Try JFrog
Guides
Contact SupportTry JFrog
Start typing to search…
  1. Security

JFrog Security Self-Managed Releases

3.137.15

Released: February 3, 2026

Highlights

Catalog

JFrog Catalog now includes Public Labels, predefined labels created by the JFrog Security Research team to help classify and identify important package groups. Public labels are read-only and are applied automatically by JFrog, allowing for filtering and evaluation across the Catalog.

A new public label, MCP Servers, identifies packages originating from MCP (Model Context Protocol) servers, based on JFrog’s curated research.

Xray

The SBOM tab now supports the essential use case of viewing and updating OSS license information for components within the SBOM. You can open any component in the SBOM tree, review its detected licenses, and add, remove, or correct license entries directly from the UI. This enables accurate license attribution and improves compliance reporting for scanned artifacts. For more information, see How to view and modify licenses in the SBOM tab.

Feature Enhancements

JFrog Advanced Security

  • JFrog Advanced Security now includes Transitive Dependency Analysis, enabling deep contextual insight into vulnerabilities introduced through indirect (transitive) dependencies. For each CVE, users can now view:
    • The full call chain leading to the vulnerable function, including whether the call is direct or transitive.
    • A visual call graph illustrating the dependency path.
    • Highlighted evidence, such as functions, file paths, and line numbers, with one-click copy for easy sharing.
  • Added support for exporting Secrets scan results in CycloneDX (CBOM) format.

Xray

  • Added REST API support for creating Custom Licenses in Xray.
  • The Impact Path view has been upgraded from the Bullseye layout to a more intuitive tree-based visualization, improving clarity and navigation.
  • Xray now supports scanning multi-architecture images. The results are presented as a unified scan summary for the entire image, along with individual scans for each contained architecture.
  • Full License Text Retrieval in Attribution and SBOM - Adds the full license text of generic licenses.
  • A new REST API, Get Jira Integration Status, has been introduced to enable programmatic retrieval of the current health and operational status of an existing Jira integration.
  • Added support for ingesting VEX (Contextual Analysis) information from external CycloneDX sources. Requires Advanced Security.
  • Added a new REST API endpoint, /api/v1/sbomMigration/status, to retrieve the current SBOM migration status.
  • Added support for a text output format for the License Attribution Report.
  • Added component supplier information to SPDX reports in accordance with the NTIA 2021 SBOM guidelines.
  • Added Impact Search capability for searching vulnerability identifiers or package identifiers across the entire Xray database.
  • A new REST API, Get Jira Integration Status, has been introduced to enable programmatic retrieval of the current health and operational status of an existing Jira integration.

Curation

  • Added support for additional Maven repositories:

  • The issue related to the selection of the NPM “latest” tag has been resolved. When the version referenced by the latest tag does not represent the most recent compliant release (for example, when newer versions exist but are not tagged as latest), the inspection process now continues to evaluate all available versions. It automatically removes any non-compliant versions from the metadata.

  • Loading custom certificates into ${JF_PRODUCT_HOME}/var/etc/security/keys/trusted is now supported for secure communication with Catalog Central when a proxy server is configured.

  • Introduced bulk assignment of packages to labels to support waivers across all current and future package versions.

  • Increased the maximum number of labels that can be assigned to a single package to 500.

  • Introduced a new public API that returns the currently active Catalog version.

  • Added support for the Pub ecosystem in Catalog and Curation policies.

  • Added support for PHP Composer in Catalog and Curation policies.

  • Added support for Debian and Ubuntu in Catalog and Curation policies.

  • Added support for waiver requests in the API and UI, enabling developers to request waivers from policy owners for specific blocked packages, in addition to the existing CLI flow.

Resolved Issues

JiraDescription
XRAY-133423Resolved a security vulnerability identified as CVE-2025-4517.
XRAY-133925Resolved an issue where the WorkersCount API reported an incorrect number of workers used for SBOM Impact Analysis.
XRAY-133583Optimized license assignment during the scan process.
XRAY-132937Added support for Debian and Ubuntu copyright information in the attribution report.
XRAY-132829Resolved tab click behavior issues, added package type auto-complete, and updated column order and formatting in Impact Search.
XRAY-132850Resolved an issue where some RabbitMQ queues failed to replicate consistently across all nodes when Quorum Queues were disabled.
XRAY-132738Resolved an error during JF Docker Scan execution when OCI annotations were empty.
XRAY-132657Migrated the Descendants Tree to the new UI tree component.
XRAY-131885Resolved an intermittent Indexer crash.
XRAY-131798Resolved an issue where re-scanning Release Bundles after deleting ignore rules did not generate expected violations.
XRAY-131790Resolved incorrect component IDs returned during fix-version checks for Debian distributions using the new SBOM.
XRAY-131704Resolved an issue where license violations from Git repository scans failed to load in the violation right pane.
XRAY-131644Resolved an issue in Xray Reports that caused redirect errors during navigation.
XRAY-131616Resolved an issue that caused errors during RabbitMQ4 installation.
XRAY-131573Resolved an issue caused by incorrectly formatted requests in the Violations API.
XRAY-131562Resolved an issue that prevented navigation away from the Vulnerabilities Report tab.
XRAY-131434Resolved an issue where dependency information did not appear in Build SBOM exports.
XRAY-131393Resolved an issue where the completion log was printed before analysis had finished.
XRAY-131301Resolved a security vulnerability identified as CVE-2025-47913.
XRAY-131012Resolved an issue where some external links to license information under the SBOM tab were broken.
XRAY-130792Resolved an issue with NPM “latest” tag handling that could select non-compliant versions; all versions are now evaluated and non-compliant releases excluded.
XRAY-130635Resolved an issue that caused errors when cloning a report.
XRAY-130525Resolved an issue that caused false positives for specific RPM components.
XRAY-130339Resolved an issue where navigating to the root folder of GitLab servers under Git Repositories could return a 500 error.
XRAY-130154Resolved an issue where on-demand secrets scans via the JFrog CLI could fail when custom secrets were matched.
XRAY-129148Fixed the curation email sending mechanism for SaaS customers using CNAME.
XRAY-129037Resolved an issue where packages with invalid or outdated license metadata were not updated during forced reindex operations.
XRAY-129030Resolved an issue that caused sorting preferences to reset in the Report Results view.
XRAY-128937Resolved an issue where opening the on-demand scans UI could result in a timeout.
XRAY-128360Resolved an issue where incorrect Helm chart files caused the SCA scan to freeze.
XRAY-128113Resolved an issue where multi-arch image scans were not saved to the database.
XRAY-127727Resolved an issue where Violation Report filters showed only the first 1,000 Watches.
XRAY-127669Resolved an issue where the Package Type column in Vulnerability Reports was empty.
XRAY-127407Resolved an issue where include/exclude patterns in Vulnerability Reports did not work correctly.
XRAY-127329Resolved an issue in input parsing within the Reindex flow.
XRAY-127291Added the Xray ID field to the CVE policy violation details pane for improved traceability.
XRAY-127276Resolved a security vulnerability identified as CVE-2025-59375.
XRAY-126114Resolved an issue that caused failures when scanning a specific CRAN package.
XRAY-125318Resolved an issue where “Unknown” license violations did not display impact paths.
XRAY-125088Resolved an issue that caused inconsistencies in the displayed violation count.
XRAY-124905Added the missing atlassian-end-user-license-agreement-3.0 license to the Xray license database.
XRAY-122439Resolved an issue where fix versions were not displayed for some packages during on-demand scanning.
XRAY-116071Resolved an issue where offline DBSync displayed incorrect migration instructions during synchronization.
XRAY-114874Resolved an issue where not all groups appeared when selecting a waiver decision owner during policy creation.
XRAY-90900Added catalog installation support for Ubuntu 24.04 and Debian 12.

