Supported Technologies
Public repositories supported by Curation and curation-audit cli support.
| Public repository name | Public repository URLs supported (configure in Artifactory remote repository) | Minimal Artifactory Version | Minimal Curation Version (aka Xray Version) | Minimal JFrog cli version (for curation-audit) | Catalog Support (UI & API) | Compliant Version Selection |
|---|---|---|---|---|---|---|
| npm Registry | https://registry.npmjs.org | 7.63.5 (Both Curation service & curation-audit cli) | 3.78.x (Both Curation service & curation-audit cli) | 2.38.3 (npm) 2.108.0 (yarn v2 & v3 , pnpm) 2.112.0 (yarn v4) | Yes | Yes (enabled by default) |
| Docker Hub | https://registry-1.docker.io | 7.63.5 (Curation service only) | 3.82.10 (Curation service only) | 2.89.0 | API only | No |
| Docker Hardened Images (DHI) | https://dhi.io | 7.63.5 (Curation service only) | 3.150.0 (Curation service only) | 2.89.0 | Yes | No |
| Maven | https://repo1.maven.org/maven2 https://repo.maven.apache.org/maven2 https://repo1.maven.org https://repo.maven.apache.org https://maven.google.com https://dl.google.com/android/maven2 https://dl.google.com/dl/android/maven2 https://repository.jboss.org/maven2 https://repo.jenkins-ci.org/releases https://plugins.gradle.org/m2 https://maven.artifacts.atlassian.com | 7.63.5 (Curation service only) 7.82.2 (including curation-audit cli) | 3.78.x (Curation service only) 3.92.7 (including curation-audit cli) | 2.53.1 | Yes | Yes |
| Maven/Gradle (GridGain) | https://maven.gridgain.com/nexus/content/repositories/external | 7.63.5 | 3.134.0 | N/A | Yes | Yes |
| Maven/Gradle (Red Hat) | https://maven.repository.redhat.com/ga | 7.63.5 | 3.141.0 | N/A | Yes | Yes |
| Maven/ChainGuard | https://libraries.cgr.dev/java | 7.63.5 | 3.145.x | N/A | UI only | Yes |
| The Python Package Index (PyPI) | https://files.pythonhosted.org/ | 7.63.5 (Curation service only) 7.82.2 (Curation service only) | 3.78.x (Curation service only) 3.92.7 (Curation service only) | 2.62.0 (pip support) 2.112.0 (Poetry support) 2.118.0 (pipenv support) 2.119.0 (uv) | Yes | Yes |
| Go Packages | https://proxy.golang.org/ https://gocenter.io | 7.63.5 (Curation service only) | 3.92.7 (Curation service only) | 2.58.1 | Yes | Yes |
| Nuget Gallery | https://www.nuget.org/ https://api.nuget.org | 7.80 (Curation service only) | 3.92.7 (Curation service only) | 2.68.0 | Yes | Yes |
| Conan Central Repository | http://center.conan.io/ | 7.63.5 (Curation service only) | 3.95.x (Curation service only) | Coming soon | Yes | No |
| Hugging Face | https://huggingface.co/ | 7.77.3 (Curation service only) | 3.95.x (Curation service only) | 2.118.0 | Yes | No |
| RubyGems | https://rubygems.org/ | 7.63.5 | 3.98.0 | N/A | Yes | Yes |
| Gradle | https://repo1.maven.org/maven2 https://repo.maven.apache.org/maven2 https://repo1.maven.org https://repo.maven.apache.org https://maven.google.com https://dl.google.com/android/maven2 https://dl.google.com/dl/android/maven2 https://repository.jboss.org/maven2 https://repo.jenkins-ci.org/releases https://plugins.gradle.org/m2 https://maven.artifacts.atlassian.com | 7.63.5 | 3.101.0 | 2.77.0 | Yes (part of Maven) | Yes |
| Cargo (Rust) | https://index.crates.io https://static.crates.io | 7.63.5 | 3.118 | N/A Support native messaging | Yes | Yes |
| Conda | https://repo.anaconda.com/pkgs/main https://conda.anaconda.org/conda-forge | 7.117 | 3.125.2 | N/A | Yes | Partial |
