Released: 30 October, 2025
New Features
Support for Sigstore bundle attestations
Artifactory now supports the automatic conversion of OCI Sigstore bundle attestations into JFrog evidence.
New Parent Manifests API
A Parent Manifests API has been added, which allows you to discover all parent manifest lists associated with a specific Docker manifest. For more information, see Find Parent Manifest Lists.
New Platform Auditor User Type
The JFrog Platform now supports a Platform Auditor user role that allows users to view the entire JFrog Platform Web UI but not perform any actions, which can be useful for auditing or compliance monitoring. To use this feature, enable the following feature flag in your system configuration file:
accessPlatformAuditor: true
For more information, see The Platform Auditor.
Support for signed attestations in OCI images
The Evidence Collection service can take signed, 3rd-party attestations uploaded to Artifactory as OCI images and convert them automatically into JFrog evidence. For example, this new feature can successfully convert attestations created using the cosign attest command. For the automatic conversion to work, the attestations must conform to both the DSSE and in-toto standards.
Cleanup - Builds
Artifactory now supports a build cleanup policy to delete unintended builds. For more information, see Cleanup Policies.
New Remote Repository Types for IDE Plugins
Two new remote repository types, AI Editor Extensions and JetBrains Plugins, are now available to proxy IDE plugin marketplaces. The AI Editor Extensions repository supports proxying extension marketplaces for VSCode, Cursor, and Windsurf. This repository type is integrated with JFrog Curation to enable policy-based blocking of unwanted plugins. The JetBrains Plugins repository supports proxying the JetBrains Marketplace for JetBrains IDEs such as IntelliJ IDEA and PyCharm.
With both repository types, you can browse and install extensions and plugins natively within each IDE.
The repositories are available to customers with an Ultimate bundle subscription.
New Remote Repository Type for Bazel Modules
The new Bazel Modules remote repository type supports caching and proxying the Bazel Central Registry (BCR) in Artifactory. This repository type is designed to support module dependency maknagement in accordance with Bazel 9 requirements. Maintaining a secure cache and proxy of the BCR ensures that developers pull only approved and vetted dependencies, enhancing security and streamlining the development process. For more information, see Bazel Modules Repositories.
Update Password Policy Via REST API
The JFrog Platform now supports creating and updating your instance’s password policy via REST API, for easier access for Cloud instances. For more information, see Password Policy.
Artifactory Now Natively Supports the Terraform Provider Registry Protocol
Artifactory now natively supports the HashiCorp Terraform Provider Registry Protocol, acting as a fully compliant Provider Origin Registry for both Terraform and OpenTofu. This enhancement simplifies client configuration, enhances security with GPG verification, and provides smarter protocol-aware proxying. This new method applies to local, virtual, and federated repositories and adds to the
network_mirrorapproach. For more information, see Documentation.
Feature Enhancements
Storage
Support for AWS SDK v2 in S3 Storage
Artifactory's S3 binary storage provider now supports AWS SDK v2. This integration allows you to leverage the latest AWS features and optimizations for a more robust and efficient storage solution, while maintaining full backward compatibility with your existing S3 configurations. AWS SDK v2 receives all active development, new features, and security updates, ensuring your storage integration remains up-to-date. For more information, click here.
Important
Amazon Web Services has decided to make SDK v1 end-of-life at the end of 2025. Therefore, JFrog strongly recommends that all Artifactory customers currently using SDK v1 transition to SDK v2 at this point in time.
Support for Azure Workload Identity
Artifactory now supports authentication with Azure Blob Storage using Azure Workload Identity. This method provides a secure, secret-less authentication mechanism for applications running on Azure Kubernetes Service (AKS). It leverages federated identity credentials, eliminating the need to manage and rotate secrets such as SAS tokens or storage account keys within your Artifactory configuration. For more information, click here.
Data Sharding Improvements
Improvements were made in thread synchronization in sharding and s3-sharding providers.
Daily Cleanup Job Added for Cache FS _pre folder
A daily job is now triggered on startup to cleanup old
dbRecord*.binfiles in the cache provider’s_prefolder. The configurations for this job can be modified in the binarystore.xml file under the cache-fs provider. For more information, see Cached Filesystem Binary Provider.Additional Configuration for GCP Internal Actions
The ability to configure readTimeout was added to Google Cloud Platform (GCP) internal actions.
