JFrog

No entries match these filters. Clear filters

1. docs update Oct 21, 2026 · issue 115

   JFrog Curation adds Compliant Version Selection, Curation Federation, and On-Demand Curation for broader OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. governance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Compliant Version Selection, which automatically returns the highest package version that passes all policies when a requested version is blocked, so developers avoid failed builds without manual intervention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Curation Federation, which synchronizes policies, conditions, and JFrog Catalog labels from a central controller site to all connected JFrog Platform Deployment sites, eliminating manual policy replication.
   • Adds On-Demand Curation, which extends policy enforcement to packages from internal, private, or ecosystem-specific repositories not covered by the JFrog Public Catalog, applying real-time vulnerability, license, immaturity, and malicious code evaluation before a package reaches the developer.

   3 details in Everything

2. announced Oct 21, 2026 · issue 116
   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Roll out Shadow AI detection to a developer workstation by installing the JFrog Agent Plugin so local AI assets are automatically discovered, scanned, and reported to the JFrog Platform.
   📍Steps: 1. Obtain the JFrog Agent Plugin package from your JFrog Platform administrator. 2. Install the plugin on the target developer workstation. 3. The plugin begins the Discover → Scan Locally → Report cycle automatically — findings appear in JFrog AI Security under the unified AI asset inventory.
3. Shadow AI Detection Now Extends to Developer Workstations (2026-10-21) Oct 21, 2026 · issue 115

   JFrog AI Security extends Shadow AI detection to developer workstations via the JFrog Agent Plugin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   • Adds the JFrog Agent Plugin installable on developer workstations to discover and locally scan AI assets — skills, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, plugins, hooks, commands, and monitors — that bypass central repository controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces a three-step local detection pipeline: Discover (enumerate AI assets on the workstation), Scan Locally (deterministic rules-based scan), and Report (sends metadata, findings, and risk analysis to the JFrog Platform).
   • Adds a unified AI asset inventory in JFrog AI Security showing each asset's name, type, reporting harness (Claude Code, Cursor, etc.), workstation count, local risk analysis, JFrog origin, and detection timestamp.
   • Adds risk assessment classifications for detected assets: Shell Access + WebFetch (high exfiltration risk), Unscoped Write/Edit (writes outside designated directories), and BypassPermissions Mode (executes without required approval).
   • Adds an Origin field per asset indicating whether it matches an artifact already managed in JFrog Artifactory or JFrog Catalog, or has No Match against the JFrog Platform.

   5 details in Everything

4. Scanning AI Assets: Catching What SCA and SAST Might Miss (2026-10-21) Oct 21, 2026 · issue 115

   JFrog adds intent-based AI asset scanning for SKILL.md files, agent plugins, and APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. packages via JFrog AI Security and Agent Guard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Adds JFrog AI Security scanner that performs semantic (intent-based) analysis of agent skill files (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ SKILL.md), agent plugins, and APM manifest packages to detect prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools., hidden instructions, obfuscated payloads, and credential-exfiltration instructions that SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. cannot reach.
   • Adds JFrog Agent Guard enforcement component that applies deterministic-plus-semantic policy at the agent harnessagent harnessThe software around an AI agent that manages its tools, execution loop, state and limits. It determines how the model's proposed actions are run and checked. — the point an agent actually invokes the asset — not only at download time, so a skill reclassified after initial approval is blocked on machines that already have it.
   • Returns one of three scan classifications — Not Malicious, Suspicious, or Malicious — for each AI asset, with policy controls that route outcomes to block, review queue, or allow.
   • Supports per-version allow-lists so approving one version of a skill does not automatically approve subsequent versions.
   • Supports enforcement by severity threshold (e.g. block any skill with a Critical-severity finding) and time-bound waivers with fixed expiration dates.

   +1 more show less

   • Stores agent skills, plugins, and APM packages in JFrog Artifactory alongside Docker images and npm packages under the same permissions model and audit trail, unifying AI and software supply chainsoftware supply chainThe dependencies, tools and processes used to build and deliver software. Compromising one part can affect the products or organizations that rely on it. assets in a single platform.

