Artifactory 7.133.8 Self-Managed

JFrog Release Information

Content Type
Release Notes

Released: 10 February 2026

Intended Change in Artifactory’s Response to Improper Configuration of a Smart Remote Repository

To properly configure a smart remote repository using the Create Repository API, the URL of an Artifactory instance must be used as the URL of the remote repository, and the attribute contentSynchronisation must have enabled = true in the Repository Configuration JSON.Create RepositoryRepository Configuration JSON

Currently, if a user wants to create a smart remote repository and enables contentSynchronisation, but does not set the URL of an Artifactory instance as the URL of the remote repository, Artifactory responds by creating a regular (not smart) remote repository, sends a 200 success message, and disables contentSynchronisation. The user does not receive any indication that the smart remote repository that the user tried to create is actually a regular remote repository or that contentSynchronisation is disabled.

Starting from May 12, 2026, Artifactory will respond differently to this scenario. Instead of creating a regular remote repository, Artifactory will respond with a 400 error message, and no repository will be created.

Artifactory to Stop Allowing Importing a Backup of Repositories with the -cache Suffix

Artifactory does not allow creating a repository with the -cache suffix, because -cache is a reserved string that Artifactory uses internally to create a -cache repository for every remote repository. However, currently Artifactory allows importing a backup of repositories even if there are repositories in that backup with a -cache suffix. Starting from May 12, 2026, Artifactory will no longer allow a backup of repositories if there are repositories in that backup containing the -cache suffix. Ensure that by May 12, 2026, you do not have any repositories with the -cache suffix to be backed up for the backup to run successfully.

Note: Renaming existing repositories is not possible. Therefore, if you need to rename a repository because it has the -cache suffix, the most efficient way to do this is to create a new repository, copy the contents of the repository with the -cache suffix into it, then delete the old repository.

Resolved Issues

JIRA Issue

Component

Severity

Description

RTDEV-76067

General

Medium

Fixed an issue whereby AQL returned an empty array for a valid build domain query for an admin user.

RTDEV-63325

General

Medium

Fixed an issue whereby when attempting to download a file via a URL in the native browser, if Allow Anonymous Access was enabled but authorization was still required, a pop-up appeared requesting a username and password to complete the download instead of an auto-redirect to the SAML login page.

RTDEV-71910

General

High

Fixed an issue whereby repository-level JMX attributes ArtifactsCount and ArtifactsTotalSize were missing from MBeans, preventing remote monitoring of storage metrics via JConsole.

RTFE-4535

User Interface (UI)

High

Fixed an issue whereby non-admin users sometimes experienced failures when uploading large artifacts through the Artifactory user interface.

RTDEV-73816

Release Lifecycle Management

High

Fixed an issue that potentially allowed malicious insiders to exploit a stored XSS vulnerability.