ARTIFACTORY: npm Legacy Audit API Endpoints Retired

Summary

npm has permanently retired two legacy security audit API endpoints as of July 15, 2026:

POST /-/npm/v1/security/audits
POST /-/npm/v1/security/audits/quick

Both endpoints now return HTTP 410 Gone with the message:

"This endpoint is being retired. Use the bulk advisory endpoint instead. See the following docs for more info: https://api-docs.npmjs.com/#tag/Audit"

The replacement endpoint is /-/npm/v1/security/advisories/bulk, documented at https://api-docs.npmjs.com/#tag/Audit

Background

npm introduced the faster Bulk Advisory endpoint (/-/npm/v1/security/advisories/bulk) as the default for npm CLI v7+ when it launched in 2021. The two legacy endpoints were retained for backward compatibility with third-party clients including pnpm (v10.x and below) and Yarn v1.

npm began intermittent brownouts (periodic 410 responses) in April 2026. By June 2026, nearly all requests were returning 410. Full retirement took effect on July 15, 2026.

Community discussion and context can be found in the GitHub community thread (https://github.com/orgs/community/discussions/192768).

Impact
This change has two distinct areas of impact: Artifactory's smart remote audit logic, and legacy package manager clients that still call the retired endpoints directly.

Artifactory smart remote repositories (Artifactory 7.125.0 and above)

When a client sends an audit request through an Artifactory npm virtual or smart remote repository, Artifactory uses the retired /-/npm/v1/security/audits/quick endpoint internally to determine whether the upstream remote is capable of serving audit results. This check fails with a 410 regardless of which audit endpoint the client itself uses, meaning even clients that correctly call the /bulk endpoint will see audit failures in the following repository configurations:

A virtual repository backed by smart remotes only (no direct remote to the npmjs registry)

 A smart remote pointing to a virtual or remote repository that eventually resolves to the npmjs registry

Package manager clients

Clients that still use the retired endpoints are additionally affected when proxied through Artifactory or when calling the npmjs registry directly:

Client	Version	Affected?	Notes
npm CLI	v8+	No	Uses Bulk Advisory endpoint by default
npm CLI	v7 and below	Yes	Calls legacy audit endpoint
pnpm	v11.0.0+	No	Migrated to Bulk Advisory endpoint in v11
pnpm	v10.x and below	Yes	Hard-codes legacy endpoint
Yarn	v4+ (Berry)	No	Uses Bulk Advisory via yarn npm audit
Yarn	v3 and below	Yes	Calls legacy audit endpoint



Symptoms

Customers affected by this change will observe one or more of the following:

ERR_PNPM_AUDIT_BAD_RESPONSE errors in CI output when running pnpm audit on pnpm v10 or below

 HTTP 410 Gone responses 
from https://registry.npmjs.org/-/npm/v1/security/audits or /-/npm/v1/security/audits/quick

Example error output (pnpm v10 via Artifactory npm remote repository):

ERR_PNPM_AUDIT_BAD_RESPONSE  The audit endpoint
(at https://<instance>.jfrog.io/artifactory/api/npm/<repo>/-/npm/v1/security/audits/quick)
responded with 410: Failed to fetch audit report for repo <repo>. status: 410 cause:
{"error":"This endpoint is being retired. Use the bulk advisory endpoint instead.
See the following docs for more info: https://api-docs.npmjs.com/#tag/Audit"}.
Fallback endpoint (at https://<instance>.jfrog.io/artifactory/api/npm/<repo>/-/npm/v1/security/audits)
responded with 410: Failed to fetch audit report for repo <repo>. status: 410 cause:
{"error":"This endpoint is being retired. Use the bulk advisory endpoint instead.
See the following docs for more info: https://api-docs.npmjs.com/#tag/Audit"}

Note

When routing through Artifactory, the 410 error from npm is wrapped by Artifactory. Customers will see Failed to fetch audit report for repo <repo>. status: 410 instead of the raw npm response.

Resolution and Workarounds

1. For customers using pnpm

Upgrade pnpm to v11.0.0 or later. pnpm v11 migrated its audit implementation to the Bulk Advisory endpoint and is not affected by this retirement.

npm install -g pnpm@latest
# or, using corepack:
corepack use pnpm@latest


If upgrading pnpm is not immediately possible, remove the pnpm audit step from your CI pipeline entirely. There is no flag on the pnpm audit command to skip or suppress the failing endpoint call.

2. For customers using Yarn v1 (Classic)

Yarn v1 ignores whatever registry is configured and hardcodes registry.yarnpkg.com for audit requests, bypassing Artifactory entirely. Customers in environments where outbound access to registry.yarnpkg.com is restricted will see a network error rather than a 410. Options are:

Migrate to Yarn v4 (Berry). Yarn v4 uses yarn npm audit which calls the Bulk Advisory endpoint and is unaffected.

 Remove yarn audit from the CI pipeline.

3. Artifactory smart remote repositories

Workarounds

If you are using a client that already supports the Bulk Advisory endpoint (npm CLI v8+, pnpm v11+, Yarn v4+), you can restore audit functionality by adjusting your repository configuration so that Artifactory can resolve the audit request without relying on the /quick check:

Add a direct remote repository pointing to the npmjs registry (https://registry.npmjs.org) and include it in your virtual repository alongside the smart remote.
Alternatively, wrap your smart remote in a virtual repository and add a direct remote to npmjs within that virtual.

Either approach allows Artifactory to route the audit request through a direct remote, bypassing the failing smart remote audit capability check.

Fix

JFrog is actively rolling out a fix to Artifactory's smart remote audit logic to use the Bulk Advisory endpoint instead of the retired /quick endpoint.

Saas: fix is currently being rolled out and will be available shortly.

Self-hosted: fix will be included in versions 7.133, 7.146, 7.161.