Project Administration
Support for webhooks for project-related builds
Artifactory now supports the creation of webhooks for builds associated with specific projects. This enables you to receive notifications whenever a build in a particular project is uploaded, promoted, or deleted. To create a build webhook for a specific project, you must be working within the scope of the project (as opposed to All Projects).
For specific guidelines about creating a build webhook for a specific project, see Domain: Build.
Evidence Management
Evidence propagation to Federation members
This release enhances the Evidence service to enable evidence propagation to all Federation members, regardless of whether they contain the relevant public key for verification. Evidence verification, however, is performed only on those members that have the public key. For more information, see Verify Evidence.
Evidence for artifacts in virtual repositories displayed in Artifacts tree
You can now view evidence related to artifacts in a virtual repository in the Artifacts tree. This is particularly useful when attaching evidence to a Docker image created in a tool such as GitHub Actions. In such cases, users typically work with the Docker image as part of a virtual repository in Artifactory. The virtual repository must contain at least one local repository to house the evidence. For more information, see View the Artifact Evidence Table.
Improvements to evidence graph
The design of the Release Bundle evidence graph has been improved to make it easier to distinguish between the various elements (builds, packages, etc.) that comprise the Release Bundle. For more information, see View Release Bundle v2 Evidence.
Federation
Enhanced metadata propagation during RTFS Full Sync operations
The Artifactory Federation Service (RTFS) now supports the propagation of artifact creation time metadata during a Full Sync operation. To enable this feature:
Set the following Artifactory system property to
trueon the target members:artifactory.federated.mirror.events.upload.info.propagate.enabledUse a new REST API to enable the propagation of this specific metadata. For more information, see Propagate Creation Time Metadata during Full Sync.
Updated Artifactory Worker Events
Updated the following Artifactory Worker events:
After Copy: The following fields are removed from the Sample Payload:
contentLength,trustServerChecksums,servletContextUrl,skipJarIndexinganddisableRedirect.After Delete: The following field is removed from the Sample Payload:
headersAfter Property Create: The following fields are removed from the Sample Payload:
contentLength,trustServerChecksums,servletContextUrl,skipJarIndexing,disableRedirectandheaders.After Move: The following fields are removed from the Sample Payload:
contentLength,trustServerChecksums,servletContextUrl,skipJarIndexinganddisableRedirect.Before Move: The following fields are removed from the Sample Payload:
contentLength,trustServerChecksums,servletContextUrl,skipJarIndexinganddisableRedirect.
Before Download Request: The following fields are added in the response:
modifiedRepoPath,expiredandheaders.Before Create: The following fields are removed from the Sample Payload:
contentLength,trustServerChecksums,servletContextUrl,skipJarIndexinganddisableRedirect.Before Copy: The following fields are removed from the Sample Payload:
contentLength,trustServerChecksums,servletContextUrl,skipJarIndexinganddisableRedirect.Before Property Create: The following fields are removed from the Sample Payload:
contentLength,trustServerChecksums,servletContextUrl,skipJarIndexinganddisableRedirect.Before Property Delete: The following fields are removed from the Sample Payload:
contentLength,trustServerChecksums,servletContextUrl,skipJarIndexinganddisableRedirect.After Property Delete: The following fields are removed from the Sample Payload:
contentLength,trustServerChecksums,servletContextUrl,skipJarIndexinganddisableRedirect.Updated the following Worker Events with
repoTypeInput Parameter:Before Property Replication
Before File Replication
Before Statistics Replication
Before Directory Replication
Before Delete Replication
Smart Archiving
Skips Restore of Artifacts with the Same Name and Path
The restore process now skips any artifact that already exists in the target location, preventing accidental overwrites. The existing file will be preserved, and the skipped operation will be noted in the logs and the CSV report.
Supported Archive Packages Search for Project Admins
Project Admins will now see and be able to use the Archive Search feature. The search results are automatically scoped, ensuring they can only view archived packages that belong to the projects they manage.
API Updates
Filtering added to Get All Repository Configurations API
You can now use query parameters to filter the results of the Get All Repository Configurations API. You can filter by package type (for example, docker, maven) and repository type (for example, local or remote).