3.137.17

Released: February 6, 2026

Resolved Issues

3.137.18

Released: February 10, 2026

Resolved Issues

JiraDescription
XRAY-134727Resolved a security vulnerability identified as CVE-2025-15467.
XRAY-134548Resolved Policy Enforcer fallback behavior that could incorrectly generate CVE violations marked Not Applicable when an artifact was scanned before the CVE was introduced to the scanner’s vulnerability database.
XRAY-134152Resolved an issue that caused the Git repositories screen to fail to load in some cases.

3.137.20

Released: February 15, 2026

Resolved Issues

JiraDescription
XRAY-135140Resolved a security vulnerability identified as CVE-2025-68121 in Cloud environments.
XRAY-134548Improved policy evaluation accuracy for new CVEs by refining the fallback logic for artifacts awaiting a re-scan.
XRAY-130107Enhanced the secret detection engine filtering logic to reduce false positives caused by example local database configurations in installation scripts.

3.137.21

Released: February 19, 2026

Resolved Issues

JiraDescription
XRAY-135140Resolved a security vulnerability identified as CVE-2025-68121 in Cloud environments.

3.137.22

Released: February 23, 2026

Resolved Issues

JiraDescription
XRAY-135801Improved detection of Debian packages in ECHO Docker images.

3.137.23

Released: February 25, 2026

Resolved Issues

JiraDescription
XRAY-135639Resolved an issue that caused RabbitMQ 4 upgrades to fail in Xray Platform Helm charts and OpenShift installers.

3.131.15

Released: November 9, 2025

Highlights

Curation

Conda Support

Curation now supports Conda packages.

VS Code Support

You can now curate VS Code remote repositories created through the AI Editor Extensions — apply policies, conditions, and governance controls to manage VS Code packages with the same flexibility as any other package type. For more information, see How to Curate VS Code Remote Repositories.

*Requires an Ultimate or Unified Security Bundle.

Compliant Version Selection

Curation now returns the highest policy-compliant package version instead of blocking requests, minimizing development disruptions. Supported for PyPI and NPM. For more information, see Compliant Version Selection.

Advanced Security

Rules for ML Model Types

You can now define package-version rules for ML model types to block and/or notify risky formats and enforce approved versions.

Xray

Jira Integration

Xray now offers REST APIs for seamless Jira integration using Basic Authentication. For more information, see JIRA INTEGRATION.

Scanning Multi-architecture Images

Xray now supports scanning multi-architecture images. The results are presented as a unified scan summary for the entire image, along with individual scans for each contained architecture.

Xray CVSS v4.0 Scoring Support

Xray now supports CVSS v4.0 scoring in addition to CVSS v3 and v2. CVSS v4.0 introduces a more detailed, flexible, and accurate framework that allows security professionals to perform more precise risk assessments by better incorporating exploitability, the evolving threat landscape, and the unique context of their environments. This enhancement ensures that Xray’s vulnerability scoring remains up-to-date and aligned with the latest industry standards, providing a more comprehensive view of vulnerability severity and risk impact.

Xray Helm Chart Scanning Support

Xray now supports scanning Helm charts to identify vulnerabilities and license compliance issues within the chart’s packaged dependencies.

Create Custom License REST API

Added REST API support for creating Custom Licenses in Xray.

Catalog

Valkey Support

Added installation and upgrade support for JFrog Valkey, an open-source in-memory data store used in JFrog Catalog deployments. Supported across Docker Compose, RPM/Debian, Linux Archive, Helm, and OpenShift installations. For more information, see Install Valkey.

Feature Enhancements

Xray

  • Added support for ant-style patterns in the specific package policy.

  • Xray now supports CPE (Common Platform Enumeration) matching during SBOM ingestion for generic components.

  • Added support for Apache 2.0 NOTICE information in SBOM exports (SPDX and CycloneDX).

  • Xray now supports ingesting SBOMs in SPDX format, expanding compatibility with industry-standard Software Bill of Materials specifications.

  • Added Support for Exporting SBOM in SPDX Format version 2.3.

  • Added support for a new macro JFrog Research Severity in Native Jira Integration. It uses severity from JFrog Research when available, falls back to CVE data, or applies your default value if neither is found.

  • License Attribution report is now supported in the UI as well - can be triggered from the resource export dialog.

  • Automatic License Conclusion (license resolution) now shows concluded licenses as a different column in PDF, and as “concluded” property in SDPX and CycloneDX.

  • Added support in Xray to detect cpp components based on text patterns embedded in compiled binaries.

  • Enhanced Violations Reporting with Scheduling, Sharing, and Dashboards.

    We've introduced a powerful new experience for generating Violations Reports. Users can now:

    • Use a step-by-step wizard to define report scope across repositories, builds, release bundles, and projects
    • Schedule reports to run daily, weekly, or monthly.
    • Share reports directly with teammates via email.
    • Interactive dashboards that highlight policy violations per type, severity and applicability, along with a top 10 CVEs violations widget.
    • Detailed table.

  • Enhanced Vulnerabilities Reporting with Scheduling, Sharing, and Dashboards

    We've introduced a powerful new experience for generating Vulnerabilities Reports. Users can now:

    • Use a step-by-step wizard to define report scope across repositories, builds, release bundles, and projects.
    • Schedule reports to run daily, weekly, or monthly.
    • Share reports directly with teammates via email.
    • View insights through a new aggregated dashboard with severity, applicability, and top 10 vulnerabilities widgets.
    • Filter results based on vulnerability applicability, severity, or component.
    • Explore full vulnerability details with remediation guidance and contextual analysis.
    • Export an overview PDF.

Catalog

Introduced License Correction Request, you can open a request in the Catalog UI for packages with unknown or misidentified licenses. The JFrog team reviews and updates the license based on their findings.

Source Code

You can now integrate Frogbot with your GitHub repositories using the JFrog GitHub App. This integration simplifies setup by automatically configuring Frogbot with GitHub Actions, adding the required secrets, and opening a workflow pull request in each selected repository. Once enabled, Frogbot continuously scans commits and pull requests for security issues, adds comments with findings, and can even open fix pull requests for vulnerable dependencies. This integration is supported for repositories under GitHub Organizations.