   6 details in Everything

5. announced Oct 15, 2026 · issue 113

   JFrog Business Value Center adds a real-time ROI and security-coverage dashboard inside MyJFrog for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ HOW TO FIND IT
   View your platform's ROI, hours saved, and scan-coverage metrics before a renewal or budget review.
   📍Sign in to MyJFrog, then navigate to Business Value Center to see real-time ROI, developer hours reclaimed, storage savings, and the percentage of repositories currently scanned by Xray.
   • Adds the JFrog Business Value Center dashboard inside MyJFrog, surfacing real-time ROI, developer hours reclaimed, cost savings, storage avoided, and vulnerability-scan coverage across the software supply chainsoftware supply chainThe dependencies, tools and processes used to build and deliver software. Compromising one part can affect the products or organizations that rely on it..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Tracks what share of repositories are actively scanned by JFrog Xray and what share of incoming open-source packages are blocked by JFrog Curation policies, giving security teams auditable coverage metrics on demand.

   2 details in Everything

6. JFrog Business Value Center: Celebrate the ROI of Your Software Supply Chain (2026-10-15) Oct 15, 2026 · issue 110

   JFrog Business Value Center adds a real-time ROI and supply chain coverage dashboard inside MyJFrog for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ HOW TO FIND IT
   Access the Business Value Center to pull real-time ROI figures before a budget renewal or executive review.
   📍Sign in to MyJFrog › select Business Value Center from the dashboard navigation › review the ROI panel (developer hours reclaimed, cost avoided, storage saved) and the Optimization panel (% of repos scanned, % of packages blocked by Curation policies).
   • Adds the JFrog Business Value Center inside MyJFrog — a real-time dashboard that quantifies platform ROI, developer hours reclaimed, storage saved via deduplication, and the percentage of repositories actively scanned by JFrog Xray.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Surfaces an Optimization panel showing what share of the software supply chainsoftware supply chainThe dependencies, tools and processes used to build and deliver software. Compromising one part can affect the products or organizations that rely on it. is scanned for vulnerabilities and what fraction of incoming open-source packages are blocked by JFrog Curation policies before reaching developers.

   2 details in Everything

7. Governing the Agentic SDLC Through Continuous Policy Enforcement (2026-10-12) Oct 12, 2026 · issue 106

   JFrog introduces the Agentic Process Evidence Protocol and AppTrust Prompt-to-Release Traceability to govern AI agent activity across the SDLCSDLCThe Software Development Life Cycle: a structured process covering planning, design, coding, testing, and deployment. Cyber tools integrate into it to catch vulnerabilities before code ships rather than after..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Adds Prompt to Release Traceability in JFrog AppTrust, connecting AI agent session logs to signed SLSASLSASupply-chain Levels for Software Artifacts, a framework for assessing how software was built and protecting that process from tampering. Provenance records help verify where a build came from.-compatible provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. attestations and binding them to git commits, artifacts, and released versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces the Agentic Process Evidence Protocol, a four-step framework that captures agent session telemetry (user prompts, thinking tokensthinking tokensIntermediate reasoning a model writes out before its final answer. Reasoning models generate it automatically and it is often billed as extra output tokens., file edits, tool calls), cryptographically signs and attaches evidence to SDLC entities, evaluates evidence at policy gates before promotion, and persists session logs for post-release auditing.
   • Enables policy-as-code release gates that evaluate Agentic Process Evidence to enforce checks such as approved LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. usage, approved MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool usage, human accountability, human review presence, and absence of unapproved lateral operations.
   • Captures five signed categories of facts per agentic process: agent identity (agent version, harness version, model ID), execution traceability (full session logs as structured JSON covering every tool call, API call, input, and context source), provenance, integrity, and policy compliance.
   • Publishes an open Agentic Process Evidence specification on GitHub (https://github.com/jfrog/agentic-process-evidence) for integration by agent frameworks (Cursor, OpenCode, Claude Code, or custom AI workers), regulatory bodies, and SDLC platform providers.

   +1 more show less

   • Supports post-release auditing by binding session logs to git commits and software releases, enabling retroactive searches — for example, identifying all releases produced using a later-identified malicious MCP tool.

   6 details in Everything

8. announced Sep 16, 2026 · issue 082

   JFrog Artifactory adds native LuaRocksLuaRocksThe package manager for the Lua programming language, maintained by the LuaRocks project, used to distribute and install Lua modules so tools can pull in versioned dependencies without bundling them manually. repository support for hosting, proxying, and caching Lua rocks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Adds LuaRocks as a native repository type in JFrog Artifactory, supporting local, remote, and virtual repository configurations for Lua packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports proxying and caching the public luarocks.org registry through a remote repository, serving cached rocks on subsequent requests.
   • Enables hosting private rocks and Kong plugins in a local LuaRocks repository, allowing CI jobs to publish .rock files and Kong nodes to install versioned plugins from a single internal endpoint.
   • Provides a virtual LuaRocks repository that unifies private and cached public rocks behind a single URL for the luarocks client.

