Supported Technologies
Public repositories supported by Curation and curation-audit cli support.
| Public repository name | Public repository URLs supported (configure in Artifactory remote repository) | Minimal Artifactory Version | Minimal Curation Version (aka Xray Version) | Minimal JFrog cli version (for curation-audit) | Catalog Support (UI & API) | Compliant Version Selection |
|---|---|---|---|---|---|---|
| npm Registry | https://registry.npmjs.org | 7.63.5 (Both Curation service & curation-audit cli) | 3.78.x (Both Curation service & curation-audit cli) | 2.38.3 (npm) 2.108.0 (yarn v2 & v3 , pnpm) 2.112.0 (yarn v4) | Yes | Yes (enabled by default) |
| Docker Hub | https://registry-1.docker.io | 7.63.5 (Curation service only) | 3.82.10 (Curation service only) | 2.89.0 | API only | No |
| Docker Hardened Images (DHI) | https://dhi.io | 7.63.5 (Curation service only) | 3.150.0 (Curation service only) | 2.89.0 | Yes | No |
| Maven | https://repo1.maven.org/maven2 https://repo.maven.apache.org/maven2 https://repo1.maven.org https://repo.maven.apache.org https://maven.google.com https://dl.google.com/android/maven2 https://dl.google.com/dl/android/maven2 https://repository.jboss.org/maven2 https://repo.jenkins-ci.org/releases https://plugins.gradle.org/m2 https://maven.artifacts.atlassian.com | 7.63.5 (Curation service only) 7.82.2 (including curation-audit cli) | 3.78.x (Curation service only) 3.92.7 (including curation-audit cli) | 2.53.1 | Yes | Yes |
| Maven/Gradle (GridGain) | https://maven.gridgain.com/nexus/content/repositories/external | 7.63.5 | 3.134.0 | N/A | Yes | Yes |
| Maven/Gradle (Red Hat) | https://maven.repository.redhat.com/ga | 7.63.5 | 3.141.0 | N/A | Yes | Yes |
| Maven/ChainGuard | https://libraries.cgr.dev/java | 7.63.5 | 3.145.x | N/A | UI only | Yes |
| The Python Package Index (PyPI) | https://files.pythonhosted.org/ | 7.63.5 (Curation service only) 7.82.2 (Curation service only) | 3.78.x (Curation service only) 3.92.7 (Curation service only) | 2.62.0 (pip support) 2.112.0 (Poetry support) 2.118.0 (pipenv support) | Yes | Yes |
| Go Packages | https://proxy.golang.org/ https://gocenter.io | 7.63.5 (Curation service only) | 3.92.7 (Curation service only) | 2.58.1 | Yes | Yes |
| Nuget Gallery | https://www.nuget.org/ https://api.nuget.org | 7.80 (Curation service only) | 3.92.7 (Curation service only) | 2.68.0 | Yes | Yes |
| Conan Central Repository | http://center.conan.io/ | 7.63.5 (Curation service only) | 3.95.x (Curation service only) | Coming soon | Yes | No |
| Hugging Face | https://huggingface.co/ | 7.77.3 (Curation service only) | 3.95.x (Curation service only) | 2.118.0 | Yes | No |
| RubyGems | https://rubygems.org/ | 7.63.5 | 3.98.0 | N/A | Yes | Yes |
| Gradle | https://repo1.maven.org/maven2 https://repo.maven.apache.org/maven2 https://repo1.maven.org https://repo.maven.apache.org https://maven.google.com https://dl.google.com/android/maven2 https://dl.google.com/dl/android/maven2 https://repository.jboss.org/maven2 https://repo.jenkins-ci.org/releases https://plugins.gradle.org/m2 https://maven.artifacts.atlassian.com | 7.63.5 | 3.101.0 | 2.77.0 | Yes (part of Maven) | Yes |
| Cargo (Rust) | https://index.crates.io https://static.crates.io | 7.63.5 | 3.118 | N/A Support native messaging | Yes | No |
| Conda | https://repo.anaconda.com/pkgs/main https://conda.anaconda.org/conda-forge | 7.117 | 3.125.2 | N/A | Yes | Partial |