Resolved Issues

JiraDescription
XRAY-119896Resolved a jf bs scan command issue.
XRAY-115356Fixed mismatch between detected license in Xray vs Policy license selector - in license “LicenseRef-jfrog-ms-dot-net-library-eula“
XRAY-116447The Any Repo option was incorrectly disabled for users without admin permissions, even if they had all the required permissions to add repositories to a watch.
XRAY-118970The fix version was not displayed for some packages in on-demand scanning
XRAY-117101Fixed an issue with the dropdown in the Xray tab in Artifactory. Users can now switch the violations table view between active and ignored issues.
XRAY-116057Failed to update the Scan Status of the artifact
XRAY-115356Fixed mismatch between detected license in Xray vs Policy license selector - in license LicenseRef-jfrog-ms-dot-net-library-eula
XRAY-115121Improved vulnerability matching accuracy for RedHat components by factoring in branch information into the vulnerable range.
XRAY-113702Updated the logic for the Artifactory artifactgeneral API (used in the Scans List page) to handle encoding correctly: all characters are now decoded except for /, which remains encoded, as required by the API when passing artifact or build names.
XRAY-116447The Any Repo option was incorrectly disabled for users without admin permissions, even if they had all the required permissions to add repositories to a watch.
XRAY-114175Added TLS support for Advanced Security when running in router mode.
XRAY-122439Fixed an issue where scans of RBv2 did not generate exposure violations.
XRAY-122439Fixed an issue where fix versions were not displayed for some packages during on-demand scanning.
XRAY-124017Fixed an issue in Xray webhooks where high memory usage occurred in the policy enforcer when a single CVE impacted multiple artifacts.
XRAY-124017Fixed an issue in Xray webhooks where high memory usage occurred in the policy enforcer when a single CVE impacted multiple artifacts.
XRAY-123347Compressed files with uppercase extensions, such as .TGZ and .TAR.GZ, were not scanned.
XRAY-122770Scanning a build would hang indefinitely if the build name contained the string "build-info".
XRAY-104468Xray returned a 500 error from the artifactBlockedStatus endpoint when a DNS resolution error occurred while connecting to the database.
XRAY-123540Fixed an issue that caused the Policy Violations Report to break due to missing data.
XRAY-123764Fixed an issue where jf docker scan would time out and fail for scans that took longer than 10 minutes to complete.
XRAY-122808Fixed missing fields in jf docker scan JSON output when using --watches with an Operational Risk policy.
XRAY-115361Fixed an issue where not all violations were ignored when a Block Download grace period rule was assigned.
XRAY-124820Incorrect published dates on V2 Reports.
XRAY-120511Re-scanning an artifact in one remote repository incorrectly triggered a scan on a different remote repository.
XRAY-119885Xray's policy rule evaluation did not stop after the first rule match.
XRAY-122389The Xray Create Policy REST API allowed creating rules with incompatible criteria
XRAY-124246Fixed an issue where exposure violations were incorrectly ignored when creating an “Ignore CVE” rule scoped to all components and artifacts.
XRAY-124561dockerIgnoreInstalledFiles feature flag did not work properly.
XRAY-119548Updated the violations widget title to display “Loading” while data is being retrieved, instead of showing a zero value.
XRAY-123980Several licenses, including BSD-2-Clause-first-lines, BSD-2-Clause-Darwin, and LicenseRef-jfrog-w3c-03-bsd-license, were not available when creating an Xray License policy.
XRAY-122761A warning message appeared when saving a Watch, indicating a failure to retrieve the binary manager.
XRAY-118013A misleading log message appeared in Xray logs when a user viewed the scan data for a Debian package, despite the scan being successful.
XRAY-87110Project admins received an incorrect "Currently only admins can run an SCA scan" message when viewing the Xray Data tab for non-indexed resources, despite having permissions to initiate scans elsewhere.
XRAY-124184Fixed an issue that caused a specific on-demand Source Code Scan deletion to fail.
XRAY-125467Indexing a specific zip file may cause a runtime error, such as an invalid memory address or a nil pointer dereference.
XRAY-125238Watch violations were incorrectly triggered for packages with N/A CVSS scores when a policy's CVSS score rule range included the maximum score of 10.
XRAY-124208Fixed memory leak during scans of zstd archives.
XRAY-123758Unsupported Docker layer MIME types caused an irrecoverable indexing error.
XRAY-126975Fixed an issue that occasionally caused Impact Analysis to fail on Self Hosted installations of Xray.
XRAY-126787Incorrect status code error when exporting license attribution report without the Catalog service available.
XRAY-125880CVE duplications appeared in the Vulnerabilities tab in Xray scan results.
XRAY-123429Fixed an issue where on-demand scan results in the Platform UI displayed a CVE as “not_applicable” instead of “not_covered”.
XRAY-125885Fixed an issue where empty package names caused an error.
XRAY-124561dockerIgnoreInstalledFiles feature flag did not work properly.
XRAY-119548Updated the violations widget title to display “Loading” while data is being retrieved, instead of showing a zero value.
XRAY-123980Several licenses, including BSD-2-Clause-first-lines, BSD-2-Clause-Darwin, and LicenseRef-jfrog-w3c-03-bsd-license, were not available when creating an Xray License policy.
XRAY-122761A warning message appeared when saving a Watch, indicating a failure to retrieve the binary manager.
XRAY-118013A misleading log message appeared in Xray logs when a user viewed the scan data for a Debian package, despite the scan being successful.
XRAY-87110Project admins received an incorrect "Currently only admins can run an SCA scan" message when viewing the Xray Data tab for non-indexed resources, despite having permissions to initiate scans elsewhere.
XRAY-124184Fixed an issue that caused a specific on-demand Source Code Scan deletion to fail.
XRAY-125467Indexing a specific zip file may cause a runtime error, such as an invalid memory address or a nil pointer dereference.
XRAY-125238Watch violations were incorrectly triggered for packages with N/A CVSS scores when a policy's CVSS score rule range included the maximum score of 10.
XRAY-124208Fixed memory leak during scans of zstd archives.
XRAY-123758Unsupported Docker layer MIME types caused an irrecoverable indexing error.
XRAY-126975Fixed an issue that occasionally caused Impact Analysis to fail on Self Hosted installations of Xray.
XRAY-126787Incorrect status code error when exporting license attribution report without the Catalog service available.
XRAY-125880CVE duplications appeared in the Vulnerabilities tab in Xray scan results.
XRAY-123429Fixed an issue where on-demand scan results in the Platform UI displayed a CVE as “not_applicable” instead of “not_covered”.
XRAY-125126Fixed an issue affecting third-party components in the Applicability scanner.
XRAY-127701The Attribution Report was failing for builds.
XRAY-127446CPE parsing created empty Component IDs.
XRAY-127028Fixed default component type classification and fixed component type classification for ML models.
XRAY-127368Fixed a UI bug in the Report right pane - caused overflow if too many licenses are selected.
XRAY-127250Improved global permissions fetching, which caused potential slowness in the Curation UI page loading.
XRAY-126104Comparing build versions in the UI failed with a 'Mandatory fields are missing' error when the build name contained a forward slash ('/').
XRAY-125318The Impact Path was not displayed for packages with Unknown Licences.
XRAY-128360Incorrect Helm Charts files in the scanned filesystem were causing the SCA scan to freeze.
XRAY-128113In some cases, Xray failed to save Multi-arch image scans to the database.
XRAY-127669The Package Type column in Vulnerability Reports was empty.
XRAY-125318“Unknown” license violations did not display any impact paths.
XRAY-116071Resolved an issue where offline DBSync showed the wrong migration instructions during the synchronization process.
XRAY-127940Xray scans were hanging when scanning JAR executables
XRAY-127669The Package Type column in Vulnerability Reports was empty.
XRAY-125318“Unknown” license violations did not display any impact paths.
XRAY-127287Force-reindexing was sending the wrong repository for the artifact.
XRAY-127051Custom licenses cannot be fully removed in the old Xray view.

3.131.18

Released: November 11 , 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.131.19

Released: November 18, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.131.20

Released: November 17, 2025

JiraDescription
XRAY-126667Gradle curation remained stuck in “Pending update”.

3.131.22

Released: December 1, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.131.23

Released: December 3, 2025

JiraDescription
XRAY-129590The .jpi file scanning did not work properly.