Change in API response for Release Bundle v2 tags
To correct inconsistent behavior, the following API endpoints have changed the response for Release Bundle v2 tags from
bundle_tagandrelease_bundle_tagto a standard response oftag:Improved Get Federation Sync State REST API performance
The performance of the REST API that returns the synchronization state of all Federated repositories in the JPD has been improved.
Note
This API endpoint is relevant for users operating the legacy Federation service, not the Artifactory Federation Service (RTFS).
Package Management and Repositories
Virtual Repositories for Hugging Face Packages
Virtual repositories can now be created for Hugging Face packages.
Local and remote Hugging Face repositories that are associated with a virtual Hugging Face repository must have the Machine Learning Repository Structure.
Hugging Face datasets and models can be resolved from a virtual Hugging Face repository only with the snapshot_download API and not by using libraries.
For more information, see Create a Hugging Face Repository and Resolve Hugging Face Packages.
RPM Package Settings
Added support for Administrators to enable/disable RPM package settings for the following:
Recommends Tags
SHA256
For enabling/disabling these settings, see Enable/Disable RPM Package Settings.
Improvement to the Vendor Folder for the Private Go Registry and the Go Proxy
Checksums in the private Go registry and the Go proxy are now aligned for the Go version 1.24 vendor folder.
NuGet Package Updates
Curation Support for NuGet Virtual Repositories
Extended JFrog Curation capabilities to support NuGet virtual repositories, providing a powerful, centralized way to secure your NuGet package consumption.
NuGet Package - Now Supports .NET CLI
NuGet packages now include support for the .NET CLI.
Optimized NuGet Version
Tightened validation to require all NuGet packages to use strict Semantic Versioning (SemVer 2.0). See specification.
Nuget Packages - Rate Limit
Introduced a new rate-limiting mechanism for search APIs to prevent excessive calls and ensure service stability.
Upgraded Gradle Set Me Up Wizard
The Gradle Set Me Up wizard has been upgraded to support Gradle 9.
Improvement in VCS Remote Repositories
The GitHub Server option for Git providers was added for VCS remote repositories. For more information, see Create a VCS Repository.
Added Enforcement of Custom Configurations for Certain Remote Docker Repositories
When creating a remote Docker repository for an Azure Container Registry (*.azurecr.io) or a Microsoft Container Registry (https://mcr.microsoft.com/), Artifactory makes the following default configuration:
Disable URL Normalization = true
When creating a remote Docker repository for a Chainguard Registry (http://cgr.dev/chainguard), Artifactory makes the following default configuration:
Block Mismatching Mime Types = true
These default configurations are set upon remote repository creation and can be canceled afterwards. For more information, see Other Advanced Settings for Remote Repositories.
Improved npm Search
It is now possible to search for up to three search terms in npm local repositories when using the "npm search" command.
Enhanced Support for npm Audit
In addition to npm virtual repositories, npm Audit is now also enabled by default on npm remote repositories that support npm Audit directly. For more information, see Use npm Audit.
Improved Resolving of Subgroups When Accessing Subgroups in Gitlab with Go Remote Repositories
When accessing subgroups in GitLab with Go remote repositories (by selecting the Resolve Subgroups checkbox, as explained here), Artifactory now resolves the correct dependency version even if the URL contents contain both subgroups and submodules.
New Setting Added to Complete a List Manifest Image Overwrite
A new setting has been added under Package Settings called Complete list manifest image overwrite. When this setting is enabled, overwriting a list manifest image will asynchronously overwrite all of its sub-manifests.
Release Lifecycle Management
Expanded support for distributing and exporting Release Bundle v2 versions
To make distributing and exporting Release Bundle v2 versions easier, you can now use JFrog Distribution with Release Bundle v2 versions signed with the default key in Artifactory. To support this change, the default key type has been changed from RSA to GPG, and the name of the default key has been changed to default-lifecycle-key. For more information, see Create Signing Keys for Release Bundles (v2).
Improved visibility for nested Release Bundles
The Release Bundle v2 content graph now provides a clear, visual representation of nested Release Bundles. Seeing the complete hierarchy enables you to understand how the Release Bundle is constructed, even when it contains other Release Bundles. For more information, see View Release Bundle v2 Evidence.
