Artifactory 7.133.3 Self-Managed

Application metrics now available to SaaS users

Users working in SaaS (Cloud) environments can now receive a wide variety of application-related metrics (based on the Open Metrics standard) using a new REST API. For more information, see Get Artifactory Application Metrics.Get Artifactory Application Metrics

New REST API for preparing evidence for deployment to Artifactory

The new Prepare Evidence REST API simplifies the evidence creation process for users who do not use the JFrog CLI. The API request contains the predicate, which is a JSON containing claims about the defined evidence subject (for example, a build or artifact), and can include an optional markdown version. The API returns a payload that conforms to the in-toto attestation standard used by the JFrog platform. After signing the payload, you can deploy the evidence to the JFrog platform using the Deploy Evidence REST API. For more information, see Create Evidence using REST APIs.Prepare EvidenceEvidence PredicateDeploy EvidenceCreate Evidence using REST APIs

Release Bundle v2 creation dry run

You can now use the Create Release Bundle v2 REST API to perform a dry run, which simulates the creation of the Release Bundle and performs all the necessary validations, but without persistence. For more information, see Perform a Release Bundle v2 Creation Dry Run.Create Release Bundle v2 VersionPerform a Release Bundle v2 Creation Dry Run

New REST API for deleting the tag from a Release Bundle v2 version

To improve the user experience, you can use a new, dedicated REST API to delete a tag from a Release Bundle v2 version. For more information, see Delete Release Bundle v2 Version Tag.Delete Release Bundle v2 Version Tag

Query parameter for returning all errors during Release Bundle v2 creation

To help debug issues you may encounter during Release Bundle v2 creation, a new fail_fast query parameter has been added to the REST API. When set to false, the API will return validation errors that occur during creation as a group instead of failing after the first error. For more information, see Release Bundle v2 Creation Errors Collected by System.Create Release Bundle v2 VersionRelease Bundle v2 Creation Errors Collected by System

RLM promotion rollback from platform UI

To improve the user experience, you can now roll back a Release Bundle v2 version promotion from the platform UI. For more information, see Promotion Rollback. Please note that the UI icon for deleting a promotion has been removed, as rollback replaces this functionality.Promotion Rollback

Audit trail maintained when promoting duplicate Release Bundle artifacts

Previously during Release Bundle v2 promotions, the system skipped artifacts that already existed in the target stage. This behavior prevented the target stage from being updated with evidence associated with those artifacts. This enhancement guarantees that all associated evidence is copied to the target stage, ensuring a complete and verifiable audit trail throughout your SDLC.

Improved performance when creating Release Bundles from builds with dependencies

To enhance the user experience, we have implemented significant performance enhancements when creating Release Bundle v2 versions from builds that contain dependencies.

Significantly Improved Package Details User Interface

The Package Details user interface (UI) has been significantly improved, and now displays valuable information about package versions in a more user-friendly format, including:

For more information, see The Package Details User Interface.The Package Details User Interface

Significant Improvements in the Repositories User Interface

The Repositories user interface has been significantly re-designed, making it much more user-friendly and efficient.  When initially opening the Repositories list, there are options to view the 20 most recently viewed repositories and to view inactive repositories. Filtering capability has been added, so that you can now filter the Repositories list according to Repository type, package type, URL (for remote repositories), Project association, stage, and repositories that have a replication (for local and remote repositories). For more information, see View Repositories.View Repositories

Date picker to improve Builds page performance

To improve performance, the Builds page now features a date picker that displays only those builds within a defined timeframe. The default value is the last 7 days. Users can choose a different timeframe as needed.

Improved performance of Build Versions page in platform UI

Pagination has been added to the Build Versions page in the platform UI, which makes it faster and more convenient to use when the selected build contains many existing versions.