| VS Code | https://open-vsx.org/vscode/gallery https://open-vsx.org/vscode/asset | 7.125.6 | 3.131.15 | N/A | Yes | Yes |
| PHP Composer | https://github.comhttps://bitbucket.org | 7.131 | 3.137 | N/A | Yes | Yes |
| R CRAN | https://cran.r-project.org | Artifactory ≥ 7.131 | Xray ≥ 3.137 Catalog UI ≥ 1.26 | N/A | Yes | No |
| Dart Pub | https://pub.dev | Artifactory ≥ 7.131 | Xray ≥ 3.137 Catalog UI ≥ 1.26 | N/A | Yes | No |
| NVIDIA NIM | https://api.ngc.nvidia.com | 7.149.1 | 3.143.5 | N/A | Yes | No |
| SBT | https://repo1.maven.org/maven2 https://repo.maven.apache.org/maven2 https://repo1.maven.org https://repo.maven.apache.org https://dl.google.com/android/maven2 https://dl.google.com/dl/android/maven2 https://repository.jboss.org/maven2 https://repo.jenkins-ci.org/releases https://plugins.gradle.org/m2 https://maven.artifacts.atlassian.com | 7.160.0 | 3.150.0 | N/A | Yes (part of Maven) | Yes |
To support Curation for remote Gradle plugins, you must use a virtual repository configured in a specific order:
- Maven Central remote repository, first repo.
- Gradle repository, under Maven
This order is mandatory because the Gradle client automatically redirects to Maven Central for binaries.
- For Cargo (Rust): Catalog UI support is available starting from Self-Hosted Catalog 1.16.
- For R CRAN and Dart Pub: Catalog UI support is available starting from Self-Hosted Catalog 1.26.
- For Maven/ChainGuard: Repositories configured with a ChainGuard hardened library URL are automatically identified as the Maven/ChainGuard sub-ecosystem. Scans use the ChainGuard vulnerability database instead of standard Maven Central data.
- For Docker Hardened Images (DHI): Remote repositories configured with https://dhi.io are automatically identified as DHI sources. Curation applies security, license, and operational policies supported for the DHI package type.
- For Compliant Version Selection: Values reflect package-type support. Partial (Conda) currently covers Immaturity policies only. Alpine CVS evaluates Malicious and Immaturity policies. For minimum versions, notes, and behavior by package manager, see Compliant Version Selection.
Operating System Package Ecosystems
| Public repository name | Public repository URLs supported (configure in Artifactory remote repository) | Minimal Artifactory Version | Minimal Curation Version (aka Xray Version) | Minimal JFrog CLI version (for curation-audit) | Catalog Support (UI & API) |
|---|---|---|---|---|---|
| Alpine Linux packages | http://dl-cdn.alpinelinux.org/ | 7.131 | Xray ≥ 3.136 Catalog UI ≥ 1.28 | N/A | Yes |
| Debian packages | https://deb.debian.org/debian https://security.debian.org/debian-security | 7.131 | Xray ≥ 3.137 Catalog UI ≥ 1.28 | N/A | Yes |
| Debian Archive | https://archive.debian.org/debian | 7.131 | Xray ≥ 3.137 | N/A | Yes |
| Ubuntu packages (deb) | http://archive.ubuntu.com/ubuntu http://security.ubuntu.com/ubuntu | 7.131 | Xray ≥ 3.137 Catalog UI ≥ 1.28 | N/A | Yes |
| Ubuntu Old-releases | https://old-releases.ubuntu.com/ubuntu http://old-releases.ubuntu.com/ubuntu | 7.131 | Xray ≥ 3.137 | N/A | Yes |
| Ubuntu Ports | https://ports.ubuntu.com/ubuntu-ports http://ports.ubuntu.com/ubuntu-ports | 7.131 | Xray ≥ 3.137 | N/A | Yes |
| NodeSource | https://deb.nodesource.com http://deb.nodesource.com | 7.131 | Xray ≥ 3.141 | N/A | Yes |
| PostgreSQL APT Repository | https://apt.postgresql.org/pub/repos/apt/pool http://apt.postgresql.org/pub/repos/apt/pool | 7.131 | Xray ≥ 3.141 | N/A | Yes |
Updated 5 days ago
Did this page help you?