3.131.24

Released: December 7, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.131.25

Released: December 8, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.131.26

Released: December 15, 2025

JiraDescription
XRAY-129037Incorrect licensing in packages wasn’t fixed even with force-reindex.
XRAY-127051Custom licenses cannot be fully removed in the old Xray view.
XRAY-131461Scanning Docker list-manifests in remote repositories could cause Docker image scans to fail.

3.131.27

Released: December 16, 2025

JiraDescription
XRAY-130623Fixed an issue that caused incorrect license matching in Conan packages

3.131.28

Released: December 22, 2025 ​ This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.131.29

Released: December 28, 2025 ​ This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.131.30

Released: December 28, 2025

JiraDescription
XRAY-129037Incorrect licensing in packages wasn’t fixed, even with force-reindex.
XRAY-127051Removing licenses in the old Xray UI did not work properly.

3.131.31

Released: December 1, 2025

JiraDescription
XRAY-131113Fixed CVE-2025-61729

3.131.32

Released: January 13, 2026

JiraDescription
XRAY-131113Fixed CVE-2025-61729

3.131.33

Released: January 20, 2026

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.131.35

Released: January 27, 2026

Resolved Issues

JiraDescription
XRAY-131573Resolved an issue that caused errors due to incorrectly formatted requests in the Violations API.
XRAY-133857Resolved an issue affecting hash persistence for packages ingested through both binary and declarative ingestion flows.

3.131.38

Released: February 3, 2026

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.131.39

Released: February 5, 2026

Resolved Issues

JiraDescription
XRAY-134501Updated YQ utilities in Xray

3.131.40

Released: February 19, 2026

Resolved Issues

JiraDescription
XRAY-135140Resolved a security vulnerability identified as CVE-2025-68121 in Cloud environments.
XRAY-134727Resolved a security vulnerability identified as CVE-2025-15467.
XRAY-134548Improved policy evaluation accuracy for newly introduced CVEs by refining fallback logic for artifacts awaiting re-scan.
XRAY-130107Enhanced the secret detection engine filtering logic to reduce false positives from example local database configurations in installation scripts.

3.141.31

Released: February 25, 2026

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.124.11

Released: July 29 , 2025

Highlights

Xray

Legal

Installation

JFrog has added support for RabbitMQ Quorum Queues, available as an optional parameter in system.yaml, because RabbitMQ has deprecated Classic Queue mirroring in version 4.x. Consequently, JFrog will also deprecate Classic Queue support and transition to Quorum Queues. It is recommended to enable Quorum Queues in Xray, as JFrog plans to fully transition to RabbitMQ 4.x and discontinue Classic Queue support in upcoming versions.

Feature Enhancements

Xray

A new configuration option has been introduced to enable Xray indexing when creating new repositories automatically. To index all new repositories by default, set the following flag in Xray system YAML: server.enableXrayOnNewRepos=true

Jira Integration

  • Introduced new filters that enable users to categorize policy violations based on their associated Jira tickets. This improvement allows for more efficient management and resolution of violations.
  • The search functionality within the Policy Violations UI has been enhanced to allow users to search for violations using Jira Ticket IDs. This makes it easier to find relevant details related to specific violations quickly.
  • Xray now supports a Skip Proxy option, enabling users to bypass global proxy settings when integrating with Jira.

Package Support

Xray now supports pub packages ( Dart and Flutter).

PostgreSQL Support

Upgraded bundled PostgreSQL to 16.8 in native, archive, and Docker Compose installers.

Upgraded bundled PostgreSQL to 16.6 in Helm installers.

Catalog

Catalog now supports Conda packages.

Introducing the Labels Center in Catalog; a unified view to manage all labels used in your organization. For more information, see Configure and Manage Labels.

Source Code

New REST APIs are available for managing and retrieving source code scan data, including endpoints to list repositories, branches, commits, and detailed scan results. These APIs enable precise visibility and filtering of scanned Git data across your projects.

The results of on-demand scans run using the CLI jf audit --secrets command are now displayed in the Scans List table.

You can now export Git repository scan data directly from the user interface via Platform >Xray >Scans List.

Advanced Security

You can now create and generate an Exposures Report that gives you a visual representation of which components in your code and binaries are actively invoked and potentially exploitable. This helps you focus on real-world security risks rather than theoretical vulnerabilities. Use advanced filters and scoped views to customize the report to your specific needs and environments. The Exposures Report is also supported via the new REPORTS REST APIs:

Curation

  • Curation now supports Google Maven repositories.

  • Enhancements to JFrog Curation Audit Capability:

    • Improved package search functionality for easier navigation and discovery.
    • Clearer distinctions between blocked, allowed, and dry-run packages.
    • Introduced a new PASSED package type for items that successfully passed curation without specific policy inspection, providing the user a full view of the Curation process.

Resolved Issues

JiraDescription
XRAY-104468Xray returned a 500 error from the artifactBlockedStatus endpoint when a DNS resolution error occurred while connecting to the database.
XRAY-115251Fixed an issue where a misleading error message, “Cannot read properties of undefined (reading 'forEach')”, was displayed when creating a new watch on the Watches page.
XRAY-116057Updating the scan status of an artifact failed.
XRAY-119739The Xray search did not work properly in some cases.
XRAY-118268Fixed an issue affecting search, sorting, and pagination in the source code scans list.
XRAY-116062Fixed an issue when license aliases were not saved in the UI.
XRAY-115121Improved vulnerability matching accuracy for Red Hat components by factoring in branch information into the vulnerable ranges.
XRAY-114426Fixed an issue where templates were incorrectly appended to the component suffix in the “Descendants” tab of the scan results.
XRAY-109338Fixed an issue regarding the version identification of Go package versions
XRAY-115368A Project admin could not scan an existing Release Bundle from the UI.
XRAY-74193Xray did not detect licenses referenced with a symlink in a package.
XRAY-116135Fixed an issue that prevented automatic scanning of Secrets in RBv2 Docker builds.
RAY-110288Release Bundle not visible in Xray Scan Lists tab.
XRAY-116601When scanning Azure Linux images, components were misidentified, which led to false positives.
XRAY-116062Fixed an issue when license aliases were not saved in the UI.
XRAY-115121Improved vulnerability matching accuracy for Red Hat components by factoring in branch information into the vulnerable ranges.
XRAY-114426Fixed an issue where templates were incorrectly appended to the component suffix in the “Descendants” tab of the scan results.
XRAY-109338Fixed an issue regarding the version identification of Go package versions
XRAY-115368A Project admin could not scan an existing Release Bundle from the UI.
XRAY-74193Xray did not detect licenses referenced with a symlink in a package.
XRAY-119739The Xray search did not work properly in some cases.
XRAY-118268Fixed an issue affecting search, sorting, and pagination in the source code scans list.
XRAY-114127Mismatch in counts on the Reports page due to pagination issues
XRAY-114124CVE and CVSS columns on the Reports page were not populated for Vulnerability Reports.
XRAY-24708An incorrect number of vulnerabilities was sent to the Metadata Server.
XRAY-101346Fixed missing applicability details in violation results returned by the Scan Build V2 API.

3.124.13

Released: August 04, 2025

JiraDescription
XRAY-123540Fixed an issue that caused the Policy Violations Report to break due to missing data.
XRAY-114175Added TLS support for Advanced Security when running in router mode.
XRAY-120992Added configurable NodeAffinity to assign pods to specific node pools.

