Introduction
Compliance Version Selection (CVS) is a JFrog Curation capability that prevents build failures caused by blocked packages. When a developer requests a package version that violates a curation policy, CVS automatically resolves the request to the highest compliant version instead of rejecting it outright. This keeps builds running while enforcing your organization's security and compliance policies.
This article walks you through enabling CVS within JFrog Curation and configuring it for specific package types.
Pre-requisites for Enabling JFrog Curation:
- Your JFrog Platform subscription includes the Curation entitlement.
- The JFrog Catalog service is installed and operational. This link is for Catalog installation.
- At least one remote repository of the target package type must be connected to Curation. CVS only applies to repositories that are already curated.
Steps to Enable CVS at the Package Level from the UI
- Login as Administrator user and then navigate to Administration Panel => Curation Settings.
- Go to General settings and Toggle the "Enable compliant version selection" button.
- Once CVS is enabled, navigate to Configure Package Types. Enable the package type you wish to opt for the CVS feature using the toggle bar
Note: The curated connection status can fall into three categories:
- Connected → All repositories of this package type are connected and curation-enabled.
- Partially connected → Some repositories are curated while others are not.
- Not Connected → None of the repositories are curated, or there are no repositories of this type present.
Optional: Auto-Connect New Package Types
In the General settings, you can also enable Automatically connect new CVS package types. When this is turned on, any newly supported CVS package type added in future releases will be automatically enabled for CVS without manual intervention.
How CVS Works Under the Hood
- A developer (or build tool) requests a specific package version from a curated remote repository.
- Curation evaluates the request against all active policies scoped to that repository.
- If the requested version is allowed, it is served normally.
- If the requested version is blocked, Curation queries the JFrog Catalog for all available versions of that package.
- Each version is evaluated against the active policies. The highest version that passes all policies is returned as the compliant alternative.
- The client receives the compliant version transparently -- no manual intervention is needed from the developer.