Improved aggregated Release Bundle creation
Artifactory has improved its handling of aggregated Release Bundles (meaning, a Release Bundle v2 version that is comprised of other Release Bundle versions). If the Release Bundle version you are trying to create contains multiple Release Bundles with the same artifact but different metadata (evidence or properties), Artifactory will create the version successfully using the newer version of the artifact.
Change of status code when creating Release Bundle v2 from build with missing artifact
To improve reporting accuracy, errors caused by missing artifacts during Release Bundle v2 creation will be returned as a 422 error (SC_UNPROCESSABLE_ENTITY) rather than a different status code that triggered unnecessary monitoring alerts. The 422 status code represents the event more accurately as it is the expected behavior when an artifact cannot be found.
Performance Improvement in Release Bundle v2 Promotion Flow
The performance of the promotion flow for Release Bundle v2 versions has been improved.
Source environment included in Release Bundle v2 promotion GET API results
The Get Release Bundle v2 Promotions and Get Release Bundle v2 Version Promotions REST APIs now include the source environment in their responses. This enables you to see at a glance the name of the environment from which the Release Bundle version was promoted.
Redesigned presentation of Release Bundle v2 contents
The Content tab for Release Bundle v2 versions has been redesigned to show each package and standalone artifact included in the version (known as "releasables") and their source (for example, a build or a different Release Bundle). For more information, see View the Contents of a Release Bundle v2 Version.
Release Bundle v2 versions now associated with stages and lifecycles
This version replaces environments with the concept of stages and lifecycles, to provide users with more flexibility and control over their SDLC. Administrators can create global and project stages as needed and assign them to different SDLC categories, such as Code and Promote. The administrator then adds selected stages to the lifecycle to represent the progression of release candidates through your SDLC. For more information, see Stages & Lifecycle.
Support for webhooks for project-related Release Bundles
Artifactory now supports the creation of webhooks for Release Bundle v2 versions associated with specific projects. This enables you to receive notifications whenever a Release Bundle in a particular project is uploaded, promoted, or deleted. To create a Release Bundle webhook for a specific project, you must be working within the scope of the project (as opposed to All Projects).
For guidelines about creating a Release Bundle v2 webhook for a specific project, see Domain: Release Bundle v2.
Created-by information provided for Sigstore evidence
To improve understanding and traceability, the API response when creating and deploying Sigstore evidence now includes the username associated with the JFrog token instead of ‘internal’.
More accurate error messages during Release Bundle promotion
To improve user understanding, validation errors during the Release Bundle v2 promotion process will now return a BAD REQUEST error message (HTTP 400) rather than a generic HTTP 500 error.
Release Bundle v2 auto-creation feature removed
The Release Bundle v2 auto-creation feature, which was introduced to help customers transition from build promotion to the expanded feature set offered by Release Lifecycle Management, has been removed from the platform UI after having served its purpose.
Viewing Release Bundles distributed to Edge nodes
To align the platform UI with the REST API, only admin users are permitted to view distributed Release Bundle versions (v1 and v2) in the Received tab on Edge nodes. For more information, see View Release Bundles on Edge Nodes.
Cleanup and Retention Policies
Adding days/weeks selection for Time-based Policy Condition - Cleanup Release Bundle V2
Enhanced RB V2 cleanup functionality with the addition of days/weeks selection for policy condition. You can now configure cleanup conditions, specifying days/weeks for the RB V2. For more information, see Create Cleanup Policy - Release Bundle V2.
Retention Policies - Cleanup & Smart Archiving
The Stop All Runs action is now restricted to Platform Admins only. Project Admins no longer have access to this action.
Run Cleanup policies and Garbage Collection (GC) Simultaneously
Enabled cleanup policies to run more reliably by making them health-aware. Jobs will now run concurrently with other tasks only if the system is
HEALTHYand will automatically stop if load increases, ensuring system stability.This can be toggled by the system property:
artifactory.retention.system.health.aware.job.enabled
Artifact Management
Improved Artifact Lifecycle Management
Artifactory now updates the creation timestamp of an artifact when it is copied or moved to a new repository to the current date and time of the operation. Previously, the original creation timestamp was retained when moving or copying an artifact to another repository, which led to incorrect assumptions about the artifact's age and relevance in the new location. The "last modified" timestamp remains unchanged to preserve the integrity of the artifact's last update. This enhancement helps in the effective adoption of cleanup policies and aligns with industry standards. To ensure backward compatibility, this feature is implemented behind a feature flag and is disabled by default.
