Compliant Version Selection
When a developer requests a package version that is blocked by a curation policy, Compliant Version Selection (CVS) automatically identifies and returns the highest available version that passes all active policies. Instead of failing the request, Curation seamlessly resolves to a compliant alternative — keeping builds running and minimizing developer disruption.
CVS operates at the dependency resolution stage, evaluating both direct and transitive dependencies against all applicable curation policies in real time. It integrates with the JFrog Catalog to assess version metadata, ensuring that only vetted and policy-compliant versions are delivered to developers.
How It Works
When a requested package version fails a curation policy (for example, block immature or missing in Catalog):
- Artifactory retrieves all versions that satisfy the dependency range.
- Curation evaluates each version against all active policies for the repository.
- The highest version that passes all policies is returned to Artifactory.
- The developer receives the compliant version transparently — no manual action required.
- The Curation audit log records the original request and the compliant version that was delivered.
If the originally requested version is later updated in the Catalog and passes policy, subsequent requests for it will succeed normally.
Capabilities
Capabilities include:
- Automatic Compliant Version Selection – Returns the highest compliant version when a requested version is blocked, covering both direct and transitive dependencies.
- Policy Evaluation – Evaluates all active curation policies (security, license, operational) for the repository when selecting a compliant version.
- Seamless Developer Experience – Developers are not notified when a different version is delivered. Builds succeed transparently without interruption.
Supported Package Types
| Package Type | Support Level | Minimal Artifactory Version | Minimal Curation Version (Xray Version) | Notes |
|---|---|---|---|---|
| npm | Full Support | 7.124.0 | 3.131.4 | Enabled by default to safeguard from malicious metadata attacks. |
| PyPI | Full Support | 7.124.0 | 3.131.4 | |
| Maven | Full Support | 7.124.0 | 3.131.4 | |
| Go | Full Support | 7.141.1 | 3.141.14 | CVS is not supported for Go packages that have only pseudo-versions in their version list. |
| NuGet | Full Support | 7.143.2 | 3.142.3 | Only NuGet v3 repositories are supported. NuGet v2 repositories are not supported. |
| Gems | Full Support | 7.143.2 | 3.142.3 | |
| Conda | Partial Support | 7.144.0 | 3.142.3 |
|
| Composer | Full Support | 7.149.0 | 3.146.3 | |
| Gradle | Full Support | 7.155.0 | 3.147.0 | |
| VS Code | Full Support | 7.160.0 | 3.150.0 | |
| SBT | Full Support | 7.160.0 | 3.150.0 | |
| Alpine | Full Support | 7.161.0 | 3.153.0 | For apk client behavior, Edge, and cache substitution, see Behavior by Package. |
| Cargo | Full Support | 7.165.0 | 3.154.0 | For Cargo client behavior, see Behavior by Package. |
Key Considerations
- npm default behavior — Compliant Version Selection is enabled by default for npm, even before you explicitly enable it for other package types.
- If a developer requests a specific, locked version that is blocked by policy, the request fails (no fallback is attempted for locked versions).
Monitor CVS Activity
To review CVS inspections, eliminated versions, and selected alternatives, open Application > Curation > Audit Events, then select CVS under Inspection:. From a Downloads audit event, you can also open a related CVS result with Open Detailed View.
For columns, inspection results, filters, and walkthroughs, see Curated Packages Audit Events.
Configure Compliant Version Selection in Fallback Behavior for Blocked Packages
Updated 5 days ago