   4 details in Everything

9. JFrog Artifactory Supports LuaRocks Hosting for NGINX, OpenResty and Kong (2026-09-16) Sep 16, 2026 · issue 077

   JFrog Artifactory adds native LuaRocksLuaRocksThe package manager for the Lua programming language, maintained by the LuaRocks project, used to distribute and install Lua modules so tools can pull in versioned dependencies without bundling them manually. repository support for hosting, proxying, and caching Lua rocks for NGINX, OpenResty, and Kong.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Adds LuaRocks as a native repository type in Artifactory, supporting local, remote, and virtual repository tiers for Lua packages (rocks and rockspecs).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a remote repository type that proxies and caches luarocks.org rocks on first request, so subsequent pulls are served from Artifactory rather than the public registry.
   • Adds a local repository type for storing private first-party rocks, internal libraries, and custom Kong plugins as versioned .rock files.
   • Adds a virtual repository that unifies local and remote LuaRocks repositories behind a single endpoint for the luarocks client.
   • Enables the luarocks CLI to point at an Artifactory virtual repository URL as its registry, replacing direct luarocks.org access for OpenResty and Kong fleets.

   5 details in Everything

10. docs update Sep 16, 2026 · issue 076

    JFrog Boost wraps agent shell commands to compress log noise, index codebases, and export OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. telemetry to observability backends.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Introduces JFrog Boost, a CLI tool that wraps shell commands run by coding agents to compress repetitive log noise before output reaches the agent context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it. while preserving failures, summaries, and actionable hints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports company-wide Boost deployment via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. scripts for organization-wide rollout.
    • Adds GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. integration to compress agent shell output in CI workflows.
    • Adds BoostGraph to index a codebase locally so agents can answer structural questions faster.
    • Supports exporting JFrog Boost OTLP spans to external observability backends.

    5 details in Everything

11. Extending the Single Source of Truth to the Agentic Software Supply Chain (2026-09-02) Sep 2, 2026 · issue 063

    JFrog extends platform governance to agentic supply chains with new APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. Registry, Plugins Registry, Skills Scanning, Agent Guard, and Zero-Touch Remediation.

    ⤢
    • New APM Repository provides a governed registry for agent package installs, replacing open-internet pulls via apm install.
    • New Plugins Registry delivers a scanned, auditable source for first- and third-party coding agent plugins, replacing default public marketplaces.
    • New Skills Scanning uses semantic security scanning to detect malicious behavior in skill files and block them before they reach a developer's machine.
    • New Agent Guard (AI Asset Enforcement) ensures only AI assets approved in AI Catalog are consumed by agents across coding environments.
    • New Agent Package Resolution provides a trusted, policy-enforced path for agents to resolve dependencies through the JFrog Platform.

    +5 more show less

    • New JFrog Agent Plugin integrates coding agents — Claude Code, Cursor, VS Code Copilot, Kiro, Devin, OpenCode, and Codex — natively with the JFrog Platform.
    • New Traffic Controller integrations with Netskope, Zscaler, and Cloudflare redirect public-repo package requests through JFrog at the network layer.
    • New JFrog Zero-Touch Remediation automatically evaluates all available fixes for a vulnerability in a customer's environment and selects the best one based on policy, environment, and risk tolerance.
    • New AutoPR with Smart Remediation automatically pushes verified, context-aware fix guidance directly to pull requests.
    • Expanded JFrog AI Catalog now governs skills, plugins, and Agent Packages (APM) in addition to previously supported AI assets.

    10 details in Everything

12. docs update Sep 2, 2026 · issue 062

    JFrog AI Coding Agent Plugin now supports Claude Code, Cursor, VS Code, and OpenCode agents.

13. Live From the Show Floor: swampUP 2026 (2026-09-02) Sep 2, 2026 · issue 063

    JFrog swampUP 2026 unveils Zero-Touch Remediation, AI-powered policy-as-code, prompt-to-release traceability, and post-release governance.