New Metadata Properties Added to the manifest.json
Metadata properties for the operating system and the operating system architecture will now be added to the manifest.json after pushing or caching a new image. These new properties are set in docker.os and docker.architecture, respectively.
Prevent accidental removal of referenced sub-architectures in multi-arch images
Starting from this Artifactory version, when deleting a multi-architecture image, any sub-architecture variant that is still referenced by another image will be preserved.
Context retention in Artifacts browser
When you copy or move artifacts in the Artifacts browser, the UI no longer moves automatically to the destination path of the operation but remains in its original context. To move to the destination path after the copy or move operation is complete, click the Go to path link in the confirmation message.
UI Support for Debian Source Package Search
Added support for Debian Source package search.
Caching
Improved Change Artifacts count UI widget caching mechanism
Improvements were made to the Change Artifacts count UI widget caching mechanism.
Daily Cleanup Job Added for Cache FS _pre folder
A daily job is now triggered on startup to cleanup old
dbRecord*.binfiles in the cache provider’s_prefolder. The configurations for this job can be modified in the binarystore.xml file under the cache-fs provider.
Platform UI
Redesigned platform UI for Release Lifecycle Management
The platform UI for Release Lifecycle Management has been redesigned to provide a clearer, more consolidated view of your Release Bundles. The new design centralizes all critical information for each Release Bundle version, including its timeline, contents, security scans, evidence, and properties, in an accessible and intuitive interface. For more information, see Release Lifecycle Management.
Improved visibility of OCI/Docker multi-arch images in the platform UI
To reduce visual clutter and improve comprehension, Artifactory now makes it easier to manage OCI/Docker multi-arch images in the platform UI. For example, if you have a multi-arch image called my-image:1.0.0 that supports amd64 and arm64 architectures, Artifactory contains 3 distinct package versions, one for the manifest list and one for each architecture:
my-image:1.0.0
my-image:sha256__f2ca1bb6c7....
my-image:sha256__1a8a5828e8....
Artifactory now displays the version for the manifest list only in the platform UI and suppresses the individual architecture versions (named according to their image tags). This enables you to focus on the multi-arch image as a single entity. Please note that all package versions will be returned when listing the content via the REST APIs.
Platform UI support for displaying larger evidence files
The platform UI can now display evidence files up to a maximum size of 3000 lines (compared to 1500 lines in previous versions). Larger evidence files can be downloaded with a single click. For more information, see View Evidence.
Support for Easy Copying of Administration Values
The JFrog Platform WebUI now supports a Copy button, allowing you to copy values in the Administration module pages with a single click.
The following values will now be easily copiable:
Token ID under Access Tokens
Name under Projects, Users, Groups, Permissions, Project Members, Webhooks, and Manage Integrations
Auth URL under OAuthSSO
URL under Webhooks
Group Name under Crowd/ Jira
Provider URL under Manage Integrations
Project Key under Projects
Platform Configuration
Support for Updating the Access Bootstrap YAML File
The JFrog Platform now supports making changes to the access.security.bootstrap.yml file without creating a new configuration or modifying the existing Artifactory YAML file. For more information, see Access Bootstrap YAML File.
Improved Configuration Descriptor Validation
Configuration descriptor validation was improved to increase system stability.
