Released: 12 February, 2026
Intended Change in Artifactory’s Response to Improper Configuration of a Smart Remote Repository
To properly configure a smart remote repository using the Create Repository API, the URL of an Artifactory instance must be used as the URL of the remote repository, and the attribute contentSynchronisation must have enabled = true in the Repository Configuration JSON.
Currently, if a user wants to create a smart remote repository and enables contentSynchronisation, but does not set the URL of an Artifactory instance as the URL of the remote repository, Artifactory responds by creating a regular (not smart) remote repository, sends a 200 success message, and disables contentSynchronisation. The user does not receive any indication that the smart remote repository that the user tried to create is actually a regular remote repository or that contentSynchronisation is disabled.
Starting from May 12, 2026, Artifactory will respond differently to this scenario. Instead of creating a regular remote repository, Artifactory will respond with a 400 error message, and no repository will be created.
Artifactory to Stop Allowing Importing a Backup of Repositories with the -cache Suffix
Artifactory does not allow creating a repository with the -cache suffix, because -cache is a reserved string that Artifactory uses internally to create a -cache repository for every remote repository. However, currently Artifactory allows importing a backup of repositories even if there are repositories in that backup with a -cache suffix. Starting from May 12, 2026, Artifactory will no longer allow a backup of repositories if there are repositories in that backup containing the -cache suffix. Ensure that by May 12, 2026, you do not have any repositories with the -cache suffix to be backed up for the backup to run successfully.
Note: Renaming existing repositories is not possible. Therefore, if you need to rename a repository because it has the -cache suffix, the most efficient way to do this is to create a new repository, copy the contents of the repository with the -cache suffix into it, then delete the old repository.
Feature Enhancements
Additions to the Artifactory Request Log and Outbound Request Log
The Artifactory Request Log (JSON only) and Outbound Request Log (JSON only) have been extended with two new fields that significantly simplify the analysis of traffic patterns:
repo: The name of the repository as it appears in the URL
repo_type: The type of the repository (one character). Will be one of the following:
v: virtual
l: local (also for federated)
r: remote
Improved Maven Indexing Performance
Artifactory performance has been improved by optimizing
database indexes for Postgres DB. By reducing the database load during file upload and deletion operations, this change ensures better system stability and faster response times for Maven repositories.npm Metadata Protection
To avoid potential metadata corruption, Artifactory now blocks writing to the
.npmdirectory during copy or move operations to paths in that directory. This limitation prevents source metadata from overwriting the destination's system-generated files, ensuring your npm packages remain correctly indexed after the move.npm Attestation Support
This version of Artifactory introduces support for native npm provenance and attestations in remote and virtual repositories. When running
npm audit signatures, the output now includes signatures and attestations for supported packages. This enhancement allows you to retrieve build-source metadata directly from upstream registries and ensure package authenticity. For more information, see Use npm Audit.Support for Webhook Creation Role
The JFrog Platform now supports a role that allows users who are not platform administrators to create and manage Webhooks. For more information, see Create and Edit Users.
Resolved Issues
JIRA Issue | Component | Severity | Description |
|---|---|---|---|
RTFE-4259 | Release Lifecycle Management | Medium | Fixed an issue that prevented users with the correct permissions from creating Release Bundles from the Builds page. |
RTDEV-73811 | Packages | Medium | Fixed an issue whereby when the Docker Access Method was configured as a subdomain, the Set Me Up dialogue for Docker generated an incorrect Docker login URL. |