating a new OIDC integration with a name that is a prefix of an existing integration, all the mappings from the existing integration were automatically copied over to the new integration. | | JA-14163 | Platform Management | Medium | Fixed an issue whereby when retrieving user details for non-logged-in users via the Rest API, a random date was returned for the time of the last login. Now **null** is returned for a non-logged-in user. | ## Artifactory 7.95 This section includes all the Artifactory 7.95 releases. ### Artifactory 7.95.0 SaaS Released: 12 September, 2024 **Feature Enhancements** - **Improved UI for deleting Release Bundle v2 versions and promotions** The UI offers improved options for deleting Release Bundle v2 versions and promotions, including versions distributed to Edge nodes. For more information, see [Manage Release Bundle v2 Versions](/governance/docs/manage-release-bundle-v2-versions). - **Improved Federated Repository validation** There is an improved validation check when creating Federated repositories that provides a clear error message if a Federated repository with the same name already exists on a different Federation member. - **List Docker Images REST API Performance Improvements** The REST API List Docker Images now delivers faster results and uses less resources. For more information, see List Docker Images API. - **Dynamic Mapping Supported for OpenID Connect Configurations** Dynamic mapping is now supported for OpenID Connect Configurations. Identity mappings can contain dynamic mappings that are used to modify token information. Dynamic mapping supports verification or modification for a username or group name in the token subject based on a pattern. For more information, see [Dynamic Mapping](/administration/docs/openid-connect-integration). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :------------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30728 | Packages | Medium | Fixed an issue whereby Artifactory returned a 400 error for a valid tag in certain circumstances when using the Docker Promote REST API to promote a Docker image. | | RTFACT-30679 | User Interface | Low | Fixed an issue whereby the **Configure** tab did not appear in the **Set Me Up** instructions for certain repositories for SAML users. | | RTFACT-30655 | Projects | Medium | Fixed an issue whereby moving a repository using the Move Repository REST API caused users with read-only permissions to lose access to that repository. | | RTDEV-46832 | Repositories | High | Fixed an issue whereby cleanup cron jobs were causing Out-of-Memory crashes in Artifactory. | | RTDEV-45910 | General | Medium | Fixed an issue whereby slowness with the `/auth/current` endpoint was causing rendering issues. | | RTDEV-33287 | Packages | Low | Fixed an issue related to Conan whereby, when creating a user without read permissions the user was able to view search results instead of receiving a 404 error. | | JA-14046 | General | Medium | Fixed an issue whereby OIDC token exchange failed after key rotation. | | INST-6822 | Installation | Medium | Fixed an issue whereby Artifactory failed to identify an application running inside a container while using Kubernetes clusters without a Docker engine. | ## Artifactory 7.94 This section includes all the Artifactory 7.94 releases. ### Artifactory 7.94.1 SaaS Released: 26 August, 2024 **Feature Enhancements** - **Federation recovery and auto-healing of binary tasks** The auto-healing mechanism used by Artifactory to recover synchronization of metadata events among repository Federation members now includes support for binary tasks as well. The mechanism will check periodically for any binary tasks that are in a retry or error state and use the checksum to identify whether the file was deleted from its source. If the binary was deleted, the task is deleted. - **Project Support for OpenID Connect Integrations** Project Admins can now create identity mappings associated with specific projects. An OpenID Connect integration can have multiple identity mappings, and can have both global and project level identity mappings. A project identity mapping takes precedence over a global identity mapping. For more information see [OpenID Connect Integration](https://docs.jfrog.com/administration/docs/openid-connect-integration). - **Multiple Values Support for OpenID Connect Integrations** Multiple values are now supported for JSON Claims in identity mappings associated with OpenID Connect Integrations. An OpenID Connect integration contains identity mappings, which use JSON Claims to define the scope of generated access tokens. You can now define the scope of an access token for multiple values, for example for multiple repositories and environments. For more information see [OpenID Connect Integration](/administration/docs/openid-connect-integration) .. - **Wildcard Pattern Support for OpenID Connect Integrations** Wildcard values in patterns are now supported for JSON Claims in identity mappings for OIDC integrations. You can now define the scope of an access token using wildcard values, and can use both explicit and implied patterns. For more information see [OpenID Connect Integration](/administration/docs/openid-connect-integration) . - **Performance Improvements** The following performance improvements were made in the artifacts tree/native browser: - For users with limited permissions, loading the list of repositories at the root level of the tree browser is now much faster - Expanding a folder with a long list of artifacts is now much faster. The displayed list of artifacts is now limited to a maximum of 20K. Artifacts that are not displayed are accessible through the Search - Display of repository and artifact details is now faster **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30717 | General | High | Fixed an issue whereby downloading files containing ‘%’ in the filename caused UI Errors. | | RTFACT-30675 | Release Lifecycle Management | Medium | Fixed an issue whereby long usernames caused an error when creating a Release Bundle v2. Artifactory now truncates the username to 64 characters and saves the truncated name to its database. | | RTFACT-30638 | Repositories | Medium | Fixed an issue related to Smart Remote repositories whereby, when enabling the **Propagate Query Params** setting and then updating the repository, Artifactory saved the ‘?trace’ report as an artifact and saved this report as a cached file regardless of the valid response status. | | RTFACT-30689 | Packages | Medium | Fixed an issue related to CRAN whereby, when trying to install local packages from a virtual repository using the R client, Artifactory returned an error. | | RTFACT-30698 | User Interface (UI) | Low | Fixed an issue related to the Tree Browser repositories search input textbox, whereby, when writing unnecessary spaces in the search input, Artifactory did not remove the white spaces from the query string and returned an empty result. | | RTFE-1748 | User Interface (UI) | Medium | Fixed an issue with the Artifactory native browser whereby, when clicking **Load More** in the WebUI, there was a missing trailing slash ( /) after the `recordNum` parameter in the request URL. | | RTFE-1665 | Builds | Medium | Fixed an issue whereby, users were unable to select text in the table of published modules for the artifacts under the **Build** tab in the JFrog Platform UI. | | RTDEV-46682 | Packages | Medium | Fixed a status code response for Cargo smart remote repositories. | | RTDEV-45666 | Packages | Medium | Fixed an issue related to Cocoapods whereby, Artifactory installed certain packages via a remote repository but then did not support subsequent installations. | | RTDEV-45055 | Federated Repositories | Medium | Fixed an issue that caused the keys for local repositories (for example, RPM) to become unavailable after converting the repositories to Federated repositories. | | JA-13546 | Projects | Medium | Fixed an issue where the Project Administrators were unable to revoke tokens from their projects. | ## Artifactory 7.93 ### Artifactory 7.93.3 SaaS Released: 14 August, 2024 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :-------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-46661 | Packages | Critical | Fixed an issue where the blob upload range header returned the wrong byte size. This resulted a malformed manifest.json and caused the error "failed to read expected number of bytes: unexpected EOF" when pulling the image using containerd. | ### Artifactory 7.93.1 SaaS Released: 12 August, 2024 **Feature Enhancements** - **Improvements to Tree Browser Performance** Improvements were made to tree browser performance such that the time it takes to list artifacts from remote repositories was significantly reduced. For more information, click here. - **Improvements to Metadata Retrieval Performance** Performance of metadata retrieval was improved following recent changes made to the npm client. - **Projects Support for Webhooks** Artifactory now supports creating and viewing webhooks associated with a specific project. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :----------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTDEV-45528 | Packages | High | Fixed an issue whereby, attempting to download a model or dataset with a letter case that does not match the exact case as in huggingface.co, failed to download. | | RTFACT-30619 | Repositories | Low | Fixed an issue whereby when attempting to update includePatterns to an empty string using the REST API, the operation reverted to the default value instead of removing the pattern entirely. | | RTFACT-30615 | User Interface | Medium | Fixed an issue whereby when a user navigated in the native browser UI to view or download artifacts that are in ZIP files without folders, the system returned a “404 item does not exist” error. | | RTFACT-30611 | Packages | Medium | Fixed an issue whereby search results in virtual repositories were not sorted by relevance. | | RTFACT-30599 | Authentication Providers | Medium | Fixed an issue whereby downloading artifacts using an identity token or reference token from Maven virtual repositories with “Force Authentication” enabled and anonymous access enabled resulted in “401 Unauthorized” errors. | ## Artifactory 7.92 This section includes all the Artifactory 7.92 releases. ### Artifactory 7.92.3 SaaS Released: 9 August, 2024 **Change to Existing Feature** The system property for synchronizing metadata in Federated repositories (introduced in v7.90.5) has been renamed: - Old name (7.90.5): `artifactory.federated.mirror.events.metadata.enabled` - New name (7.92.3 and above): `artifactory.federated.mirror.events.upload.info.propagate.enabled` **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :---------- | :-------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-46304 | Packages | Medium | Fixed an issue where Terraform anonymous requests were causing 401 errors for other anonymous requests that were made during the same time period. | ### Artifactory 7.92.0 SaaS Released: 29 July, 2024 **Feature Enhancements** - **Support for PyPI Etag Headers** Artifactory now supports Etag headers for Pypi Package Indexes, minimizing the bandwidth used for installation flows. - **Support for Hugging Face Modifying Deployment Expiration** Artifactory now supports using a system property to modify the expiration time for models and datasets deployment, so that you can upload larger models without encountering errors. - **Table of public keys now includes the key type** The table of public keys available to administrators in the Public Keys tab of the Keys Management window now includes the key type. For more information, see [Manage Public Keys](/administration/docs/security-keys-management). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :----------- | :------------------ | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTFACT-30605 | General | Medium | Fixed an issue whereby when setting an artifact property that includes a URL as the value, the property value did not appear in the user interface. | | RTFACT-30221 | User Interface (UI) | Medium | Fixed an issue related to Docker whereby, when trying to view image information on the Packages page on the JFrog Platform WebUI, Artifactory returned an error. | | RTFE-1593 | Repositories | Medium | Fixed an issue related to Helm OCI whereby, the repositories were not displayed on the Repositories page in the JFrog Platform WebUI Administration module as expected. | | RTFE-1260 | Packages | Medium | Fixed an issue whereby, when sorting package versions according to the modified timestamp in the Packages page in the JFrog Platform WebUI, when there were over 100 versions of the same package, Artifactory did not perform as expected. | | RTDEV-44724 | Repositories | Medium | Fixed an issue that allowed users to migrate system repositories to Federated repositories. | | RTDEV-44330 | Packages | Medium | Fixed an issue related to Conda whereby, under certain circumstances, users could access the full metadata from a virtual repository even if they did not have the appropriate permissions. | | RTDEV-43590 | Repositories | Medium | Fixed an issue whereby the cleanup of unused cached artifacts was deleting configuration files in remote repositories. | | RTDEV-41232 | Database | Medium | Fixed an issue whereby when Artifactory runs with an Oracle database, database conversion errors occur when creating new indexes. | | RTDEV-41201 | Database | Medium | Fixed an issue where Artifactory failed to verify the signatures of the signed repository when working with Debian packages and displayed an error. | | JA-13226 | User Management | Critical | Fixed an issue where a disabled user can change his/her status to locked when trying to login to Artifactory multiple times. | | JA-13021 | User Management | High | Fixed an issue whereby password-less access to EKS did not work with AWS GovCloud. | ## Artifactory 7.91 This section includes all the Artifactory 7.91 releases. ### Artifactory 7.91.1 SaaS Released: 18 July, 2024 **Classic Navigation Sunset** The classic navigation has reached its end of life, therefore users will no longer be able to switch back and forth to the classic navigation. For more information, see [JFrog Platform Navigation](/administration/docs/jfrog-platform-navigation). **New Features** - **Support for Multi-Architecture Docker Tag Deletion** Artifactory now supports deleting multi-architecture tags, to optimize storage and avoid clutter. For more information, see [Delete Multi-Architecture Docker Tags](/artifactory/docs/docker-repositories#delete-multi-architecture-docker-tags). **Feature Enhancement** - **Improvements to authenticated requests on Cargo repositories** Authenticated requests on Cargo repositories are now allowed with anonymous access. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :------------------ | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30585 | Projects | Medium | Fixed an issue whereby a project admin was unable to delete a repository associated with a project. | | RTDEV-44031 | Packages | Medium | Fixed an issue related to Cargo whereby, updating or creating repository settings through the YAML configuration did not work as expected. | | RTDEV-44325 | Repositories | Medium | Fixed an issue related to npm whereby, when performing metadata processing, a connection leak might occur. | | RTDEV-43599 | General | Medium | Fixed an issue whereby Artifactory would try to perform push replications from a local repository to a remote cache repository defined by the admin, even though this is an invalid setup (push replications are always between two local repositories). | | RTDEV-43241 | Repositories | Medium | Fixed an issue whereby Generic repositories configured with the `retrieveSha256FromServer` property set to true were unable to download SHA256 files from the Prisma registry due to 404 errors. | | RTDEV-43771 | User Interface (UI) | Medium | Fixed an issue whereby, when sorting or searching for a specific version on the Packages page in the JFrog Platform WebUI with the Release Version Only checkbox selected, Artifactory did not display the results as expected. | | RTDEV-1174 | General | Low | Fixed an issue related to Docker whereby, when pushing an image to a local repository, the Last modified and Created time fields displayed different values not as expected. | ## Artifactory 7.90 ### Artifactory 7.90.5 SaaS Released: 25 July, 2024 **Highlights** **Known Issue in this Version** Upgrading self-hosted deployments from version 7.71 directly to 7.90 or higher fails due to a problematic Artifactory revision number in 7.71 causing converters not to run. To avoid this issue, upgrade to Artifactory version 7.90.7 or above. - **New Platform Navigation** JFrog is launching the new platform UI navigation for Self-Hosted instances. This will be the default experience when using version number 7.90.x. To find