3.124.14

Released: August 07, 2025

JiraDescription
XRAY-124017Fixed an issue in Xray webhooks where high memory usage occurred in the policy enforcer when a single CVE impacted multiple artifacts.

3.124.15

Released: August 11, 2025

JiraDescription
XRAY-122786Xray failed to index Axis Archive (.aar) files by incorrectly identifying them as Android Archives.
XRAY-115361Fixed an issue where not all violations were ignored when a Block Download grace period rule was assigned in a Policy.

3.124.18

Released: August 17, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.124.19

Released: August 17, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.124.20

Released: August 19, 2025

JiraDescription
XRAY-125112The Xray HA upgrade process might fail because the Router service failed to start, displaying the following error: Could not update configuration for key.

3.124.21

Released: September 3, 2025

JiraDescription
XRAY-123764jf docker scan timed out and failed for scans that took longer than 10 minutes to complete.

3.124.23

Released: September 17, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.124.24

Released: September 18, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.124.25

Released: September 21, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.124.26

Released: September 21, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.124.27

Released: September 26, 2025

JiraDescription
XRAY-110727Optimized Log Rotation: Xray now skips rotation of empty log files, preventing unnecessary file operations.
XRAY-120511Rescanning an artifact in one remote repository incorrectly triggered a scan on a different remote repository.

3.124.28

Released: October 8, 2025

JiraDescription
XRAY-125238Violations were incorrectly triggered for packages with N/A CVSS scores when a Policy's CVSS score rule range included the maximum score of 10.

3.124.31

Released: October 20, 2025

JiraDescription
XRAY-124260Fixed an issue that caused slowness in Xray violations API for highly active watches.

3.124.32

Released: October 29, 2025

JiraDescription
XRAY-127940Fixed an issue that caused scans to hang when analyzing JAR executables.

3.124.33

Released: November 09, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.124.34

Released: November 16, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.124.36

Released: January 4, 2026

Jira

Description

XRAY-129902

Applicable CVEs are detected when running jf audit or Frogbot scans, however, in the JFrog platform, the same CVEs are shown as Not Covered instead of Applicable.

XRAY-131113

Fixed CVE-2025-61729

3.124.37

Released: January 13, 2026

JiraDescription
XRAY-132850Fixed an issue where certain RabbitMQ queues were not replicating across all nodes in a high-availability configuration with Quorum Queues disabled.

3.124.38

Released: January 20, 2026

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.124.39

Released: February 4, 2026

JiraDescription
XRAY-133423Resolved a security vulnerability identified as CVE-2025-4517.

3.124.40

Released: February 25, 2026

Resolved Issues

JiraDescription
XRAY-135140Resolved a security vulnerability identified as CVE-2025-68121 in Cloud environments.
XRAY-134727​Resolved a security vulnerability identified as CVE-2025-15467.
XRAY-134548Improved policy evaluation accuracy for newly introduced CVEs by refining fallback logic for artifacts awaiting re-scan.
XRAY-130107Enhanced the secret detection engine filtering logic to reduce false positives from example local database configurations in installation scripts.

3.124.41

Released: March 11, 2026**

Resolved Issues:

JiraDesription
XRAY-136172Improved handling of JSONC files, such as tsconfig.json, in Secrets scans for Docker images, which could previously fail and result in a partial scan status.
XRAY-136144Updated JFrog Router version to 7.205.4.
XRAY-135768Resolved an issue where an SBOM file encoding error could cause the entire scan to fail.
XRAY-135558Resolved an issue where Exposures scans could crash on malformed or corrupted archive files (.tgz, .tar.gz, .deb), resulting in repeated scan failures and a partial scan status. The scanner now gracefully skips unextractable archives and continues the scan.
XRAY-132636Resolved an issue where Exposures scans failed on OCI artifacts stored in Docker repositories, resulting in a partial scan status. Non-container artifacts pushed via tools like ORAS are now correctly identified and handled gracefully.
XRAY-124208Resolved a memory leak that could occur during scans of zstd archives.

3.118.8

Released: April 28, 2025

Features Enhancements

Xray

  • Added support for SBOM component properties in compliance with the German SBOM Regulation (BSI TR-03183) and the Indian SBOM Regulation (CERT-IN SBOM Guidelines).

  • Xray now supports scanning podspec.json (extension of Cocoapods).

  • Upgraded bundled PostgreSQL to 16.8 in native, archive, and Docker Compose installers.

  • Upgraded bundled PostgreSQL to 16.6 in Helm installers.

  • The Export Component Details v2 REST API now supports passing an array of objects instead of a single JSON. This allows you to generate SBOM reports for multiple artifacts at a time and the aggregated reports will be returned in a “multiple_components_report.zip” file.

  • Enhanced the Xray-Jira integration by adding the Jira Status Retrieval feature. Xray users can now view the status of related Jira tickets without leaving the Xray platform.

    Note: This feature will be enabled by default for all integration types, except for OAuth2 authentication with Jira Cloud. OAuth2 Jira Cloud users will need to follow the additional steps outlined in the Enabling for OAuth2 on Jira Cloud section to activate the feature.

  • Added support for Full License Text content in Legal reports.

  • Added an option to exclude specific file names from a scan when they exist in the resource (artifact/build/release bundle).

  • Added support for installing multiple Xray applications in a single namespace.

  • Added a new capability to Xray policies, allowing a grace period for violations before blocking downloads.

Curation

  • You can now export audit data in CSV format directly from the UI in Curation > Audit.

  • You can now export audit data in CSV format through the Approved/blocked-audit REST API.

  • Users can now connect repositories by package type to Curation, gaining a comprehensive overview of all curatable ecosystems in their Artifactory. Easily manage connections, view status updates for each package type, and define automatic connections for future repositories. Stay informed with notifications for any disconnections, ensuring seamless management and oversight.

  • Create tickets or notifications from the system if there is a blocking action in the audit using Webhooks events. Whenever a curation process encounters a blocked package, an event is triggered and sent to the designated webhook. The event includes comprehensive details about the blocked package, such as:

    • Package Information: Identifying details of the package that was requested.
    • Requester Details: Information on the user or entity that requested the package.
    • Policy Violation: A description of the specific policy violation that resulted in the blocking of the package.

  • You can now connect repositories by package type to Curation, gaining a comprehensive overview of all curatable ecosystems in your Artifactory. Easily manage connections, view status updates for each package type, and define automatic connections for future repositories. Stay informed with notifications for any disconnections, ensuring seamless management and oversight.

  • EPSS (Exploit Prediction Scoring System) is a statistical probability of exploiting a CVE, enabling security teams to prioritize remediation efforts. The custom CVSS condition now supports a new relaxed condition: If the EPSS score is below a specified threshold, the policy will not block the corresponding CVE.

  • Create tickets or notifications from the system to monitor the creation of Waiver Requests and related documentation in external systems using Webhooks events. Introduced two new Webhook events for Waiver Request creation and Waiver Request update. For more information, see Webhooks.

  • You can now create, read, update, and delete curation policies and conditions using the REST API.

  • Curation now supports Rust repositories.

  • Added a new webhook that enables security teams to understand if there were any changes in the configuration of Curation policies, including changes in the policy condition. This will not detect changes in label/package applications.

Catalog

  • Catalog now supports Google Maven repositories.

Source Code

  • CLI

    • You may now use the Waiver feature for Curation, using the JFrog jf curation-audit CLI command. The Curation Waiver feature allows you to exclude specific packages or versions from policy restrictions.
    • A Violations column was added to the Git Repositories tab under Scans List. This means that you may now see the violation count for each Git commit.