User Management - Permissions

Updated the tooltip for the Include All Builds checkbox to clarify that selecting this option includes all builds and preserves any defined exclude patterns. For more information, see Add Builds.Add Builds

Support for .dsc Source packages in local Debian repositories

Local Debian repositories now support Debian source packages. After configuring your sources.list file for source packages, you can deploy the component source package files one by one to your local repository and resolve them as a single package using apt-get source. For more information, see Connect Debian to Artifactory.Connect Debian to Artifactory

Performance Optimizations in NuGet Package Manager

Artifactory now offers a newer implementation of the NuGet package manager in Self-Managed Artifactory deployments. The new implementation significantly improves performance and efficiency with the following benefits:

To enable the new NuGet handler, add the following property to the Artifactory system properties file: artifactory.package.handler.nuget=true.

The new handler is opt-in for Self-Managed Artifactory deployments at this time, but it will be the default NuGet handler for all customers in an upcoming release. The new handler is already implemented in SaaS versions of Artifactory.

New REST APIs for VCS Remote Repositories to Obtain Data from Subgroup Repositories

New REST APIs have been added for VCS remote repositories to obtain data from subgroup repositories. Four new APIs have been added that allow you to:

Also, the legacy APIs Get VCS Tags and Get VCS Branches can be used to obtain VCS tags and branches from subgroup repositories.Get VCS TagsGet VCS Branches

Currently, branches and tags can be downloaded only in the tar.gz format.

In this Artifactory version, these APIs can be used to obtain data from the Google Source Git Provider.

Google Source Git Provider for VCS Remote Repositories

Support has been added in the Artifactory user interface for the Google Source Git Provider for VCS remote repositories. For more information, see Use VCS To Proxy Git Providers.Use VCS To Proxy Git Providers

Improvements in VCS Remote Repositories APIs

The user organization can now be used as the repository for downloading VCS tags, branches, files in a tag, and files in a branch. For more information, see Download a VCS Tag, Download a VCS Branch, Download File within a VCS Tag, and Download File within a VCS Branch.Download a VCS TagDownload a VCS BranchDownload File within a VCS TagDownload File within a VCS Branch

Smart Remote Repository URL validation

When you create or update an existing Smart Remote repository using the REST APIs, Artifactory will validate the URL to ensure that it is correct, including the prefix required by many package types. For more information about the URL prefix, see Configure a Smart Remote Repository.Configure a Smart Remote Repository

Supported Clients and Versions

JFrog CLI commands for setting up IDEs with AI Editor Extension and JetBrains Plugins repositories

The new jf ide setup command automates the process of connecting your IDE to an AI Editor Extensions or JetBrains Plugins repository in Artifactory. You can run the single command to configure any supported client, instead of manually granting permissions and editing configuration files. For more information, see Connect your IDE to Artifactory.Connect your IDE to Artifactory

Curation Support Added for PHP Composer Remote Repositories

Artifactory now ensures security compliance for Composer repositories protected by JFrog Curation. If a package is blocked by security policy, Artifactory automatically prevents the Composer client from falling back to external source URLs to download.

Added Support for the Range Header in Download Requests for PyPI Repositories

Artifactory now supports Range requests when downloading Python packages from local, remote, and virtual PyPI repositories. This improves compatibility with the UV package manager and prevents redundant full-package downloads, reduces unnecessary download counts, and improves performance.

Added Support for Proxying the GitHub Enterprise Cloud Private Registry for Go Remote Repositories

Support has been added for proxying the GitHub Enterprise Cloud private registry (<comanyName>ghe.com) for Go remote repositories.

Curation Support Added for PHP Composer Remote Repositories

Artifactory now ensures security compliance for Composer repositories protected by JFrog Curation. If a package is blocked by security policy, Artifactory automatically prevents the Composer client from falling back to external source URLs to download.

This feature requires Xray version 3.137.0 or above.

URL Auto-Correct Added to Procedure for Creating a Smart Remote Repository

An auto-correct feature was added to the procedure for creating a smart remote repository for certain package types, to ensure that a correct URL is used. For more information, see Configure a Smart Remote Repository.Configure a Smart Remote Repository

Bridge URLs in Remote Repositories

Bridge URLs can now be used in remote repositories without additional configuration.