Traefik Version Upgrade
The Traefik version embedded in the Router microservice was upgraded from v2 to v3. This should not impact operation. Though if you your deployment depends on specific functionality, review their upgrade notes
Resolved Issues
JIRA Issue | Component | Severity | Description |
|---|---|---|---|
RTDEV-58782 | Archiving/Cold Storage | Medium | Fixed an issue whereby a project admin could not successfully call the Get all Package Cleanup Policies API and received a 403 error. |
RTDEV-58791 | Archiving/Cold Storage | High | Fixed an issue with failed upgrades from Artifactory versions earlier than 7.97 to version 7.97 or later when using a non-enterprise MSSQL license. |
RTDEV-61500 | Archiving/Cold Storage | Medium | Fixed an issue whereby a cleanup policy would stop running when encountering certain directories. |
RTDEV-61647 | Archiving/Cold Storage | Medium | Fixed an issue whereby inconsistent naming and compression format for artifactory-cleanup-audit logs caused sync failures and misclassification of logs. |
RTDEV-61687 | Archiving/Cold Storage | Low | Fixed an issue whereby the Next Run section for Retention Policies (both Cleanup and Archive) sometimes did not update correctly. |
JA-17727 | Authentication Providers | Low | Fixed an issue where authentication attempts with invalid tokens caused temporary login suspension. Only basic credentials authentication attempts should count toward login suspension. |
JA-17902 | Authentication Providers | Medium | Fixed an issue whereby a SCIM PATCH request succeeded despite containing an invalid operation. |
RTDEV-58433 | Builds | Medium | Fixed an issue whereby artifacts with different names but the same checksums showed the wrong repository path in the build browser. |
RTDEV-62157 | Federated Repositories | High | Fixed an issue that caused the Federation to fail if a proxy was defined at the platform level but the Federated repository was set to |
RTFE-3634 | Federated Repositories | Low | Fixed an issue whereby when converting a local repository to a federated repository, a warning message appeared that “This operation cannot be undone” even though the federated repository can be reverted back to a local repository. |
EVT-1706 | General | Medium | Fixed an issue whereby a webhook would fail if any of the repositories it was configured to listen to were deleted from the system. |
JA-17841 | General | Medium | Fixed an issue whereby include/exclude patterns in the Per Repository tab incorrectly displayed the default value ‘**’ when navigating between the All Repositories and Per Repository tabs in the Permission Target UI. |
JA-17899 | General | Medium | Fixed an issue whereby Access was throwing errors during startup. |
JFUI-18900 | General | Medium | Fixed an issue whereby a custom message enabled in the UI would cause the "The Federated repository settings are not synchronized between these repositories" notification to negatively impact the user experience by expanding and blocking other elements. |
JFUI-18972 | General | Medium | Fixed an issue where setting up log rotation for frontend metrics logs in Artifactory's system.yaml file didn't work, as the logs did not rotate after a service restart. |
JFUI-18973 | General | Medium | Fixed an issue whereby the Show offline node checkbox under Administration > Monitoring > Service Status was not working and preventing users from viewing offline nodes in an HA cluster. |
RTDEV-55886 | General | Medium | Fixed an issue whereby when sending a request to ui/api/v1/ui/artifactactions/view with an empty path, the API returned a 500 error and this led to the disclosure of Java exceptions that described some of the application internals. |
RTDEV-57769 | General | Medium | Fixed an issue whereby flat copy returned a 409 status code for almost any error. |
RTDEV-59666 | General | Low | Fixed an issue whereby when setting up Apache as a reverse proxy for Artifactory, the default configuration that was generated from the Artifactory UI did not forward the original user IP address. |
RTDEV-60768 | General | Medium | Fixed an issue whereby when configuring Artifactory to work with a MySQL database, an unnecessary warning message was received indicating that “No NativeDbLocksService implementation bean exists for DB type". |
RTDEV-61179 | General | Medium | Fixed an issue whereby Support Bundle status in the UI was reported as FAILURE despite successful Support Bundle generation. |
RTDEV-62074 | General | Medium | Fixed an issue where redundant errors were logged. |
RTDEV-62472 | General | High | Fixed an issue where a policy for cleaning up unused cached artifacts failed to cleanup any files. |
RTDEV-62683 | General | Medium | Fixed an issue whereby it was not possible to display HTML contents of a zip file if the zip file name contained the German umlaut character (for example, ä). |
RTDEV-62928 | General | Medium | Fixed an issue whereby Artifactory would fail to start with a partial GPG key configuration. |