  • Frogbot

    • Frogbot scan results are now available directly in the JFrog platform's Scans List, under the Commits tab or associated Pull Request (PR). This centralized view provides clear visibility into security issues—including Secrets, SAST findings, and vulnerabilities—detected in your source code and dependencies, helping you triage and remediate risks faster during development.

Advanced Security

With the new Custom Scanner, you can now define search patterns to detect sensitive information in your artifacts and source code, scanning both binary and text files.

Resolved Issues

Jira

Description

XRAY-109054

When trying to access the Xray Data tab of an unindexed (hidden) artifact, the following error is displayed: Server Error Request failed with status code 500

XRAY-97064

License Due Diligence report for artifacts with many child components returned empty impact paths.

XRAY-95570

Unable to view Xray scan data for builds with special characters in their names.

XRAY-98492

Improved performance of the block download functionality linked to JFrog Xray Policies.

XRAY-98659

A “DB Error” was issued when performing a jf scan CLI command.

XRAY-95081

Vulnerabilities were incorrectly reported for a resource with .digit(s) suffix in a Docker image that had been whiteouted.

XRAY-92685

Xray failed to display build overview data correctly for builds with a "+" symbol in their name.

XRAY-95242

Artifacts were not indexed due to database corruption of child files that lacked a corresponding root file.

XRAY-96292

The scan status of .exe files was stuck.

XRAY-104815

Fixed an issue where "block" and "approve" Curation package audit events were missing from the CSV export, despite being visible in the audit UI.

XRAY-99663

Some components were missing from the SBOM table when performing the SBOM import.

XRAY-102173

An issue in scanning 7zip files prevented opening files using the ARM64 LZMA2:18 BCJ SPARC method.

XRAY-85823

The response of API call POST xray/api/v1/violations/ignored returned an unexpected result

XRAY-101943

An SPDX report did not generate results for Release Bundles.

XRAY-95742

Xray Webhooks erroneously added violations in the scan callbacks from Policies that did not contain a specific webhook rule.

XRAY-97722

Fixed the search bar in the Git Repositories tab under Scans Lists.

XRAY-105520

In some cases, SBOM did not detect npm packages.

XRAY-106871

Fixed a jf scan command issue.

XRAY-96953

Fixed an issue where running out of space during a Docker image scan (jf docker scan) incorrectly displayed a successful scan with No Vulnerabilities Found.

XRAY-105498

Fixed errors in CycloneDX export of CycloneDX Ingest.

XRAY-106119

Fixed an issue with Xray scans timing out

XRAY-92999

When using Builds > By pattern in the Watch resources, the Watch did not issue violations for all the builds when one of the builds did not meet the pattern in the Watch.

XRAY-97920

Deploy notifications for builds did not work properly when using Projects.

XRAY-96950

When generating a report the report included deleted artifact scan data.

XRAY-102815

Fixed a UI issue where Exposure violations could not be viewed correctly on the Watch Violations page.

XRAY-101269

Resolved a UI issue in Scans List > Git Repositories where duplicated data caused infinite scrolling.

XRAY-108412

Emails for Repository Scans contained a broken link to the Violations tab in Scans List.

This issue impacts users who have edited the default Binary Manager ID (Artifactory ID). Older emails with broken links remain unchanged, but all future emails will have the correct links.

XRAY-106713

Xray failed indexing archive files which contained unsupported VMDK files

XRAY-100153

False positive vulnerabilities occur for case-sensitive Python package names inside a Docker image during a whiteout.

XRAY-103965

Fixed inconsistencies in vulnerability count in build scanning

XRAY-105826

Support for CVE details was added to the build overview for non-JFrog Advanced Security users.

XRAY-102624

Fixed an issue in RabbitMQ logs.

XRAY-87916

When running an Xray scan, the scan status remains stuck at Pending due to an incorrect violations response that returns a Pending status, even though the scan itself has been completed successfully.

XRAY-107400

Fixed an edge case in license resolution.

XRAY-44023

An Ignore Rule for a violation based on a specific version of a Release Bundle V2 affected all versions of the Release Bundle.

XRAY-105705

Resolved a UI issue where the Git Repository tab under Xray Scans List could not be viewed.

XRAY-106871

Resolved a jf scan command issue.

XRAY-105653

Resolved an issue with the Enriched by JFrog filter for CVEs and SAST in under Scans List.

XRAY-88801

Resolved multiple UX issues in the scan result filters under Scans List.

XRAY-105866

The watch filter and offset properties did not affect the "List Ignored Violations" API results.

XRAY-107926

Xray indexing fails when a remote Maven repository cached the lead artifact, but the pom was not cached (even if it existed in the remote repo).

XRAY-84604

The default retention policy configured in the Xray system.yaml file was not applied.

XRAY-109690

Indexer fails when an OS image (VMDK/IMG) does not contain a supported partition/filesystem

XRAY-110588

The dial timeout (the timeout to open a connection) configuration was used for regular timeouts (total timeout for an outgoing request), causing failures when indexing large artifacts.

XRAY-108976

Imported SBOM scans failed to recognize certain licenses

XRAY-99827

Users without relevant permissions could still view release bundles and their resources.

XRAY-88886

Adding builds for indexing via API within the Project scope behaved incorrectly.

XRAY-27772

Fixed an inconsistency with case sensitivity in search functionality on the Ignore Rules page.

XRAY-89513

While upgrading Xray, the license alias created for built-in licenses was not carried forward after the upgrade.


3.118.9

Released: April 29, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.


3.118.11

Released: April 29, 2025

Resolved Issues

JiraDescription
XRAY-115499Fixed an issue where Artifactory could hang when using policies that block unscanned artifacts due to incorrect scan status from Xray.

3.118.13

Released: May 8, 2025

Resolved Issues

Jira

Description

XRAY-109617

Docker's container shared memory size is 64MB by default. This amount is often insufficient for PostgreSQL's requirements, particularly when handling larger datasets or higher transaction volumes.

To address this, we have updated the PostgreSQL compose file to start PostgreSQL with 512mb of shared memory.

However, it's important to note that the actual shared memory requirement will depend on the database's performance. As we monitor the system, we may need to increase the shared memory allocation further based on the database performance observed at a later stage.

XRAY-115991

Fixed an issue when Xray scans fail on "invalid memory address or nil pointer dereference" error


3.118.14

Released: May 13, 2025

Resolved Issues

JiraDescription
XRAY-115991During the scan, Xray matches artifacts to component IDs. After implementing bulk optimization, we encountered a nil pointer exception, which has since been fixed.

3.118.17

Released: May 19, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.


3.118.20

Released: June 4, 2025

Resolved Issues

JiraDescription
XRAY-115107Fixed an issue where the build index resources configuration couldn't be changed after the build was added via the API.

3.118.22

Released: June 19, 2025

Resolved Issues

JiraDescription
XRAY-118272Some indexing workers were stuck during the download operation.
XRAY-115107The build index resources configuration could not be modified after the build was added through the REST API

3.118.23

Released: July 06, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.


3.118.24

Released: July 17, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.


3.118.25

Released: August 03, 2025

JiraDescription
XRAY-123540Fixed an issue that caused the Policy Violations Report to break due to missing data.

3.118.26

Released: August 05, 2025

JiraDescription
XRAY-124017Fixed an issue in Xray webhooks where high memory usage occurred in the policy enforcer when a single CVE impacted multiple artifacts.