    • Introduces Zero-Touch Remediation via Compliant Version Replacement, which automatically swaps a vulnerable package version for a patched one mid-pipeline by evaluating multiple upstream sources (Chainguard, Maven Central, and others) against the customer's own policy, with JFrog Artifactory as the system of record.
    • Introduces Agentic Remediation for first-party code, fixing vulnerabilities at the source level with a developer reviewing and approving before merge — distinct from Zero-Touch Remediation's fully automated mid-pipeline swap.
    • Adds an AI-Powered Policy as Code Playground that converts plain-language intent into enforceable, versioned, Rego-based policy automatically, requiring no manual policy authoring.
    • Adds Prompt to Release Traceability, shifting evidence collection left to capture the full provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. trail for every agent interaction and artifact — sessions, tickets, pull requests, approvals, and promotions — stored alongside the exact software version being created.
    • Adds Out-of-the-Box Compliance Frameworks, enabling teams to activate pre-built policy sets for standards such as NIST and CRA and select only the applicable sections, with no custom configuration required.

    +2 more show less

    • Adds Repo-Level Policies that enforce evidence-based governance directly on repositories without requiring project, application, or lifecycle-stage setup.
    • Adds Post-Release Governance, extending compliance monitoring and vulnerability remediation tracking through the support window after a release ships to address European regulatory requirements.

    7 details in Everything

14. announced Sep 2, 2026 · issue 064

    JFrog AppTrust adds Prompt to Release Traceability — auto-assembling signed commit, PR, Jira, and agent session evidence at promotion time.

    ⤢
    • Introduces Prompt to Release Traceability in JFrog AppTrust, automatically collecting and signing commits, pull requests, Jira ticket transition histories, and approver chains for every release before any promotion gate runs.
    • Detects self-approval violations automatically by checking whether the PR approver is the same person as the committer — a check most compliance frameworks require but few teams automate.
    • Incoming JFrog Agent Plugins will capture AI agent session evidence (prompts, code produced, MCPs, skills, and agentic assets used) as signed evidence stored in Artifactory, extending the audit trail to agentic development workflows.

    3 details in Everything

15. Every Release Needs a Chain of Custody. AI Agents Just Made That Harder. (2026-09-02) Sep 2, 2026 · issue 062

    JFrog AppTrust gains Prompt-to-Release Traceability: auto-assembled, signed audit evidence chains for every release.

    ⤢
    • Launches Prompt to Release Traceability inside JFrog AppTrust, automatically collecting commits, PRs, Jira ticket transitions, and approver records, signing them, and attaching them to the application version before any promotion gate runs.
    • Validates full Jira ticket transition history (creation → in-progress → done, with dates) rather than merely checking ticket existence, producing auditor-ready workflow proof.
    • Detects self-approval violations by mapping each PR's merger and approver back to the committer — automatically flagging the pattern most compliance frameworks explicitly prohibit.
    • Introduces incoming JFrog Agent Plugins to capture AI agent session evidence (prompts, code produced, and a full session bill of materialsbill of materialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. — including which MCPs, skills, and agentic assets were used) as signed evidence stored in Artifactory.
    • Launches out-of-the-box compliance frameworks with pre-mapped controls for NIST SSDFNIST SSDFA NIST framework of secure software development practices, organized into four groups, that gives teams a common vocabulary and baseline for reducing vulnerabilities introduced during the development lifecycle. and the EU Cyber Resilience Act, ready to enforce without manual configuration.

    +1 more show less

    • Git-based evidence (commits, PRs, Jira transitions, and approver chains) is generally available now; agent session evidence and session bill of materials are planned for later this year.

    6 details in Everything

16. The Evolution of JFrog AI Catalog: Your AI Control Plane for Agentic Development (2026-09-02) Sep 2, 2026 · issue 062

    JFrog AI Catalog expands into a full AI control plane with MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., skills, plugins, and runtime enforcement for agentic workflows.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enforce that a coding agent in Cursor or Claude Code can only install MCP servers, skills, and plugins that have passed your organization's security checks via Agent Guard at runtime.
    📍Steps: 1. In the JFrog platform, go to AI Catalog › Agent Plugins and install the JFrog agent plugin for your coding environment (Cursor, Claude Code, VS Code, OpenCode, or Codex). 2. Configure your MCP Registry: define the allowed MCP servers per project and specify any restricted tool calls. 3. Enable Agent Guard within the plugin settings to activate runtime policy enforcement for MCP tool calls and skill calls.
    Detect unvetted AI assets sprawling across your environment before they reach an agent, by reviewing Shadow AI Detection results categorized as managed, unmanaged, partially managed, or malicious.
    📍Steps: 1. In the JFrog platform, navigate to AI Catalog › Shadow AI Detection. 2. Review the categorized inventory of AI assets across your environment (managed, unmanaged, partially managed, malicious). 3. Promote assets you wish to approve into the appropriate governed registry (MCP Registry, Agent Skills Registry, or Agent Plugins Registry).
    • Adds an MCP Registry to define which MCP servers are allowed per project, restrict specific tool calls, and scan local MCP packages before an agent can use them.
    • Adds an Agent Skills Registry to curate, sign, verify, and scan packaged agent behaviors before execution is permitted.
    • Adds an Agent Plugins Registry to control, sign, verify, and scan plugin bundles agents install.
    • Adds Agent Packages support to ship an agent's entire context and dependency tree as a single versioned, resolvable package compliant with the open-source APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. (Agent Package Manager) standard.
    • Introduces semantic scans that analyze what an asset instructs an agent to do, rather than matching against known-bad hashes, to catch novel malicious skills and MCP servers.