| VS Code | https://open-vsx.org/vscode/gallery https://open-vsx.org/vscode/asset | 7.125.6 | 3.131.15 | N/A | Yes | Yes |
| PHP Composer | https://github.comhttps://bitbucket.org | 7.131 | 3.137 | N/A | Yes | Yes |
| R CRAN | https://cran.r-project.org | Artifactory ≥ 7.131 | Xray ≥ 3.137 Catalog UI ≥ 1.26 | N/A | Yes | No |
| Dart Pub | https://pub.dev | Artifactory ≥ 7.131 | Xray ≥ 3.137 Catalog UI ≥ 1.26 | N/A | Yes | No |
| NVIDIA NIM | https://api.ngc.nvidia.com | 7.149.1 | 3.143.5 | N/A | Yes | No |
| SBT | https://repo1.maven.org/maven2 https://repo.maven.apache.org/maven2 https://repo1.maven.org https://repo.maven.apache.org https://dl.google.com/android/maven2 https://dl.google.com/dl/android/maven2 https://repository.jboss.org/maven2 https://repo.jenkins-ci.org/releases https://plugins.gradle.org/m2 https://maven.artifacts.atlassian.com | 7.160.0 | 3.150.0 | N/A | Yes (part of Maven) | Yes |
To support Curation for remote Gradle plugins, you must use a virtual repository configured in a specific order:
- Maven Central remote repository, first repo.
- Gradle repository, under Maven
This order is mandatory because the Gradle client automatically redirects to Maven Central for binaries.
- For Cargo (Rust): Catalog UI support is available starting from Self-Hosted Catalog 1.16.
- For R CRAN and Dart Pub: Catalog UI support is available starting from Self-Hosted Catalog 1.26.
- For Maven/ChainGuard: Repositories configured with a ChainGuard hardened library URL are automatically identified as the Maven/ChainGuard sub-ecosystem. Scans use the ChainGuard vulnerability database instead of standard Maven Central data.
- For Docker Hardened Images (DHI): Remote repositories configured with https://dhi.io are automatically identified as DHI sources. Curation applies security, license, and operational policies supported for the DHI package type.
- For Compliant Version Selection: Values reflect package-type support. Partial (Conda) currently covers Immaturity policies only. For minimum versions, notes, and behavior by package manager, see Compliant Version Selection.
Operating System Package Ecosystems
| Public repository name | Public repository URLs supported (configure in Artifactory remote repository) | Minimal Artifactory Version | Minimal Curation Version (aka Xray Version) | Minimal JFrog CLI version (for curation-audit) | Catalog Support (UI & API) |
|---|---|---|---|---|---|
| Alpine Linux packages | http://dl-cdn.alpinelinux.org/ | 7.131 | Xray ≥ 3.136 Catalog UI ≥ 1.28 | N/A | Yes |
| Debian packages | https://deb.debian.org/debian https://security.debian.org/debian-security | 7.131 | Xray ≥ 3.137 Catalog UI ≥ 1.28 | N/A | Yes |
| Debian Archive | https://archive.debian.org/debian | 7.131 | Xray ≥ 3.137 | N/A | Yes |
| Ubuntu packages (deb) | http://archive.ubuntu.com/ubuntu http://security.ubuntu.com/ubuntu | 7.131 | Xray ≥ 3.137 Catalog UI ≥ 1.28 | N/A | Yes |
| Ubuntu Old-releases | https://old-releases.ubuntu.com/ubuntu http://old-releases.ubuntu.com/ubuntu | 7.131 | Xray ≥ 3.137 | N/A | Yes |
| Ubuntu Ports | https://ports.ubuntu.com/ubuntu-ports http://ports.ubuntu.com/ubuntu-ports | 7.131 | Xray ≥ 3.137 | N/A | Yes |
| NodeSource | https://deb.nodesource.com http://deb.nodesource.com | 7.131 | Xray ≥ 3.141 | N/A | Yes |
| PostgreSQL APT Repository | https://apt.postgresql.org/pub/repos/apt/pool http://apt.postgresql.org/pub/repos/apt/pool | 7.131 | Xray ≥ 3.141 | N/A | Yes |
Updated 3 days ago
Did this page help you?