Retention Policies - Package Version Pattern Filtering

Cleanup and Smart Archiving retention policies now support Include and Exclude Package Version Patterns. For more information, see Cleanup Policies and Smart Archiving.Cleanup PoliciesSmart Archiving

Improved the Run reports generated by Retention Policies for packages (Cleanup and Smart Archiving)

The reports now include Package Path, Created Date, Modified Date, and Last Downloaded Date columns under Run Detailed Summary to facilitate better validation and auditing of deleted or archived packages. For more information, see Smart Archiving Run Report Overview, Restore Run Report Overview and Cleanup Run Report Overview.Smart Archiving Run Report OverviewRestore Run Report OverviewCleanup Run Report Overview

Updated Payload Code Sample for "Before Download Request Worker"

The payload code sample for Before Download Request Worker has been updated for backward compatibility and to avoid compilation errors. The redundant repoPath object has been removed from the root of the event request, and the headers object is now identified as requestHeaders. For more information, see Before Download Request Worker Code Sample.Before Download Request Worker Code Sample

Evidence system enhancements

New REST APIs for evidence queries

Two new REST APIs are available for performing evidence queries. They are intended for users who prefer traditional REST APIs for integration with their existing automation tools instead of using GraphQL. For more information, see Search Evidence (REST API) and Get Evidence by ID (REST API).Search Evidence (REST API)Get Evidence by ID (REST API)

Evidence GraphQL API for returning evidence by ID

You can now use GraphQL to return the details of a specific evidence item using its ID instead of using its path. For more information, see Get Evidence by ID (GraphQL).Get Evidence by ID (GraphQL)

Support for Advanced Patterns in OIDC Integration Dynamic Mapping

The JFrog Platform OIDC integration now supports dynamic mapping creation using more advanced patterns, which automates and streamlines the process for various use cases.

Added a Warning Message When Deleting a SCIM Token

The JFrog Platform now displays a warning message when attempting to delete a SCIM token, as deletion might disconnect authentication provider integrations.

Support for New SCIM REST API Endpoints

The JFrog Platform now supports getting more information about your SCIM configuration and schemas via REST API. For more information, see Get Resource Types, Get Service Provider Configuration, Get Schemas, and Get Schema by ID.Get Resource TypesGet Service Provider ConfigurationGet SchemasGet Schema by ID

New Support for Password Control Via REST API

The JFrog Platform Access service now enables you to expire and un-expire all passwords via REST API. For more information, see Expire Password for All Users and Un-Expire Password for All Users.Expire Password for All UsersUn-Expire Password for All Users

Support for Filtering Tokens by Scope via REST API

The JFrog Platform now supports filtering the results of the Get Tokens REST API using the scope parameter to get token results for a specific scope, such as group. For more information, see Get Tokens.Get Tokens

Added Support for Project Admin Permissions

The JFrog Platform now offers more granular control over project admin permissions, enabling you to grant Manage Resources permissions to project admins while preventing them from creating or managing remote repositories.

Logging of Administration Configuration Changes

The JFrog Platform now supports logging of any changes made to the access configuration, such as enabling anonymous access, in the Access audit trail log.Audit Trail Log

Support for Webhook Target Validation

The JFrog Platform now supports creating a whitelist to allow private domains or IP addresses to be used as Webhook targets without needing to disable Artifactory validation.

Support Added for Decompressing .xz and tar.xz Files

Artifactory now supports decompressing .xz and tar.xz files, similar to the already supported decompression for  .zip, .tar, and .gz files.

Artifactory Helm chart now supports Azure Workload Identity authentication through the new useInstanceCredentials parameter. This authentication method replaces the legacy saasTokens and accountKey configurations. For more information, see Azure Workload Identity

Artifactory Helm chart now includes the rtfs.customCertificatesSecretName parameter for the RTFS service. This ensures custom certificates are properly copied to the RTFS container’s trusted certificates folder.