    +4 more show less

    • Adds Shadow AI Detection to automatically detect and categorize every AI asset across an environment as managed, unmanaged, partially managed, or malicious.
    • Introduces Agent Guard, installed via the official JFrog agent plugin, which enforces organizational policy at runtime by checking every MCP tool call and skill call against defined policies, regardless of agent harnessagent harnessThe software around an AI agent that manages its tools, execution loop, state and limits. It determines how the model's proposed actions are run and checked. or coding environment.
    • Releases official JFrog agent plugins for Claude Code, Cursor, VS Code, OpenCode, and Codex that bring organizational policy control directly into the coding agent environment.
    • Stores all AI asset types — models, MCP servers, skills, plugins, and agent packages — as versioned, traceable artifacts in Artifactory under a single RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. model and audit trail.

    9 details in Everything

17. announced Sep 2, 2026 · issue 064

    JFrog AppTrust adds out-of-the-box NIST SSDFNIST SSDFA NIST framework of secure software development practices, organized into four groups, that gives teams a common vocabulary and baseline for reducing vulnerabilities introduced during the development lifecycle. and EU CRAEU CRAEU Cyber Resilience Act, a European Union regulation requiring manufacturers and publishers of products with digital elements to meet mandatory cybersecurity standards before selling into the EU market. compliance frameworks with pre-mapped Policy-as-CodePolicy-as-CodeThe practice of expressing governance rules, access controls, or compliance requirements as machine-readable code so they can be versioned, tested, and automatically enforced rather than managed through manual processes. enforcement

    ⤢ ⤢
    • Adds out-of-the-box compliance frameworks to JFrog AppTrust, starting with NIST SSDF and EU CRA, with controls pre-mapped to Policy-as-Code rules so teams can enable enforcement without writing Rego manually.
    • Separates framework configuration from rollout control: AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. owns which controls and rules are active, while development managers configure which applications fall under the framework, whether rules run as warnings or hard failures, and how long before a warning converts to a blocked package.
    • Extends SDLCSDLCThe Software Development Life Cycle: a structured process covering planning, design, coding, testing, and deployment. Cyber tools integrate into it to catch vulnerabilities before code ships rather than after. traceability to capture AI agent intent sessions alongside Git commits, pull requests, and Jira tickets, all connected to the artifacts that ship.

    3 details in Everything

18. Every New Compliance Framework Restarts the Same Fire Drill. It Doesn’t Have To. (2026-09-02) Sep 2, 2026 · issue 062

    JFrog AppTrust ships Out-of-the-Box Compliance Frameworks for NIST SSDFNIST SSDFA NIST framework of secure software development practices, organized into four groups, that gives teams a common vocabulary and baseline for reducing vulnerabilities introduced during the development lifecycle. and EU CRAEU CRAEU Cyber Resilience Act, a European Union regulation requiring manufacturers and publishers of products with digital elements to meet mandatory cybersecurity standards before selling into the EU market., with pre-mapped Policy-as-CodePolicy-as-CodeThe practice of expressing governance rules, access controls, or compliance requirements as machine-readable code so they can be versioned, tested, and automatically enforced rather than managed through manual processes. enforcement at release gates.