out more about this change, see [JFrog Platform Navigation](/administration/docs/jfrog-platform-navigation). **Classic UI Navigation Sunset** Classic UI navigation is planned to be deprecated with the Self-Hosted release of October 2024. For more information, see [JFrog Platform Deprecations](/releases/docs/jfrog-platform-deprecations). - **Individual JVM for Access Service** The Access service will now run on a dedicated Java Virtual Machine (JVM), separated from the main Artifactory JVM. While the Access JVM will utilize additional resources, this change is anticipated to decrease the memory usage of the Artifactory JVM. Additional configuration steps might be required for customers using the Derby database. For more information, see [Individual JVM for Access Service](/installation/docs/individual-jvm-for-access-service) - **Security Hardening for Artifactory Container Images** As part of JFrog's commitment to maintain the security and reliability of our products, JFrog Artifactory container images are now enforced with read-only permission to `webapps` and `conf` folders located in the `app/artifactory/tomcat` and `app/access/tomcat` directories. - **OpenID Connect Integration** OIDC integration in the JFrog Platform allows you to use services including GitHub Actions and Azure with OpenID Connect to work on the JFrog Platform. [OpenID Connect Integration](/administration/docs/openid-connect-integration) now supports Azure. - **Major Performance Improvements for Alpine** This version includes up to an 87% improvement in the response time in Alpine-related use cases, such as downloading from a virtual repository. **New Features** - **Project Admin Scoped Access Token** Now in addition to an API that was released in Artifactory version 7.84, you can also generate project admin access tokens using the JFrog Platform UI. For more information, see [Create a Project Admin Scoped Token](/administration/docs/access-tokens). - **Project Storage Quotas** You can now view and manage project storage quotas. A table view with project details is now the default All Project View, and a new Storage Quota column with a usage bar has been added. You can now perform actions such as Edit Storage to manage and change the storage quota from the table view. For more information, see [Manage Storage Quotas](/projects/docs/manage-storage-quotas). **Feature Enhancements** - **Improved Performance with Storage Summary Queries** A flag was added to the Artifactory System Properties (`artifactory.db.operations.totalSize.mysql.noIndex = true`) that changes the storage summary queries (file count and repository table) to not use indexes in MySQL DB and hence improves query performance. - **Additional Package Types Now Support Package Archiving** Additional package types have been added to support package archiving. The full list of all package types that now support package archiving is: Docker, Maven, npm, Gradle, YUM, generic, NuGet, Conan, and Helm. For more information on package archiving, see [Working with Cold Storage](/administration/docs/archive). - **Temporary Login Suspension Configuration Moved to Access Service** As part of enhancements to the JFrog Access Service to make it the primary service for Authentication and Authorization, from Artifactory version 7.90, the configuration management for Temporary Login Suspension has moved to the Access Service. For more information, see [User Lock and Login Suspension](/administration/docs/security-configuration). - **Improved User Experience for Helm Installations** Artifactory now supports the following Helm improvements: - The `nginx.artifactoryConf` and `nginx.mainConf` fields have been reallocated to the 'files' directory. - The `artifactory.openMetrics` field has been renamed as `artifactory.metrics`. - Added `nginx.hosts` field to use as `server_name` directive on the embedded Nginx instead of `ingress.hosts` field. - Changed `migration.enabled` flag to false by default. For Artifactory 6.x to 7.x migration, this flag needs to be set to `true`. - **Additional synchronized metadata in Federated repositories** It is now possible to synchronize the following artifact metadata with all Federation members: - **createdBy**: The name of the user who uploaded the artifact to Artifactory (including the suffix '`federated`'.) The name is mirrored to other members even if the user does not exist on those members. - **deploymentDate**: Defines when the artifact was deployed. Synchronizing this metadata is important for features such as the Max Unique Snapshot policy in Maven. - **modifiedDate**: Defines when the artifact was last modified. A new Artifactory system property controls the inclusion of this metadata: `artifactory.federated.mirror.events.metadata.enabled` By default, this flag is set to `false`. To mirror this metadata to other Federation members, change the flag setting to `true` on each relevant member. The metadata is mirrored only if the flag is activated on both the source and target JPD. - **Cleanup Job for Removing Orphaned Cursors** A new job cleans up orphaned cursors from the Federated repository database. This was done to optimize the auto-healing process. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :----------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30585 | Medium | Medium | Fixed an issue whereby a project admin could not delete a repository associated with a project. | | RTDEV-44298 | General | Medium | Fixed an issue whereby, from Artifactory version 7.84, AQL searches will undergo throttling, potentially resulting in 429 errors. for more information, see the Known Issues. | | RTDEV-44325 | Repositories | Medium | Fixed an issue related to npm whereby, when performing metadata processing, a connection leak might occur. | | RTDEV-44031 | Packages | Medium | Fixed an issue related to Cargo whereby, updating or creating repository settings through the YAML configuration did not work as expected. | | RTFE-1593 | Repositories | Medium | Fixed an issue related to Helm OCI whereby, the repositories were not displayed on the Repositories page in the JFrog Platform WebUI Administration module as expected. | ### Artifactory 7.90.1 SaaS Released: 1 July, 2024 **New Features** - **Support for Ansible Repositories** You can now use Artifactory to manage and store your Ansible collections (including Roles, Playbooks, Plugins, Modules, etc.), providing full flexibility and usability. You can store and distribute your own collections through secure local repositories, and cache remote resources from the Ansible Galaxy registry for reliable access. For more information, see [Ansible Repositories](/artifactory/docs/ansible-repositories). - **Support for Hugging Face Datasets** Artifactory now supports storing and caching of Hugging Face ML datasets, allowing you to manage all stages of the ML development lifecycle. For more information, see [Hugging Face Repositories](/artifactory/docs/hugging-face-repositories). - **Support for OCI Referrers API** You can view the connection between images and their related information, such as signatures and attestations, for better visibility and management. For more information, see [Use Referrers to Discover OCI References](/artifactory/docs/oci-repositories). - **Get Status of Repository Project API** A new API allows users to obtain the status of a repository and whether it was assigned and/or shared to a project, to multiple projects, or to all projects. For more information, see [Get Status of Project Repository API](https://docs.jfrog.com/projects/reference/getprojectrepositorystatus). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :----------------------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30301 | Repositories | Medium | Fixed an issue related to P2 whereby, creating a local repository was allowed using repository creation REST API, even though only remote and virtual P2 repositories are supported. | | RTFACT-30572 | General | Medium | Fixed an issue whereby, when trying to edit or delete project roles with names containing special characters, Artifactory returned a 400 error. | | RTDEV-43850 | Repositories | Medium | Fixed an issue whereby remote repositories were not set to an “assumed offline” state in certain situations. | | RTDEV-42072 | General | Medium | Fixed an issue related to the Mail Server page whereby, when setting up a mail server without configured password, users encountered an error to re-enter the password, when editing the mail server configuration or testing the connection. | | RTDEV-43533 | Repositories | Medium | Fixed an issue whereby, when clicking Load More in the Tree View menu in the JFrog Platform WebUI, Artifactory did not perform as expected. | | JA-9056 | Database | Medium | Fixed an issue whereby, Artifactory did not support updating a Permission Target with empty repository scope JSON when using Oracle Database. | | JA-8655 | Authentication Providers | Medium | Fixed an issue whereby, LDAP user refresh failed when the lock time was set without setting a lockout duration. | | JFUI-15366 | Packages | Medium | Fixed an issue whereby, when using a URL to access the JFrog Platform WebUI, and logging in using HTTP SSO, Artifactory was redirected to the incorrect URL. | ## Artifactory 7.89 This section includes all the Artifactory 7.89 releases. ### Artifactory 7.89.2 SaaS Released: 20 June, 2024 **Classic Navigation Sunset** From Artifactory version 7.91 Classic Navigation will no longer be available in JFrog SaaS. For more information, see [JFrog Platform Navigation](/administration/docs/jfrog-platform-navigation). **Feature Enhancements** - **Project Admin Scoped Access Token** Now in addition to an API that was released in Artifactory version 7.84, you can also generate project admin access tokens using the JFrog Platform UI. For more information, see [Create a Project Admin Scoped Token](/administration/docs/access-tokens). - **Project Storage Quotas** You can now view and manage project storage quotas. A table view with project details is now the default All Project View, and a new Storage Quota column with a usage bar has been added. You can now perform actions such as Edit Storage to manage and change the storage quota from the table view. For more information, see [Manage Storage Quotas](/projects/docs/manage-storage-quotas). - **Workers Troubleshooting** From Artifactory version 7.89 you can now view workers' troubleshooting data in the JFrog Platform UI. You can see both failed worker execution events and events for successful worker executions. For more information, see [Workers Troubleshooting](/administration/docs/workers-troubleshooting). **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :----------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30566 | Packages | Medium | Fixed an issue related to npm whereby, when requesting package metadata, Artifactory returned the same response headers for JSON and abbreviated JSON files. | | RTFACT-30536 | Packages | Low | Fixed an issue related to Docker whereby, when trying to promote a multi-architecture image more than once in the same repository with the same source tag and destination tag, Artifactory returned a 400 error. | | RTDEV-42772 | Packages | High | Fixed an issue related to Conda whereby, under certain circumstances, when trying to resolve a package from a virtual repository, Artifactory returned a 500 error. | | RTDEV-40320 | Repositories | Medium | Fixed an issue whereby, Artifactory Export failed on Windows due to unsupportable characters in a file name or restricted file names. | | RTDEV-42560 | Repositories | Medium | Fixed an issue whereby Artifactory Export overwrites a file with the same name but written in a different case. | ## Artifactory 7.88 This section includes all the Artifactory 7.88 releases. ### Artifactory 7.88.0 SaaS Released: 4 June, 2024 **Feature Enhancements** - **OpenID Connect Integration** OIDC integration in the JFrog Platform allows you to use services including GitHub Actions and Azure with OpenID Connect to work on the JFrog Platform. [OpenID Connect Integration](/administration/docs/openid-connect-integration) now supports Azure. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :----------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30445 | General | Medium | Fixed an issue whereby, when setting up a webhook to monitor `artifact-property-added` events and then adding a property recursively at the folder level, Artifactory did not perform as expected. | | RTFACT-30503 | Packages | Medium | Fixed an issue related to Hugging Face whereby, the ‘Store Artifacts Locally’ checkbox was visible for remote repositories via the JFrog Platform WebUI. | | RTDEV-43090 | Packages | Medium | Fixed an issue related to Generic repositories whereby, when deploying `*.crate` files in the repositories, Artifactory attempted to calculate metadata for the file which may result in a crash. | | RTDEV-42061 | Packages | Medium | Fixed an issue related to PyPI whereby, when resolving packages via Artifactory SaaS, the `cache-control` header was not returned, causing possible duplicate resolving of packages. | | JA-8980 | General | Medium | Fixed an issue whereby, when starting the Access service, an unnecessary warning related to `application.yaml` was added to the logs. | | JA-8655 | Authentication providers | Medium | Fixed an issue whereby, LDAP user refresh failed when the lock time was set without setting a lockout duration. | ## Artifactory 7.87 This section includes all the Artifactory 7.87 releases. ### Artifactory 7.87.3 SaaS Released: 26 May, 2024 **Feature Enhancements** - **Enhanced Performance for Get Storage Summary Info REST API** The time needed to return the storage summary information via API has been significantly reduced for virtual repositories. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30429 | Repositories | High | Fixed an issue whereby, when attempting to create a Smart Remote Repository on Edge instance that has Platform Proxy configured, Artifactory did not create the repository. | | RTFACT-30504 | Release Lifecycle Management | Medium | Fixed an issue whereby, a Release Bundle v2 could not be created from a build that has dependencies lacking a SHA-256. | | RTFACT-30425 | Packages | Medium | Fixed an issue related to PyPI whereby, when trying to access the simple index of a smart remote repository that is offline, Artifactory returned a 404 error. | | RTDEV-40750 | Repositories | Medium | Fixed an issue that prevented the creation of a federated Release Bundle v2 repository with multiple members using a single [API](/administration/docs/stages-lifecycle) call (`PUT api/repositories/{repoKey}`). | | RTFE-1341 | Repositories | Medium | Fixed an issue whereby the Run Now option was available when adding a replication configuration to a new local repository that was still being created in the UI. | | RTDEV-41880 | Packages | Medium | Fixed an issue whereby, under certain circumstances, Artifactory failed to index NuGet packages. | | RTDEV-42350 | Packages | Medium | Fixed an issue related to Gradle whereby, the Set Me Up menu in the JFrog Platform WebUI showed incorrect instructions. | | RTDEV-41317 | Packages | Medium | Fixed an issue related to Helm whereby, when trying to use a virtual repository containing a remote repository pointing to the `https://wiremock.github.io/helm-charts/` registry, Artifactory returned a 500 error. | | RTDEV-4982 | Repositories | Medium | Fixed an issue related to Helm whereby, when turning off the ‘List Remote Folder Items’ setting for smart remote repositories, it was still enabled. | ## Artifactory 7.86 This section includes all the Artifactory 7.86 releases. ### Artifactory 7.86.0 SaaS Released: 7 May, 2024 **Feature Enhancements** - **Support for new CocoaPods CLI Commands** Artifactory now supports using the `pod search` and `pod list` commands for virtual CDN repositories. - **Reduced Load When Reading Global Exclude Properties** An improvement was introduced in this version to reduce the load when reading global exclude properties. Any properties added to the **artifactory.repo.includeExclude.globalExcludes** parameter are now controlled by the flag **artifactory.repo.default.includeExclude.globalExcludes.empty.list**, which is set to **true** by default. When this flag is **true**, the list is treated as empty, meaning that the global exclude patterns are not considered. Therefore, it is necessary to set **artifactory.repo.default.includeExclude.globalExcludes.empty.list = false** for the global exclude patterns to be taken into account. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :------------------ | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30392 | Packages | Medium | Fixed an issue related to Terraform whereby, when trying to resolve modules from a virtual repository containing a smart remote repository in an air-gapped environment, Artifactory returned a 404 error. | | RTFACT-30422 | Packages | Medium | Fixed an issue whereby, when trying resolving artifact metadata from a virtual repository, Artifactory did not merge metadata files of `xml.bz2` format from a nested remote repository, which caused longer resolution times and an inability to view or resolve artifacts from the nested remote repository. | | RTFACT-30451 | Packages | Medium | Fixed an issue related to Go whereby, when trying to download a Golang package in a major version higher than 10 from a remote repository proxying GitHub, Artifactory did not perform as expected. | | RTDEV-41630 | Packages | High | Fixed an issue related to Docker whereby, under certain circumstances, Artifactory failed to generate the docker tags list when the registry returned a full URL instead of a relative URL in the link header as expected. | | RTDEV-41714 | General | High | Fixed an issue whereby, under certain circumstances, when trying to perform pull replication, Artifactory created an infinite loop and failed to complete the operation. | | RTDEV-41390 | User Interface (UI) | Medium | Fixed an issue related to OCI whereby, when creating a repository using the JFrog Platform WebUI, it is possible to use a repository key containing uppercase characters, but when trying to use the repository through the REST API, Artifactory returned a 400 error. | | RTDEV-40507 | Storage | High | Fixed an issue whereby when CDN Download was enabled, if contentType contained a special character (such as '+') it was omitted and caused a failure with the redirect URL. | | RTDEV-41067 | Packages | Medium | Fixed an issue relate to NuGet whereby, `*.symbols.nupkg` packages were indexed, causing search errors. | | JA-8655 | Access | Medium | Fixed an issue whereby, LDAP user refresh failed when the lock time was set without setting a lockout duration. | | JA-8600 | Access | High | Fixed an issue whereby, SAML login with Azure failed on multi-SAML SSO. | | JA-8346 | Access | Medium | Fixed an issue whereby, Release Bundle did not appear as a resource in the Permissions UI for JFrog Pro subscriptions. | | JA-8230 | Access | Medium | Fixed an issue whereby, newly created generic repositories intermittently disappeared under projects. | ## Artifactory 7.84 ### Artifactory 7.84.10 SaaS Released: 12 May, 2024 **Replicator Sunset** The Replicator service for Release Bundles v1 has been deprecated. For more information, see [Artifactory Deprecations](/releases/docs/artifactory-deprecations). **Known Issue in this Version** Starting from Artifactory version 7.84, AQL searches will undergo throttling, potentially resulting in 429 errors. The default setting for the parameter below will be TRUE. You can opt to set it to FALSE to disable the throttling: `artifactory.aql.queries.limit.enabled` More information may be found [here](/releases/docs/artifactory-known-issues#artifactory-784-known-issues). **Highlights** - **PostgreSQL is the Recommended Database for Artifactory Installation** After a comprehensive evaluation of leading database providers' capabilities, scalability, and support, JFrog selected PostgreSQL as the preferred database solution for all its product offerings. Organizations can still choose to use any database in the list of Artifactory-supported databases, however, there is a minor new configuration step that will need to be performed for new installations. When installing a new Artifactory instance with any database other than PostgreSQL, you are required to specify the configuration in the `system.yaml` file. For more information, see [Choose the right database](/installation/docs/choose-the-right-database). - **Major Performance Improvements for PyPI, NuGet, and npm** This version includes significant reductions in response time, as well as simplified and reduced database calls from the previous Self-Hosted version (7.77). These improvements apply to several important use cases, including virtual package resolution and external dependency resolution, among others. We have measured: - Up to 24% response time reduction in PyPI-related use cases - Up to 23% response time reduction in NuGet-related use cases - Up to 84% response time reduction in npm-related use cases **Feature Enhancements** - **Improved Artifact Tree View** The Artifact Tree view has been significantly improved such that when opening a node on a repository, a specific (configurable) number of artifacts will be displayed instead of the entire contents of the repository. This significantly reduces loading time for repositories containing a large number of artifacts. The default display number is 500, but this number can be changed in the Artifactory UI (click [here](/installation/docs/general-settings) for instructions). If there are more artifacts to display beyond the current list, a **Load more** option appears at the end of the list and when clicked displays more items. The enhanced Artifact Tree View is available both in a Tree Browser and a Native Browser. - **Automatically pair OAuth SSO users with JFrog Platform users** You can now automatically pair OAuth SSO users when they log in to the JFrog Platform with their JFrog Platform user based on their email address. No configuration change is required to enable the feature. For more information on OAuth SSO, see [OAuth SSO](/administration/docs/oauth-sso). - **Open Metric for Federated Repository status** A new Open Metric records the number of Federated repositories that have the indicated status. For more information, see [Federated Repository Metrics](/administration/docs/open-metrics#federated-repository-metrics). - **Lifecycle System YAML** There is a new section in the Artifactory YAML file for configuring parameters related to Release Lifecycle Management. This replaces the Configuration APIs that were used previously and have now been deprecated. For more information, see [Lifecycle System YAML](/installation/docs/using-system-yamls). - **Helm Installation Updates** - The `setSecurityContext` field in Helm installation has been renamed as `podSecurityContext`. - Added a dedicated image section for `initContainers` instead of `initContainerImage` - Added `unifiedSecretInstallation` flag, which enables single unified secret holding all chart secrets to **true** by default. - **Availability Zone Affinity** You can configure a preferred availability zone in the router section of the Artifactory System YAML file. If a service is available in the local zone, traffic is sent to this local service. However, if a service is not available locally, traffic is sent to a service in another zone using a round robin strategy. For more information, see [JFrog Router Service](/installation/docs/jfrog-router-service). - **Access Token Creation by Project Admins** Project admins can create access tokens that are tied to the projects in which they hold administrative privileges. For more information, see [Access Token Creation by Project Admins](/administration/docs/access-tokens). - **Changes to Anonymous Access** Starting from Artifactory 7.84.3, the anonymous user is removed from the **Anything** and **Any Remote** [permissions](/administration/docs/permissions) by default. To grant permissions to anonymous users, the best practice is to create a new permission target containing the anonymous user, and to assign it with read-only access to the relevant repositories. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :--------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30429 | Repositories | High | Fixed an issue whereby, when attempting to create a Smart Remote Repository on Edge instance that has Platform Proxy configured, Artifactory did not create the repository. | | RTFACT-30451 | Packages | Medium | Fixed an issue related to Go whereby, when trying to download a Golang package in a major version higher than 10 from a remote repository proxying GitHub, Artifactory did not perform as expected. | | RTFACT-30427 | Storage | Medium | Fixed an issue whereby initiating the process for pruning unreferenced data with a federated repository configured resulted in 403 forbidden errors. | | RTFACT-30504 | Release Lifecycle Management | Medium | Fixed an issue whereby, Release Bundle V2 could not be created from a Build having dependencies without SHA-256. | | RTFACT-30472 | Packages | Medium | Fixed an issue related to npm whereby, when using Yarn 2 to publish a scoped npm package to Artifactory, Artifactory did not perform as expected. | | RTFACT-30425 | Packages | Medium | Fixed an issue related to PyPI whereby, when trying to access the simple index of a smart remote repository that is offline, Artifactory returned a 404 error. | | RTDEV-40507 | Storage | High | Fixed an issue whereby when CDN Download was enabled, if contentType contained a special character (such as '+') it was omitted and caused a failure with the redirect URL. | | RTDEV-41880 | Packages | Medium | Fixed an issue whereby, under certain circumstances, Artifactory failed to index NuGet packages. | | RTDEV-41317 | Packages | Medium | Fixed an issue related to Helm whereby, when trying to use a virtual repository containing a remote repository pointing to the `https://wiremock.github.io/helm-charts/` registry, Artifactory returned a 500 error. | | JA-8655 | Authentication Providers | Medium | Fixed an issue whereby, LDAP user refresh failed when the lock time was set without setting a lockout duration. | ### Artifactory 7.84.6 SaaS Released: 1 May, 2024 **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :-------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTDEV-42076 | General | Critical | Fixed an improper input validation issue that could potentially lead to privilege escalation. | | RTFACT-30422 | Packages | Medium | Fixed an issue whereby, when trying resolving artifact metadata from a virtual repository, Artifactory did not merge metadata files of xml.bz2 format from a nested remote repository, which caused longer resolution times and an inability to view or resolve artifacts from the nested remote repository. | | RTDEV-41685 | Packages | High | Fixed an issue related to PyPI whereby, under certain circumstances, a persistent connection leak caused slowness in Artifactory. | | RTDEV-41630 | Packages | High | Fixed an issue related to Docker whereby, under certain circumstances, Artifactory failed to generate the docker tags list when the registry returned a full URL instead of a relative URL in the link header not as expected. | | RTDEV-40221 | Packages | High | Fixed an issue related to npm whereby, under certain circumstances, Federated repository instances overwrote the latest dist-tag to the wrong version during package indexing instead of excluding the dist-tag from the mirror. | ### Artifactory 7.84.3 SaaS Released: 18 April, 2024 **New Features** - **Support for CocoaPods Virtual Repositories** Artifactory now supports using CocoaPods virtual repositories, only for repositories using CDN- allowing you to access both local and remote CocoaPods resources through a single URL. For more information, see [Set Up Virtual CocoaPods Repositories](/artifactory/docs/virtual-repositories) and [Use CocoaPods CDN for Virtual Repositories](/artifactory/docs/cocoapods-repositories#connect-cocoapods-cdn-to-artifactory). - **Support for OpenTofu Terraform Client** Artifactory now supports the OpenTofu registry and client, which provides an alternative to Hashicorp’s Terraform Provider Registry. For more information, see [Configure OpenTofu to Work With Artifactory](/artifactory/docs/terraform-opentofu-and-terraform-backend-repositories#get-started-with-terraform-registry-and-terraform-backend). - **APIs for Creating & Retrieving Batches of Repositories** A new API enables you to create multiple repositories using a batch request. The batch request can contain a mix of different package types and repository types. For more information, see [Create Multiple Repositories API](https://docs.jfrog.com/artifactory/reference/createmultiplerepositories) . Another new API enables you to retrieve the configurations for a batch of repositories based on the repository names. For more information, see Get Batch of Repositories by Name API. **Feature Enhancements** - **Support for Release Lifecycle Management in Federated Environments** It is now possible to work with [Release Bundles v2](/governance/docs/understanding-release-bundles-v2) in a Federated environment as part of managing your [release lifecycle](/governance/docs/release-lifecycle-management). This is particularly useful when Federations are employed in a DR (disaster recovery) or Active/Active multi-site framework, as it ensures that your releases (as contained in an immutable Release Bundle) are replicated across all sites. For more information, see [Release Lifecycle Management in Federated Environments](/governance/docs/release-lifecycle-management-in-federated-environments_release-lifecycle-management). - **Project Key Validator for Federated Release Bundle Repositories** A validator has been added to ensure that [Release Bundle repositories](/artifactory/docs/release-bundle-repositories) related to a specific project can be Federated only if the same project key exists on the other JPDs in the Federation. - **Local Deletion of Distributed Release Bundles v2 from Edge Nodes Reported in Source Timeline** When a distributed Release Bundle v2 version is deleted locally from the target (typically an Edge node), as opposed to being deleted [remotely](/governance/docs/delete-a-release-bundle-v2-from-multiple-edge-nodes) from the source Artifactory, a new service provided by JFrog Distribution informs the source Artifactory of the operation. An event that describes the deletion is then added to the Release Bundle [timeline](/governance/docs/use-the-release-bundle-version-timeline) for maximum visibility. The behavior of this functionality is configurable in both Distribution (requires 2.24.x and higher) and Artifactory. For more information, see [Configure Deleted-at-Target Scraping Service](/governance/docs/configure-deleted-at-target-scraping-service). - **Updates to Release Lifecycle Management APIs** Several changes have been made to the [Release Lifecycle Management APIs](/governance/reference/createbundleversion). Among the changes: - For all relevant APIs, the status value of `PROCESSING` has been changed to `STARTED`. - For all relevant APIs, the `messages[].source` and `messages[].created` properties have been deprecated. - The `X-JFrog-Signing-Key-Name` request header has been made optional instead of mandatory when promoting a Release Bundle v2 version using the API. - **Support for **`.zip`** Package Format in CocoaPods Remote CDN Repositories** Artifactory now supports resolving and caching `.zip` format packages in CocoaPods remote CDN-enabled repositories, in addition to `.tgz` format. - **Access Token Creation by Project Admins** Project admins can create access tokens that are tied to the projects in which they hold administrative privileges. For more information, see [Access Token Creation by Project Admins](/administration/docs/access-tokens). - **Changes to Anonymous Access** Starting from Artifactory 7.84.3, the anonymous user is removed from the **Anything** and **Any Remote** [permissions](/administration/docs/permissions) by default. To grant permissions to anonymous users, the best practice is to create a new permission target containing the anonymous user, and to assign it with read-only access to the relevant repositories. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :----------------------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30423 | Packages | Medium | Fixed an issue related to Pub whereby, when trying to resolve an artifact with a version containing a '+' character from a virtual repository, Artifactory did not include the metadata as expected. | | RTFACT-30340 | Packages | Medium | Fixed an issue related to Terraform whereby, when trying to resolve versions of modules that were already cached, the gitref files were not updated as expected and Artifactory returned a 404 error or an incorrect latest version. | | RTFACT-30393 | Repositories | Medium | Fixed an issue related to Go whereby, when trying to set up a remote repository using the Set Me Up instructions in the JFrog Platform WebUI, Artifactory returned a 404 error. | | RTFACT-30336 | Packages | Medium | Fixed an issue whereby, when navigating to the package version details page and clicking the **Show In Tree** button near a package artifact while moving to the Artifacts page, Artifactory returned an error. | | RTDEV-40796 | Repositories | Medium | Fixed an issue related to OCI and HelmOCI whereby, the JFrog Platform WebUI displayed the ‘enable indexing in Xray’ option, even though Xray indexing is not supported for OCI and HelmOCI repositories. | | RTDEV-40543 | Packages | Medium | Fixed an issue related to Maven whereby, when trying to configure a Maven client with the “Mirror Any“ option checked, Artifactory did not generate the `settings.xml` file as expected. | | RTDEV-40089 | General | Medium | Fixed an issue whereby the backup would fail when Artifactory attempted to verify if enough disk space was available for the backup and a remote repository was selected for backup. | | JA-8461 | General | High | Fixed an issue related to Helm whereby, when using an Oracle database with only one repository with permissions, cannot remove this repository from permissions. | | RTDEV-40052 | Packages | High | Fixed an issue related to Helm whereby, when trying to use the dependencies commands in virtual repositories, Artifactory returned an error. | | RTDEV-40549 | Authentication Providers | Medium | Fixed an issue that enabled a Release Bundle v2 to be created successfully even when the GPG key assigned to the Release Bundle was provided with the wrong passphrase. | | RTDEV-39551 | Packages | Low | Fixed an issue related to PyPI whereby, under certain circumstances, the `yanked` property was not applied to packages' simple index files as expected. | | JFUI-14956 | User Interface (UI) | Medium | Fixed an issue whereby, when modifying the `timeoutMinutes` property within the `values.yaml` file to a value higher than 5 minutes, the Artifactory Frontend service did not behave as expected. | | JFUI-14838 | User Interface (UI) | Low | Fixed an issue whereby, `frontend-request.log` did not have the same structure as other log files in the JFrog Platform. | ## Artifactory 7.83 ### Artifactory 7.83.1 SaaS Released: 4 April, 2024 **Feature Enhancements** - **Improved Artifact Tree View** The Artifact Tree view has been significantly improved such that when opening a node on a repository, a specific (configurable) number of artifacts will be displayed instead of the entire contents of the repository. This significantly reduces loading time for repositories containing a large number of artifacts. The default display number is 500, but this number can be changed in the Artifactory UI (click [here](/installation/docs/general-settings) for instructions). If there are more artifacts to display beyond the current list, a **Load more** option appears at the end of the list and when clicked displays more items. The enhanced Artifact Tree View is available both in a Tree Browser and a Native Browser. - **Improved Tracking of Distribution Task Progress** JFrog Distribution now uses an improved method for tracking distribution tasks, which enables more accurate updates about the progress of each task. - **PyPI Repository Improvements** Reduced the database strain of fetching pip index using a simple index for packages from a remote repository nested under a virtual repository. - **Multiple SAML SSO Provider Configurations** From Artifactory version 7.83.1, the ability to create multiple SAML SSO provider configurations will gradually be rolled out. For more information, see [SAML SSO](/administration/docs/saml-sso). Now, additional SAML SSO provider configurations can be created, enabled, disabled, edited, and deleted. **Note** Before creating multiple SAML configurations, JFrog recommends deleting the old configuration and reconfiguring it with a different setting name other than **Default**. If you reconfigure your SAML configuration, you must also update the relevant information in the Identity Provider server. **Resolved Issues** | JIRA Issue | Component | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :----------------------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30356 | Packages | High | Fixed an issue related to Cargo whereby, after calculating repository metadata, Artifactory did not support resolving packages from local repositories. | | RTDEV-40166 | General | Medium | Fixed an issue whereby, when applying Artifactory YAML Configuration with mail server changes containing quotation marks, Artifactory returned an error and became unresponsive. | | RTDEV-39396 | Storage | Medium | Fixed an issue whereby, `enableSignedUrlRedirect` in the **state-aware-s3** provider (in **binarystore.xml**) did not follow the read order of zones that were configured in the sharding provider. | | RTDEV-39111 | Authentication Providers | Medium | Fixed an issue whereby, when a transient user was created the API security.currentUser().isTransientUser() returned **false**. | | RTDEV-40083 | Packages | Medium | Fixed an issue related to Hugging Face whereby, Artifactory did not support the `/api/validate-yaml` endpoint that was added in client version 0.21.0, causing upload failures. | ## Artifactory 7.82 This section includes all the Artifactory 7.82 releases. ### Artifactory 7.82.2 AaaS Released: 18 March, 2024 **Feature Enhancements** - **Go Virtual Repositories Performance Improvement** Added Go Remote VCS repositories requests caching using local cache to reduce remote API calls and avoid rate limits. - **Get Federated Repository Status V2 API** This enhanced version of the existing [Get Federated Repository Status V2 API](/artifactory/reference/getFederatedRepositoryStatus) supports a wider range of statuses. For more information, see [Get Federated Repository Status (v2) API](/artifactory/reference/getFederatedRepositoryStatusV2). - **Perform recovery on repository Federation** It is now possible to perform a recovery operation on an entire Federation at once by leaving off the `{repo-key}` parameter when invoking the REST API. For more information, see [Federation Recovery ](/artifactory/docs/federated-repositories#federation-recovery-and-auto-healing). **Resolved Issues** | JIRA Issue | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30289 | Medium | Fixed an issue related to Docker whereby, when running a ‘docker push’ command on a new image, the ‘docker tag promoted’ webhook was incorrectly triggered. | | RTFACT-30314 | Medium | Fixed an issue where YAML configuration changes couldn't be applied if the file size exceeded 3 MB. | | RTFACT-30270 | Low | Fixed an issue related to NuGet whereby, under certain circumstances, Artifactory did not support resolving artifacts through a virtual repository containing a large number of remote repositories. | | RTFACT-30335 | Low | Fixed an issue whereby, Artifactory did not support setting a Cargo registry URL via the configuration YAML file. | | RTFACT-30309 | Low | Fixed an issue whereby, when trying to resolve an un-cached artifact from a remote repository pointing to a registry that does not allow content browsing through the Native Browse, Artifactory returned a 404 error. | | RTDEV-39764 | Medium | Fixed an issue related to RPM whereby, when adding GPG keys without extension with a file name containing ‘GPG’, Artifactory did not support making the keys expirable. | | RTDEV-37982 | Medium | Fixed an issue whereby, when using a dotnet NuGet client with incorrect authentication credentials, Artifactory returned a 500 server error instead of a 401 error. | | RTDEV-39600 | Medium | Fixed an issue related to Terraform whereby, Artifactory did not support dereferenced commits for Terraform modules when proxying remote registries. | | RTDEV-39724 | Medium | Fixed a permissions issue that prevented users with a license other than Enterprise+ from creating Release Bundles v2 from the Release Lifecycle Management dashboard. | ## Artifactory 7.81 This section includes all the Artifactory 7.81 releases. ### Artifactory 7.81.1 SaaS Released: 27 February, 2024 **Cargo Git Indexing Deprecation** Starting at the end of Q2, 2024, Cargo indexing will only be enabled using Sparse indexing, and the use of Git indexing will be discontinued. For more information, see [Deprecations in Process](/releases/docs/deprecations-in-process). **Feature Enhancements** - **Display List Manifest Content on the Artifacts Page** Artifactory now displays the manifests under a `list.manifest` file directly in the Artifacts page in the JFrog Platform WebUI. For more information, see [List Manifest Content](/artifactory/docs/docker-repositories#list-manifest-content). - **Storage Improvements** This release contains the following storage improvements: - When using Azure Blob storage with a SAS token, the SAS token is now encrypted at rest in the the binarystore.xml file. - When using the state-aware-s3 binary provider, sensitive properties are now encrypted in the same manner as they are for the s3-storage-v3 binary provider. - **Full Sync improvements for Federated repositories** This release contains an option for generating the file list