---
updatedAt: 2026-10-06T09:24:03.000Z
agentTools:
  siteIndex: https://docs.jfrog.com/llms.txt
  projectIndex: https://docs.jfrog.com/security/llms.txt
---

# Compliant Version Selection

When a developer requests a package version that is blocked by a curation policy, Compliant Version Selection (CVS) automatically identifies and returns the highest available version that passes all active policies. Instead of failing the request, Curation seamlessly resolves to a compliant alternative — keeping builds running and minimizing developer disruption.

CVS operates at the dependency resolution stage, evaluating both direct and transitive dependencies against all applicable curation policies in real time. It integrates with the JFrog Catalog to assess version metadata, ensuring that only vetted and policy-compliant versions are delivered to developers.

### How It Works

When a requested package version fails a curation policy (for example, **block immature** or **missing in Catalog**):

1. Artifactory retrieves all versions that satisfy the dependency range.
2. Curation evaluates each version against all active policies for the repository.
3. The highest version that passes all policies is returned to Artifactory.
4. The developer receives the compliant version transparently — no manual action required.
5. The Curation audit log records the original request and the compliant version that was delivered.

If the originally requested version is later updated in the Catalog and passes policy, subsequent requests for it will succeed normally.

### Capabilities

**Capabilities include:**

* **Automatic  Compliant Version Selection** – Returns the highest compliant version when a requested version is blocked, covering both direct and transitive dependencies.
* **Policy Evaluation** – Evaluates all active curation policies (security, license, operational) for the repository when selecting a compliant version.
* **Seamless Developer Experience** – Developers are not notified when a different version is delivered. Builds succeed transparently without interruption.

### **Supported Package Types**

<Table align={[null,null,"left","left","left"]}>
  <thead>
    <tr>
      <th>
        Package Type
      </th>

      <th>
        Support Level
      </th>

      <th>
        Minimal Artifactory Version
      </th>

      <th>
        Minimal Curation Version (Xray Version)
      </th>

      <th>
        Notes
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        npm
      </td>

      <td>
        Full Support
      </td>

      <td>
        7.124.0
      </td>

      <td>
        3.131.4
      </td>

      <td>
        Enabled by default to safeguard from malicious metadata attacks.
      </td>
    </tr>

    <tr>
      <td>
        PyPI
      </td>

      <td>
        Full Support
      </td>

      <td>
        7.124.0
      </td>

      <td>
        3.131.4
      </td>

      <td>

      </td>
    </tr>

    <tr>
      <td>
        Maven
      </td>

      <td>
        Full Support
      </td>

      <td>
        7.124.0
      </td>

      <td>
        3.131.4
      </td>

      <td>

      </td>
    </tr>

    <tr>
      <td>
        Go
      </td>

      <td>
        Full Support
      </td>

      <td>
        7.141.1
      </td>

      <td>
        3.141.14
      </td>

      <td>
        CVS is not supported for Go packages that have only [pseudo-versions](https://go.dev/ref/mod#pseudo-versions) in their version list.
      </td>
    </tr>

    <tr>
      <td>
        NuGet
      </td>

      <td>
        Full Support
      </td>

      <td>
        7.143.2
      </td>

      <td>
        3.142.3
      </td>

      <td>
        Only NuGet v3 repositories are supported. NuGet v2 repositories are not supported.
      </td>
    </tr>

    <tr>
      <td>
        Gems
      </td>

      <td>
        Full Support
      </td>

      <td>
        7.143.2
      </td>

      <td>
        3.142.3
      </td>

      <td>

      </td>
    </tr>

    <tr>
      <td>
        Conda
      </td>

      <td>
        Partial Support
      </td>

      <td>
        7.144.0
      </td>

      <td>
        3.142.3
      </td>

      <td>
        - Currently supports only the **Immaturity** policy.
        - CVS does not support Conda Shards yet.
      </td>
    </tr>

    <tr>
      <td>
        Composer
      </td>

      <td>
        Full Support
      </td>

      <td>
        7.149.0
      </td>

      <td>
        3.146.3
      </td>

      <td>

      </td>
    </tr>

    <tr>
      <td>
        Gradle
      </td>

      <td>
        Full Support
      </td>

      <td>
        7.155.0
      </td>

      <td>
        3.147.0
      </td>

      <td>

      </td>
    </tr>

    <tr>
      <td>
        VS Code
      </td>

      <td>
        Partial Support
      </td>

      <td>
        7.160.0
      </td>

      <td>
        3.150.0
      </td>

      <td>
        Supports Open VSX Registry.
      </td>
    </tr>

    <tr>
      <td>
        SBT
      </td>

      <td>
        Full Support
      </td>

      <td>
        7.160.0
      </td>

      <td>
        3.150.0
      </td>

      <td>

      </td>
    </tr>

    <tr>
      <td>
        Alpine
      </td>

      <td>
        Full Support
      </td>

      <td>
        7.161.0
      </td>

      <td>
        3.153.0
      </td>

      <td>
        For apk client behavior, Edge, and cache substitution, see [Behavior by Package](https://docs.jfrog.com/security/docs/behavior-by-package#alpine).
      </td>
    </tr>

    <tr>
      <td>
        Cargo
      </td>

      <td>
        Full Support
      </td>

      <td>
        7.165.0
      </td>

      <td>
        3.154.0
      </td>

      <td>
        For Cargo client behavior, see [Behavior by Package](https://docs.jfrog.com/security/docs/behavior-by-package#cargo).
      </td>
    </tr>
  </tbody>
</Table>

### **Key Considerations**

* **npm default behavior** — Compliant Version Selection is enabled by default for npm, even before you explicitly enable it for other package types.
* If a developer requests a specific, locked version that is blocked by policy, the request fails (no fallback is attempted for locked versions).

### Monitor CVS Activity

To review CVS inspections, eliminated versions, and selected alternatives, open **Application** > **Curation** > **Audit Events**, then select **CVS** under **Inspection:**. From a Downloads audit event, you can also open a related CVS result with **Open Detailed View**.

For columns, inspection results, filters, and walkthroughs, see [Curated Packages Audit Events](https://docs.jfrog.com/security/docs/curated-packages-audit-events).

Configure Compliant Version Selection in [Fallback Behavior for Blocked Packages](https://docs.jfrog.com/security/docs/fallback-behavior-for-blocked-packages#enable-compliant-version)