    ⤢ ⤢
    • Adds Out-of-the-Box Compliance Frameworks in JFrog AppTrust, launching with NIST SSDF and EU CRA pre-mapped to Policy-as-Code rules — no Rego to write and no manual control mapping required.
    • Introduces a compliance catalog inside AppTrust where AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. teams select a framework and see every control translated into plain requirements, each linked to specific Policy-as-Code rules enforced at release gates.
    • Surfaces coverage gaps explicitly: controls not yet covered by AppTrust are flagged, while controls already satisfied by running AppTrust are shown as covered by default.
    • Adds full SDLCSDLCThe Software Development Life Cycle: a structured process covering planning, design, coding, testing, and deployment. Cyber tools integrate into it to catch vulnerabilities before code ships rather than after. traceability capturing agent intent sessions, Git commits, pull requests, and Jira tickets, all connected to shipped artifacts, giving Policy-as-Code rules live data to check against.
    • Separates framework configuration from rollout control: AppSec owns which controls and rules are active; development managers control which applications are in scope, whether rules run as warnings or hard failures, and the warning-to-block conversion window.

    +1 more show less

    • Out-of-the-Box Compliance Frameworks are available now as part of the Ultimate Security Bundle.

    6 details in Everything

19. announced Aug 28, 2026 · issue 058
    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Opt in to JFrog Preview to gain immediate access to newly released capabilities before they reach general availability.
    📍In MyJFrog, go to Settings › Preview. Click the Enable Preview toggle. In the Enable JFrog Preview dialog box, open and read the Preview Terms of Service. Select the checkbox to accept the terms and conditions, and click Agree and Enable. Then select specific preview features to activate in your subscription.
    • New Preview early-access track available in two forms: Closed Preview (invite-only) and Open Preview (all eligible customers), both free with opt-in.
    • Activate Preview in the MyJFrog portal under Settings > Preview by enabling the Enable Preview toggle and accepting the Preview Terms of Service.
20. Introducing JFrog Preview: Getting New Capabilities Into Your Hands, Faster (2026-08-28) Aug 28, 2026 · issue 058

    JFrog launches a Preview early-access track so customers can opt into new capabilities before GA through MyJFrog.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Activate the JFrog Preview track to gain immediate access to newly available capabilities on your subscription.
    📍In MyJFrog, go to Settings › Preview. Click the Enable Preview toggle. In the Enable JFrog Preview dialog box, open and read the Preview Terms of Service. Select the checkbox to accept the terms and conditions, and click Agree and Enable. Then select the specific preview features you want to activate.
    • New Preview early-access track delivers two tiers — Closed Preview (invite-only feedback cohorts) and Open Preview (any eligible customer, fully supported, free) — so capabilities reach users as soon as they are production-ready.
    • Opt-in is self-serve: navigate to Settings > Preview in the MyJFrog portal, enable the Enable Preview toggle, accept the Preview Terms of Service, and activate individual preview features on your subscription.

    2 details in Everything

21. announced Aug 28, 2026 · issue 009

    JFrog launches Preview early-access track, enabling opt-in to new capabilities before GA via MyJFrog portal.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Opt in to JFrog Preview to gain immediate access to newly released capabilities before they reach general availability.
    📍In MyJFrog, go to Settings › Preview. Click the Enable Preview toggle. In the Enable JFrog Preview dialog box, open and read the Preview Terms of Service. Select the checkbox to accept the terms and conditions, and click Agree and Enable. Then select specific preview features to activate in your subscription.
    • New Preview early-access track available in two forms: Closed Preview (invite-only) and Open Preview (all eligible customers), both free with opt-in.
    • Activate Preview in the MyJFrog portal under Settings > Preview by enabling the Enable Preview toggle and accepting the Preview Terms of Service.

    2 details in Everything

22. docs update Aug 25, 2026 · issue 056

    JFrog Catalog now supports bulk package governance automation via a GraphQL API.

23. Coding Agents Just Reopened Your Software Supply Chain Blind Spot (2026-08-25) Aug 25, 2026 · issue 056

    JFrog Agent Package Resolution (preview) routes AI coding agent package downloads through Artifactory governance automatically.

    └──▷ TRY IT
    One-time project setup: bind your local package managers to Artifactory so that every subsequent agent session — and any indirect installs — resolves through the governed repository without manual configuration.
    copy