for a Full Sync operation using multiple SQL queries (paging) instead of a single AQL query. Dividing the database query into pages helps prevent the operation from crashing when retrieving a large file list (by default, more than 400000 artifacts). In addition, several new system properties have been introduced for managing this paging feature. For more information, see [System Properties for Full Sync File List Queries](/artifactory/docs/federated-repositories#system-properties-for-full-sync-file-list-queries). For more information about Full Sync, see [Perform Full Sync on Federated Repositories](/artifactory/docs/federated-repositories#perform-full-sync-on-federated-repositories). **Resolved Issues** | JIRA Issue | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30105 | High | Fixed an issue related to RPM whereby, when trying to resolve artifacts from an upstream repository through a virtual repository, Artifactory did not work as expected at first attempt. | | RTFACT-30292 | Medium | Fixed an issue whereby, when trying to remove an SSH key from Artifactory, the key was not completely removed. | | RTFACT-30297 | Medium | Fixed an issue related to Conda whereby, when trying to deploy an artifact with an empty `noarch` metadata value, Artifactory did not calculate the package metadata as expected. | | RTDEV-39105 | Medium | Fixed an issue related to Maven whereby, Artifactory did not force authentication for unavailable artifacts in virtual repositories in the native JFrog Platform WebUI even when the Force Authentication checkbox was selected. | | RTDEV-39036 | Medium | Fixed an issue related to npm whereby, Artifactory did not support installing external dependencies with URLs containing question marks (?). | | RTDEV-38815 | Medium | Fixed an issue related to Go and PyPI whereby, when resolving artifacts from remote repository using a plugin that uses the `org.artifactory.exception.CancelException` class, Artifactory returns an incorrect error. | | RTDEV-38116 | Medium | Fixed an issue that prevented sites using Oracle RAC from supporting Federated repositories. For more information, see Oracle RAC support for Federated repositories. | | RTDEV-38849 | Medium | Fixed an issue that caused an unexpected server error when deleting a Release Bundle v2. | ## Artifactory 7.80 This section includes all the Artifactory 7.80 releases. ### Artifactory 7.80.0 SaaS Released: 14 February, 2024 **Feature Enhancements** - **Support for new CocoaPods CLI Commands** Artifactory now supports using the `pod search` and `pod list` commands for local and remote CDN repositories. - **Auto Healing of Federated repositories enabled by default** The auto-healing mechanism introduced in version 7.71.1 is now permanently enabled for all customers who work with Federated repositories. This mechanism checks Federated repositories at regular intervals for exhausted queues (queues that have exceeded the maximum number of attempts to send events to other Federation members), resets the failed events automatically, and tries again to sync with the target mirror. For more information, see [Federation Recovery and Auto-Healing](/artifactory/docs/federated-repositories#federation-recovery-and-auto-healing). - **Solutions for resolving 'stuck' Full Sync operations on Federated repositories** Two new options have been introduced for resolving Full Sync operations that have become 'stuck', meaning the operation persists in the database but is not active in memory. For example, this situation can arise if a user restarts an Artifactory instance while a Full Sync operation is in progress. 1. A new [async task](/artifactory/docs/federated-repositories#system-properties) defined in the `system.properties` file (`artifactory.reset.stale.full.sync.job.interval.min`) can reset the status of a Full Sync operation that has become 'stuck', enabling the operation to restart. 2. A new [Federated Repository Force Full Sync API](https://docs.jfrog.com/artifactory/reference/federatedrepositoryforcefullsync) API enables you to force a Full Sync operation between the Federated repository members, interrupting another Full Sync operation that is already in progress. - **New menu options for creating Release Bundle v2 versions** The Actions menu in the Release Lifecycle Management [kanban](/governance/docs/promote-a-release-bundle-v2-version-in-the-platform-ui) board now includes options for creating a new version of the selected Release Bundle v2 from builds or other Release Bundles. For more information, see [Create a New Version of an Existing Release Bundle](/governance/docs/create-a-release-bundle-v2-in-the-platform-ui). - **Helm Virtual **`index.yaml`** Resolution Improvements** We have improved our index calculation mechanism for virtual repositories to minimize potential OOM issues. We recommend setting the **Metadata Retrieval Cache Period (Sec)** in the repository page in the JFrog Platform WebUI to 60 seconds or more. For more information, see [Helm Virtual Repository Index Improvements](/artifactory/docs/kubernetes-helm-chart-repositories#helm-virtual-repository-index-improvements). - **Automatically pair OAuth SSO users with JFrog Platform users** You can now automatically pair OAuth SSO users when they log in to the JFrog Platform with their JFrog Platform user based on their email address. No configuration change is required to enable the feature. For more information on OAuth SSO, see [OAuth SSO](/administration/docs/oauth-sso). **Resolved Issues** | JIRA Issue | Severity | Description | | :--------------------------------------------------------------------------------------------------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RTFACT-30253 | Medium | Fixed an issue whereby, when enabling the “Disable Artifact Resolution in Repository“ setting at the repository level, it was still possible to download the entire repository’s content as a ZIP file. | | RTFACT-30243 | Medium | Fixed an issue related to RPM whereby, when deploying a package with a name containing the substring `_tmp_`, Artifactory did not index it as expected. | | RTFACT-30272 | Low | Fixed an issue related to Maven whereby, when deploying a snapshot to a local repository with the `artifactory.maven.authentication.nonPreemptive` property enabled, Artifactory did not perform as expected. | | RTFACT-30256 | Low | Fixed an issue related to P2 whereby, Artifactory did not support creating a Smart Remote repository with a key containing special characters. | | RTFACT-30208 | Low | Fixed an issue whereby, when running the Update Repository Configuration REST API using a mismatched `rclass` parameter, Artifactory returned a 400 error specifying the `rclass` always as ‘local’, regardless of the repository type. | | RTDEV-39093 | Critical | Fixed an issue that excluded certain properties by default (`build.name`, `build.number`, `build.timestamp`) when promoting a Release Bundle v2 version. | | RTDEV-39037 | Critical | Fixed an issue that prevented a Release Bundle v2 from collecting all artifacts of the same name from within a single build-info module. | | RTDEV-38945 | Medium | Fixed an issue whereby, Xray did not support scanning builds with names containing German umlaut characters (ü). | | RTDEV-38928 | Medium | Fixed an issue that caused errors in the Release Lifecycle dashboard due to Release Bundle v2 promotions to a renamed or deleted environment. | | RTDEV-38927 | Medium | Fixed an issue that prevented failed Release Bundle v2 promotions from appearing with the correct icon on the Release Lifecycle dashboard. | | RTDEV-38828 | Medium | Fixed an issue whereby the process of reading the same binary multiple times simultaneously to the Cached Filesystem Binary Provider was getting stuck and caused high CPU processing. | | RTDEV-37966 | Medium | Established a limit to the number of versions (default = 200) that can be displayed for one Release Bundle v2 on the Release Lifecycle dashboard. | | RTDEV-37678 | Medium | Fixed an issue that caused the promotion and distribution filters on the Release Lifecycle dashboard to present Release Bundle versions created during the selected timeframe instead of versions that were promoted or distributed during that timeframe. | ## Previous Artifactory SaaS Releases Release Notes for Artifactory SaaS Releases earlier than 7.80 have been archived and can be downloaded as a PDF. You can download them from the [Legacy PDF Archive](https://releases.jfrog.io/artifactory/legacydocs/).