Zero-Touch Remediation Overview

JFrog Zero-Touch Remediation closes the gap between vulnerability detection and remediation. When a developer or CI pipeline requests a vulnerable package from an Artifactory virtual repository covered by a Zero-Touch Remediation automation, Zero-Touch Remediation provides a verified patched version without requiring a manual dependency upgrade.

You govern remediation through scoped automations that define the covered virtual repositories and vendor priority. Fixes can come from connected clearing-house vendors or from local patches: Maven artifacts your organization rebuilt and registered in an Artifactory local repository. The goal is to compress exposure windows from weeks to hours while keeping builds green.

How Zero-Touch Remediation Works

Zero-Touch Remediation supports Maven and npm virtual repositories. The remediation flow differs by package type.

Maven Remediation

Maven remediation occurs during download:

1. A build requests the original Maven coordinate from a covered virtual repository.
2. Artifactory asks Xray whether a patched replacement is available.
3. Xray queries JFrog Catalog for patched candidates from the clearing-house vendors connected to the virtual repository and from local patches registered in local repositories that are members of that virtual repository.
4. The Least Vulnerable strategy selects the candidate with the lowest vulnerability score. If scores are equal, a registered local patch ranks above a vendor rebuild. Remaining ties use the automation's vendor priority.
5. If the selected candidate reduces CVE exposure, Artifactory serves it through the same virtual repository.
6. Xray records the decision in the Zero-Touch audit view.

If no suitable patched version exists, or a candidate would not reduce CVE exposure, Artifactory serves the originally requested artifact.

npm Remediation

npm remediation occurs before installation by rewriting package-lock.json. It does not intercept the tarball download:

1. The project contains a package-lock.json with the original package versions.
2. A JFrog CLI version that supports lockfile healing sends the lockfile and npm virtual repository name to Xray.
3. Xray queries JFrog Catalog for patched candidates allowed by the matching Zero-Touch automation.
4. Xray returns a rewritten lockfile with the patched version, a resolved URL that points to the same Artifactory virtual repository, and integrity data calculated from the artifact in Artifactory.
5. JFrog CLI writes the returned lockfile, and npm installs the patched tarballs from the virtual repository.
6. Xray records the decision in the same Zero-Touch audit view used for Maven.

Lockfile healing evaluates direct and indirect dependencies. The project's package.json continues to declare the original package name and version. Vendor-specific versions and direct vendor registries are not part of this flow. A standard npm install does not invoke lockfile healing.

Supported Fix Vendors

Zero-Touch Remediation selects patched packages from the following clearing-house vendors. Vendor coverage differs by package type.

Because Chainguard provides Maven fixes only, npm automations remediate through Echo, TuxCare, and Seal Security. A vendor participates in remediation only when the covered virtual repository includes that vendor's remote repository.

Local Patches

Organizations that maintain their own Maven backports can register those artifacts as healing candidates. Zero-Touch Remediation serves the local bytes at the original coordinate. That is the same interception path used for vendor rebuilds.

• Registration is a REST API request (POST /xray/api/v1/ztr/patches) plus a CycloneDX 1.6 declaration. There is no create-patch UI.
• Local patches are Maven only. npm lockfile healing does not consume them.
• Serving requires the local repository to remain a member of the covered Maven virtual repository. Registration does not name the virtual repository and does not add a separate enable/disable control.

For the registration contract and validation outcomes, see Register local patches.

Supported Capabilities

The following capabilities are available in Zero-Touch Remediation.

Prerequisites

Before you enable Zero-Touch Remediation:

• Xray and Artifactory on your JFrog Platform.
• A Maven or npm virtual repository that includes the public registry and the remote repositories of the vendors you want to use. For npm, use a vendor that supports npm: Echo, TuxCare, or Seal Security.
• Remote repositories behind the virtual repository indexed in Xray, so scans correctly reflect components after remediation.
• For npm, an existing package-lock.json and a JFrog CLI version that supports npm lockfile healing.
• For local patches, an Xray-indexed Maven local repository that is a member of a covered virtual repository, plus Manage Data permission to register artifacts. See Local Patches.

Frequently Asked Questions

This section provides answers to frequently asked questions.

Related Topics

• Zero-Touch Remediation
• Configure Zero-Touch Remediation Automations
• View Remediation Requests
• Interpreting Remediation in Scan Results