    $ jf setup

    Enable Agent Package Resolution for your team via the JFrog Agent Plugin on GitHub so Claude Code or Cursor sessions automatically receive the correct Artifactory URLs at startup.
    📍In the JFrog Platform, install the JFrog Agent Plugin from GitHub, then under Agent Package Resolution settings choose which package types (npm, PyPI, Maven, Go, Docker, Helm, NuGet) are governed, and enable zero-touch setup to push Artifactory URLs to agent sessions automatically.
    • Introduces Agent Package Resolution (preview), a feature of the JFrog Agent Plugin that routes AI coding agent dependency downloads through JFrog Artifactory instead of public registries, covering npm, PyPI, Maven, Go, Docker Hub, Helm, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code..
    • Adds session steering: at the start of each Claude Code or Cursor agent session, the plugin automatically supplies the Artifactory URL for each governed package type — no per-project configuration required.
    • Adds a jf setup command for persistent package-manager configuration that binds the local package manager to an Artifactory repository for a given project, persisting across sessions and tools.
    • Extends JFrog Curation policy enforcement server-side to all agent-driven downloads, blocking malicious packages, unapproved licenses, and policy-violating packages regardless of whether session steering or jf setup is active.
    • Covers indirect and transitive installs — postinstall scripts, pip install -r requirements.txt, npm ci, and equivalent bulk-pull commands — routing all through Artifactory from the first session.

    +1 more show less

    • Produces complete audit trails for every agent-driven download, block, and policy decision alongside existing human-driven build logs.

    6 details in Everything

24. Coding Agents Just Reopened Your Software Supply Chain Blind Spot (2026-08-25) Aug 25, 2026 · issue 009

    JFrog Agent Package Resolution (preview) routes AI coding agent package downloads through Artifactory governance automatically.

    └──▷ TRY IT
    One-time project setup: bind your local package managers to Artifactory so that every subsequent agent session — and any indirect installs — resolves through the governed repository without manual configuration.
    copy

    $ jf setup

    Enable Agent Package Resolution for your team via the JFrog Agent Plugin on GitHub so Claude Code or Cursor sessions automatically receive the correct Artifactory URLs at startup.
    📍In the JFrog Platform, install the JFrog Agent Plugin from GitHub, then under Agent Package Resolution settings choose which package types (npm, PyPI, Maven, Go, Docker, Helm, NuGet) are governed, and enable zero-touch setup to push Artifactory URLs to agent sessions automatically.
    • Introduces Agent Package Resolution (preview), a feature of the JFrog Agent Plugin that routes AI coding agent dependency downloads through JFrog Artifactory instead of public registries, covering npm, PyPI, Maven, Go, Docker Hub, Helm, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code..
    • Adds session steering: at the start of each Claude Code or Cursor agent session, the plugin automatically supplies the Artifactory URL for each governed package type — no per-project configuration required.
    • Adds a jf setup command for persistent package-manager configuration that binds the local package manager to an Artifactory repository for a given project, persisting across sessions and tools.
    • Extends JFrog Curation policy enforcement server-side to all agent-driven downloads, blocking malicious packages, unapproved licenses, and policy-violating packages regardless of whether session steering or jf setup is active.
    • Covers indirect and transitive installs — postinstall scripts, pip install -r requirements.txt, npm ci, and equivalent bulk-pull commands — routing all through Artifactory from the first session.

    +1 more show less

    • Produces complete audit trails for every agent-driven download, block, and policy decision alongside existing human-driven build logs.

    6 details in Everything

25. Introducing JFrog Platform Federation: One Control Plane for Synchronizing Every Site in Your Software Supply Chain (2026-08-24) Aug 24, 2026 · issue 060

    JFrog Platform Federation introduces a peer-to-peer mesh that syncs projects, access control, curation policies, and repositories across every site automatically.

    ⤢ ⤢

    ⤢

    ⤢
    └──▷ HOW TO FIND IT
    When a new zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. drops, set a curation blocking rule once on any peer site and have it enforced across every regional pipeline within seconds — no per-site rollout scripts needed.
    📍In the JFrog Platform UI, go to Curation › Policies, create or update a blocking rule or waiver on any peer site, and Platform Federation propagates it to every connected site in the mesh automatically.
    When onboarding a new region, define your Stage-to-Site mapping once so Automated Repository Provisioning creates the correct repositories on the new site without tickets or manual REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. calls.
    📍In the JFrog Platform UI, go to Platform Federation › Stage-to-Site Mapping, define which release stages map to which regional sites, then add the new site to the mesh — required repositories are provisioned automatically.
    • Adds Projects Federation, which synchronizes multi-tenant workspaces, project- and global-level roles, SDLCSDLCThe Software Development Life Cycle: a structured process covering planning, design, coding, testing, and deployment. Cyber tools integrate into it to catch vulnerabilities before code ships rather than after. release-stage gates, and identity access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. across every peer site in the mesh in seconds.
    • Adds Curation Federation, which propagates open-source blocking rules, waivers, and approvals from any peer site to every regional pipeline worldwide within seconds of being set.
    • Adds Automated Repository Provisioning, which creates and configures repositories on the correct sites automatically based on a Stage-to-Site mapping, eliminating per-repo and per-site manual administration.
    • Introduces a peer-to-peer mesh architecture for distributed JFrog sites, replacing hub-and-spoke and script-driven sync with autonomous, continuous background synchronization of projects, access control, policies, artifacts, and repositories.
    • Supports both self-managed and JFrog Cloud SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. sites — including airgapped and private-cloud deployments — in the same federated mesh, enabling phased SaaS migrations without breaking centralized security or identity control.