3.118.27

Released: August 05, 2025

JiraDescription
XRAY-114175Added TLS support for Advanced Security when running in router mode.

3.118.28

Released: August 11, 2025

JiraDescription
XRAY-122786Xray failed to index Axis Archive (.aar) files by incorrectly identifying them as Android Archives.

3.118.30

Released: September 14, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.


3.118.31

Released: September 26 , 2025

JiraDescription
XRAY-110727Optimized Log Rotation: Xray now skips rotation of empty log files, preventing unnecessary file operations.
XRAY-120511Rescanning an artifact in one remote repository incorrectly triggered a scan on a different remote repository.

3.118.32

Released: August 19, 2025

JiraDescription
XRAY-125112The Xray HA upgrade process might fail because the Router service failed to start, displaying the following error: Could not update configuration for key.

3.118.36

Released: October 29, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.118.38

Released: November 10, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.118.40

Released: December 23, 2025

Resolved Issues:

JiraDescription
XRAY-131179Fixed CVE-2025-22868 by upgrading the OAuth dependency.

3.118.41

Released: December 30, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.118.42

Released: January 13, 2026

Resolved Issues:

JiraDescription
XRAY-132850Fixed an issue where certain RabbitMQ queues were not replicating across all nodes in a high-availability configuration with Quorum Queues disabled.

3.111.9

Released: January 30, 2025

Feature Enhancements

Xray

  • Installing Xray is now supported on Amazon Linux 2023 (AL3).

  • Xray now supports indexing raw disk images (.img) and SquashFS (.squashfs).

  • JFrog Self-Hosted customers will see an information message under the scans list prompting an upgrade to DBSync v3. We strongly encourage users to migrate to DBSync v3 promptly to ensure seamless and timely updates. For details, see Migration Guide for Self-Hosted Customers: Upgrading from DBSync V1 to V3.

  • Enhanced the clarity and readability of Jira Ticket Summary and Description fields created through the Xray-Jira integration.

  • Introduced a new Builds Security Overview dashboard that provides a centralized and comprehensive view of build versions where you can analyze trends, identify the most vulnerable components, and mitigate security risks effectively. For more information, see Builds Security Overview.

  • Added support for 3 additional fields in CycloneDX vulnerabilities description:

    • Vulnerability Ratings: Include CVSS Score, CVE severity, Scoring method, and Vector
    • Vulnerability Description: A detailed description of the specific vulnerability
    • Vulnerability CWEs: A list of CWE (Common Weaknesses Enumerations) that fit this specific CVE

    These 3 added fields greatly enhance the detail level and completeness of our CycloneDX SBOM reports.

  • You can now download the technician dashboard to view charts of metrics related to application performance. This REST API call will download a zip file with the dashboards as HTML files. Any admin user can access the REST API.

    REST API:GET api/v1/metrics/dashboard/download

  • Added Repo Path to the generated Violation reports.

  • Improved Operational Risk Policy by allowing the release age to be set in customized months instead of using a default range.

Advanced Security

  • Secrets Detection is now supported for the following types of repositories:

    • RPM
    • Debian
    • Alpine
    • Go
    • RubyGems
    • Gradle

  • Gradle repositories are now supported for Contextual Analysis.

  • Enhanced the design of the Exposures details (right pane).

Curation

  • You can now directly create a Curation Policy from a condition.
  • Introduced a guided process to help new Curation users get started. It clearly outlines steps like enabling curation, connecting repositories, and setting policies, with visual cues to track progress
  • Introduced a new Conditions Template that allows a Security Manager to create Curation Policies based on OpenSSF scorecard results. Conditions based on this template detect and block third-party packages whose scorecard scores (one or more) match the range you defined (including aggregated scores).
  • Curation policies can now be applied to repositories for a specific package type, including current and future repositories of the same type.

Catalog

JFrog Catalog can now be installed using Helm and OpenShift. For more information, see Install JFrog Catalog with Helm and OpenShift.

Resolved Issues

Jira

Description

XRAY-101948

Fixed the Impact Path tab in the right pane of Watch Violations.

XRAY-90229

In the Watch Violations screen, when clicking on an Exposures violation of package type Npm an error message appears: ‘Error getting Exposure scan’. A 404 was issued due to an incorrect path in the NPM package.

XRAY-92998

In the SPDX report, JFrog was falsely assigned as the Artifact Manufacturer.

XRAY-91040

When exporting a Vulnerabilities Report for an artifact from the Scans List page, the exported PDF was not sorted by severity order.

XRAY-88893

When running the command jf audit --watches=< > --fail=true, the fail_build field was missing from the response. This issue was reported in JFrog CLI version 2.64.0.

XRAY-91154

When running the command jf docker scan <image_path> --format json, the full_path field was missing in the response. This issue was reported in JFrog CLI version 2.64.0.

XRAY-95655

When the name of a build included the special character '/', navigating through the Build Versions in the Scans List page via breadcrumbs caused the UI to become unresponsive.

XRAY-95206

Xray could not display any versions of a build that contained the special character '/' in the build name after scanning.

XRAY-92685

Resolved an issue where Xray failed to display build overview data correctly for builds with a "+" symbol in their name.

XRAY-95132

Xray indexing failed for artifacts containing .pt extension files within zipped archives.

XRAY-94615

Fixed an issue when exporting CycloneDX reports for Release Bundles.

XRAY-93036

Indexing of artifacts with large license files took longer than expected

XRAY-83997

It was not possible to view Xray data on remote repositories when both "Any Local" and "Any Remote" permissions were granted.

XRAY-92483

The Xray Data tab for builds was infinitely loading.

XRAY-91762

The Exposures force scanning ability (Scan Now) for builds and RBV2 was removed as it was not supported.

XRAY-92466

The Violation report column headers were misaligned due to new additional columns.

XRAY-89785

Increased the Specific CVE IDs Policy condition to include up to 10k CVEs in one Policy rule.

XRAY-91233

The Scan Build REST API failed when the build contained a project key.

XRAY-90830

Report requests were stuck due to backend events.

XRAY-89975

Contextual Analysis results were missing in reports for remote repositories.

XRAY-88846

The JFrog CLI, in some cases, resulted in a “500 Internal Server Error” when running the “sbom-enrich” command.

XRAY-88805

The file path was sometimes missing for Exposures violations.

XRAY-88380

When generating a report using the REST API input validation was missing for the provided name, resulting in the creation of a report with an invalid name.

XRAY-87616

Xray could not scan artifacts from build info if the build was published using REST API without including the same values for the build.timestamp and body request started parameter.

XRAY-87395

The Export Details REST API call failed when the filename was more than 255 bytes

XRAY-86530

Fixed incorrect component referencing in CycloneDX - it was using “bom-ref” field instead of “affects” field.

XRAY-84772

REST API Ignore Rules are not applied in Docker On-Demand Scans when the name contains a slash.

XRAY-98492

Improved performance of the block download functionality linked to JFrog Xray Policies.

XRAY-96635

XRAY-97117

Resolved inefficiency in UI status checks within the DBsync migration wizard.

XRAY-87325

Removed socat as a dependency from Xray. As a result, socat will no longer be packaged or shipped with Xray deployments.

XRAY-92962

The results in Violations & License Reports were partial.


3.111.12

Released: February 2, 2025

JiraDescription
XRAY-96839Xray failed to display build versions for builds with a "~" symbol in their name.