RTDEV-63693 | General | Low | Fixed an issue whereby inconsistent token validation behavior was observed when calling the system/version API with anonymous access enabled. |
RTDEV-63869 | General | Medium | Fixed an issue whereby a virtual RPM repository was unable to merge metadata when it contained an upstream remote RPM repository with Zstandard compression index files and a local repository containing RPM packages. |
General | Medium | Fixed an issue whereby when Artifactory attempted to authenticate a remote Sonatype Nexus repository using Basic Authentication, the request failed with a 401 Unauthorized error if the username contained non-ASCII characters. | |
INST-11808 | Installation | Medium | Fixed an issue where setting a custom |
RTDEV-56935 | Packages | Medium | Fixed an issue whereby after saving an NIM remote repository configuration, the test connection failed. |
RTDEV-58806 | Packages | Medium | Fixed an issue whereby the removal of a child repository from an RPM virtual repository did not trigger metadata calculation. |
RTDEV-59071 | Packages | Medium | Fixed an issue where an external user could obtain an API key instead of an Identity Token in the Maven Set Me Up tool. |
RTDEV-60193 | Packages | Critical | Fixed an issue whereby the Go module download process encountered a failure when the MCRP limit was reached, which resulted in an unsuccessful request to the remote resource, and attempts to serve from the cache also failed. |
RTDEV-60343 | Packages | Medium | Fixed an issue whereby Conan federation did not sync all package properties. |
RTDEV-60689 | Packages | Medium | Fixed an issue where Artifactory was not honoring include/exclude patterns on a Go remote GitHub repository for .info artifacts. |
RTDEV-61861 | Packages | Critical | Fixed an issue whereby cleanup policies were incorrectly deleting Helm packages with the same prefix name. |
RTDEV-62449 | Packages | Medium | Fixed an issue whereby passing the X-JFrog-Override-Base-URL header during the npm install process from a virtual repository was not always respected. |
RTDEV-62985 | Packages | Medium | Fixed an issue whereby when deploying a .pom file for Maven or Gradle repository types that start with an empty line or used UTF-8 non-breaking spaces in an XML structure, a 409 error was encountered. |
RTDEV-64039 | Packages | Low | Fixed an issue whereby an incorrect icon for Docker images was displayed in Docker virtual repositories. |
RTFE-3459 | Packages | Medium | Fixed an issue whereby the setting Enable Token Authentication was always checked (set TRUE) for a Helm OCI remote repository and a Docker remote repository, even if the actual value for this setting was false. |
RTFE-3636 | Packages | Medium | Fixed an issue whereby the Set Me Up repositories list was not showing an empty virtual Maven repository. |
Packages | Medium | Fixed an issue whereby the Artifactory Cloud platform did not update the <latest> tag in maven-metadata.xml upon deployment. | |
Packages | Medium | Fixed an issue whereby Artifactory was not able to cache the the drupal/nouislider_js module and other modules from git.drupalcode.org. | |
RTFE-3603 | Projects | Medium | Fixed an issue whereby the "Read Only" check box was not saved when sharing a repository with a project. |
RTDEV-39704 | Release Lifecycle Management | Medium | Fixed an issue that caused builds to be deleted during build promotion if the customer’s storage quota exceeded the configured limit. The status change operation in the build promotion process will now fail if the storage quota has been reached. |
RTDEV-57821 | Release Lifecycle Management | Medium | Fixed an issue whereby attempts to delete, move, or overwrite a promoted artifact returned a 403 error code (Forbidden). These actions will now return a 409 error code (Conflict). |
RTDEV-58946 | Release Lifecycle Management | Medium | Fixed an issue where creating a Release Bundle would incorrectly discard duplicate artifacts from different modules. If a build contained the same artifact in multiple paths, only one copy was kept. The process now correctly includes all instances of the artifact, preserving each one in the final Release Bundle. |
RTDEV-59525 | Release Lifecycle Management | Medium | Fixed an issue whereby creating a Release Bundle with a non-existent project key returned a 500 error. It now returns a 400 error. |
RTDEV-59712 | Release Lifecycle Management | Medium | Fixed an issue whereby the same event displayed different timestamps in the kanban view and in the timeline. |
RTDEV-61209 | Release Lifecycle Management | High | Fixed an issue whereby the Get Release Bundle v2 Versions in a Specific Environment API would return data that did not reflect the version's current environment. |
RTDEV-61309 | Release Lifecycle Management | Critical | Fixed an issue whereby Artifactory was unable to collect all the multi-arch Docker images from a remote cache repository. |
RTDEV-61351 | Release Lifecycle Management | Medium | Fixed an issue whereby creating a Release Bundle containing two builds with different tags but identical content resulted in the inclusion of just one build. |
RTDEV-61511 | Release Lifecycle Management | Medium | Fixed an issue whereby promotion to a specific repository would fail due to a race condition caused by the creation of an unrelated repository in the same environment. |
RTDEV-61672 | Release Lifecycle Management | Medium | Fixed an issue whereby publishing build-info with an empty statuses section caused a 500 error. |
RTDEV-62012 | Release Lifecycle Management | Medium | Fixed the checksum calculation for Release Bundle (RBv2) by adding an explicit ORDER BY clause. |
RTDEV-64239 | Release Lifecycle Management | High | Fixed an issue that affected the build promotions process. Previously, when multiple dependencies had the same SHA, only one file would be promoted and the rest would be ignored. Now all dependencies are promoted, even if the files have the same SHA. |
RTDEV-64552 | Release Lifecycle Management | High | Fixed an issue whereby build dependencies were extracted during Release Bundle v2 creation even when the |
Release Lifecycle Managment | Medium | Fixed an issue whereby, when viewing a build’s dependencies within an Artifactory project and selecting Show in Tree for a dependency, the UI redirected to a repository that was not included in the project. | |
RTDEV-57244 | Repositories | Medium | Fixed an issue whereby attempting to create a remote repository with an encrypted password from another Artifactory instance failed with a 500 BadPaddingException. |
RTDEV-57737 | Repositories | High | Fixed an issue whereby:
|
RTDEV-57893 | Repositories | Medium | Fixed an issue whereby artifacts failed to appear in the UI browser after defining an include pattern on the virtual repository. |
RTDEV-58624 | Repositories | Medium | Fixed an issue whereby the following APIs were accessible to admins only: Now, after the fix, these APIs can be accessed by non-admins with the appropriate permissions. |
RTDEV-60496 | Repositories | High | Fixed an issue whereby the .jfrog system folder could not be deleted from local repositories or remote caches. |
RTDEV-61165 | Repositories | Medium | Fixed an issue whereby the Get All Repository Configurations API, in certain cases, returned an empty response when using the JSON accept header. |
RTDEV-62248 | Repositories | Low | Fixed an issue whereby the file-list API would return a 404 error for nested virtual repositories when setting the parameter ?list&deep=1. |
RTDEV-64189 | Repositories | Medium | Fixed an issue whereby it was not possible to enable the List Remote Artifacts checkbox for Conda smart remote repositories. |
RTFE-3619 | Repositories | Low | Fixed an issue whereby pressing the Delete button to delete a repository multiple times caused multiple popups. |
Repositories | Low | Fixed an issue whereby attempts to test the connection to a remote repository using token authentication fail. | |
RTDEV-61737 | Storage | Low | Fixed an issue whereby stale file descriptors remain from temporary files created when uploading binary with Azure Binary Provider. |
JA-18101 | User Interface | Medium | Fixed an issue related to the OIDC integration configuration in the JFrog Platform WebUI whereby, when reopening the Identity Mapping configuration following initial setup and saving it again without making any changes, group names containing spaces were not displayed as expected. |
RTDEV-60864 | User Interface | Medium | Fixed an issue whereby the Artifactory native UI did not display the contents of a VCS remote repository when an include pattern was set. |
RTDEV-62995 | User Interface | Low | Fixed an issue whereby in the Monitoring Storage UI, there was an unexpected appearance of the ` character. |
RTDEV-62997 | User Interface | Low | Fixed an issue in the Storage Monitoring UI, whereby when clicking the sort icon in the Percentage column to display the results in ascending order, the results were displayed in descending order (and vice versa). |
RTFE-3332 | User Interface | Medium | Fixed an issue whereby the Artifactory UI displayed an option to delete properties from virtual repositories, even though it is not possible to delete these properties. |
RTFE-3546 | User Interface | High | Fixed an issue whereby the warning “<previous artifact from previous project> could not be found“ was incorrectly appearing in the UI when switching projects. |
RTFE-3639 | User Interface | Medium | Fixed an issue whereby when navigating to a Storage project in the UI, the Package Type for npm appeared as “N/A” instead of displaying npm. |
JA-18037 | User Management | High | Fixed an issue whereby clicking Unlock on the Edit Profile page was throwing a 403 Forbidden error. |
WKS-1799 | Workers | Medium | Fixed an issue in the Workers Page in the JFrog Platform WebUI whereby, when creating or editing an event-driven Worker, selecting a timezone, and saving the configuration, the timezone was not saved as expected. |