3.111.15

Released: February 26, 2025

JiraDescription
XRAY-101948Fixed the Impact Path tab in the right pane of Watch Violations.

3.111.18

Released: March 11, 2025

JiraDescription
XRAY-107655Fixed Incorrect indentation of customVolumeMounts for the PolicyEnforcer container in Xray helm charts.
XRAY-105423Fixed an issue with Red Hat Vulnerability matching when the new SBOM model is enabled.

3.111.20

Released: March 11, 2025

JiraDescription
XRAY-107813Resolved an issue affecting exposure policy triggers for rescanned artifacts.
XRAY-102345Added option to exclude file name from scan when it exists in the resource (artifact/build/release bundle).

3.111.23

Released: March 11, 2025

JiraDescription
XRAY-107926Xray indexing failed when a remote Maven repository caches the lead artifact but does not cache the corresponding POM file (even if it exists in the remote repository).
XRAY-87916When running an Xray scan, the scan status remains stuck at "Pending" because the violations response incorrectly returns a "Pending" status, even though the scan has been completed successfully

3.111.24

Released: April 10, 2025

JiraDescription
XRAY-111091The Operational Risk violation ID was incorrectly displayed as the Artifact Component ID instead of the Operational Risk Source Component ID.

3.111.25

Released: April 17, 2025

JiraDescription
XRAY-114360Resolved an exposure scan failure caused by a logging permission error in containerized environments.

3.111.26

Released: May 15, 2025

JiraDescription
XRAY-116332Ghost artifact cleanup migration was pushing messages to the new content lane of the persist queue, causing delays in processing new scans.

3.111.28

Released: June 4, 2025

JiraDescription
XRAY-115107Fixed an issue where the build index resources configuration couldn't be changed after the build was added via the API.

3.111.30

Released: August 3, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.


3.111.31

Released: August 6, 2025

This patch fine-tunes a few things under the hood for better performance and a smoother experience.

3.107.11

Released: November 25, 2024

Feature Enhancements

Xray

Xray Reports

Added Repo Path to the generated Violation reports.

Retention Period Enhancement

Improved the retention period of scans, which will be recalculated once the artifact is downloaded. The retention period will be remeasured from the beginning of the configured retention.

Indexing CycloneDX SBOM Files

Added Xray support for indexing CycloneDX SBOM files (*.cdx.json or *.cdx.xml in Generic or Docker repositories)

Advanced Security

NuGet Support in Secrets

Secrets scanning is now supported on NuGet repositories.

JFrog Curation

Use JFrog Catalog Labels as Waivers in a Policy

This feature enables the security team to specify multiple packages and versions that can be excluded from the Policy (i.e., not violating it) allowing them to enter the repository. Waivers are added as labels on a per-policy basis, using preset labels from the JFrog Catalog.

Resolved Issues

JiraDescription
XRAY-91233The Scan Build REST API failed when the build contained a project key,
XRAY-90830Report requests were stuck due to backend events.
XRAY-78247Xray didn’t block the download of a folder via REST API when the folder contained non-downloadable artifacts.
XRAY-76649Improved secret management by storing secrets as environment variables rather than reading them from mounted secret files. This change improves security and compliance.
XRAY-85322A notification was not sent for the Notify deployer policy action for existing scans.
XRAY-82897In the report REST API, when the impacted_artifact parameter contained special characters or space the API returned “Request payload is invalid as an impacted artifact is invalid"
XRAY-81898The Export Details V2 REST API retrieved data only for the latest build version that was scanned.
XRAY-91759Xray installation on Debian 11 failed because the libllvm13 package was introduced as a new dependency for installing the bundled PostgreSQL package on Debian 11.
XRAY-87616Xray could not scan artifacts from build info if the build was published using REST API without including the same values for the build.timestamp and body request started parameter.
XRAY-80970In the Scans List, the violation details right pane displayed two different severities for the violation.
XRAY-39533When using include or exclude patterns in build resources for a Watch and selecting the Apply on Existing Content option, the Watch violations on the applied builds were consistently generated.
XRAY-81898The Export Details v2 REST API generated details only for the latest build version that was scanned.
XRAY-80178Scans of composer artifacts failed due to a corrupted package.
XRAY-84554JFrog Advanced scan failed when scanning a repository that contains over 65K artifacts.
XRAY-85577In some cases, a repository scan status was stuck at 99%.
XRAY-75943When creating an Ignore Rule via UI, and a Path filter was set, the rule wasn’t created.
XRAY-82730A warning message "No connection to Access" in Xray Monitoring was falsely displayed.
XRAY-75864Contextual Analysis results discrepancy between the JFrog Platform and the REST API.
XRAY-72663A user with Xray permissions could not add a Webhook notification.

3.107.15

Released: December 1, 2024

JiraDescription
XRAY-92962The results in Violations & License Reports were partial.

3.107.18

Released: December 15, 2024

Highlights

Xray

JFrog Self-Hosted customers will see an information message under the scans list prompting an upgrade to DBSync v3. We strongly encourage users to migrate to DBSync v3 promptly to ensure seamless and timely updates. For details, see Migration Guide for Self-Hosted Customers: Upgrading from DBSync V1 to V3.

Resolved Issues

JiraDescription
XRAY-87325Removed socat as a dependency from Xray. As a result, socat will no longer be packaged or shipped with Xray deployments.

3.107.21

Released: January 2, 2025

Jira

Description

XRAY-96635

XRAY-97117

Resolved inefficiency in UI status checks within the DBsync migration wizard.

3.107.23

Released: January 19, 2025

📘

Note

All users on Xray versions 3.107.7, 3.107.15, 3.107.18, 3.107.18, 3.107.21 and using the Xray block download policy, should upgrade to Xray version 3.107.23 to maintain optimal performance in Artifactory and Xray.

JiraDescription
XRAY-98492Improved performance of the block download functionality linked to JFrog Xray Policies.

3.107.30

Released: March 6, 2025

Jira

Description

XRAY-102173

An issue in scanning 7zip files prevented opening files using the ARM64 LZMA2:18 BCJ SPARC method.

When a 7zip compression file couldn’t be opened, Xray continued to process the next file.

3.107.32

Released: March 26, 2025

JiraDescription
XRAY-107813Resolved an issue affecting exposure policy triggers for rescanned artifacts.
XRAY-106871Resolved a jf scan command issue.

3.107.35

Released: April 20, 2025

JiraDescription
XRAY-105498Fixed Errors in CycloneDX export of CycloneDX Ingest
XRAY-108976Imported SBOM scans failed to recognize certain licenses
XRAY-99663Some components were missing from the SBOM table when performing the SBOM import.
XRAY-90668Added support for auditing Swift (SPM) projects through JFrog CLI.

3.107.36

Released: May 15, 2025

JiraDescription
XRAY-116332Ghost artifact cleanup migration was pushing messages to the new content lane of the persist queue, causing delays in processing new scans.

Xray 3.104

3.104.17

Released: October 6, 2024

JiraDescription
XRAY-85577In some cases, a repository scan status was stuck at 99%.

3.104.19

Released: November 20, 2024

JiraDescription
XRAY-91759Xray installation on Debian 11 failed because the libllvm13 package was introduced as a new dependency for installing the bundled PostgreSQL package on Debian 11.

3.104.18

Released: October 15, 2024

JiraDescription
XRAY-87616Xray could not scan artifacts from build info if the build was published using REST API without including the same values for the build.timestamp and body request started parameter.

Updated 5 days ago