    +1 more show less

    • Provides a Federated Topology View showing the global peer mesh across regions with entities and policies synchronized in real time.

    6 details in Everything

26. announced Aug 24, 2026 · issue 060

    JFrog Platform Federation adds Projects Federation, Curation Federation, and Automated Repository Provisioning for peer-to-peer multi-site sync.

    ⤢ ⤢

    ⤢

    ⤢
    └──▷ HOW TO FIND IT
    When your security team publishes a zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. blocking rule and needs it enforced globally within seconds rather than rolling it out region by region.
    📍In the JFrog Platform, go to Curation › Policies, create or update a blocking rule or waiver on any peer site, and Platform Federation propagates it to every connected regional pipeline automatically.
    When onboarding a new region so that all required repositories appear automatically without filing tickets or running scripts for each repo.
    📍In the JFrog Platform, go to Platform Federation › Stage-to-Site Mapping, define which release stages are assigned to the new site, and Automated Repository Provisioning replicates the required repositories to that site.
    • New Automated Repository Provisioning creates and replicates repositories across sites based on a Stage-to-Site mapping, eliminating per-repo, per-site manual setup when a new site joins the mesh.
    • New JFrog Platform Federation introduces a peer-to-peer mesh architecture that connects distributed JFrog sites into a single logical control plane, replacing hub-and-spoke and script-based coordination.

    2 details in Everything

27. Propagating User Identity From AI Agents to Your Tools: Amazon Bedrock AgentCore Gateway and JFrog Artifactory (2026-08-21) Aug 21, 2026 · issue 053

    JFrog Artifactory gains On-Behalf-Of (OBO) OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. with Amazon Bedrock AgentCore Gateway for per-user AI agent identity propagation.

    ⤢ ⤢ ⤢
    • Supports On-Behalf-Of (OBO) token exchange (RFC 8693RFC 8693An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user.) between Amazon Bedrock AgentCore Gateway and JFrog Artifactory Access, so AI agent requests reach Artifactory authenticated as the originating user rather than a shared service account — preserving audit fidelity, least privilege, and containment.
    • Enables AgentCore Gateway to use JFrog Artifactory's MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server as a registered target, with onBehalfOfTokenExchangeConfig configured on the gateway target so each inbound user JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. is exchanged for a short-lived, per-user JFrog token.
    • Supports listingMode field on AgentCore Gateway targets (requires a recent AWS CLI) to enable dynamic tool listing, allowing tool discovery to run under the user's token instead of a shared credential.
    • Integrates JFrog Access OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. identity mappings with AgentCore Identity: JFrog trusts the external IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. issuer ($IDP_ISSUER) and maps verified access-token claims (e.g. preferred_username, team) to JFrog users, groups, or project roles via the JFrog OIDC integration API.
    • Requires the user's OIDC access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. aud claim to equal the AgentCore Gateway URL ($GATEWAY_URL) and iss to match $IDP_ISSUER, with a mappable identity claim (e.g. preferred_username) present on the access token — not only the ID token.

    +2 more show less

    • Compares three identity-propagation options across the gateway-to-Artifactory hop: header whitelisting (forwards X-Authenticated-User-style headers), three-legged OAuth (authorization-code grant with per-user token vault in AgentCore Identity), and On-Behalf-Of exchange — with OBO being the only option that delivers verifiable per-user identity at Artifactory without a second login.
    • Requires JFrog EnterpriseX or higher for OIDC token exchange support on the Artifactory Access service.

    7 details in Everything

28. Propagating User Identity From AI Agents to Your Tools: Amazon Bedrock AgentCore Gateway and JFrog Artifactory (2026-08-21) Aug 21, 2026 · issue 009

    JFrog Artifactory gains On-Behalf-Of (OBO) OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. with Amazon Bedrock AgentCore Gateway for per-user AI agent identity propagation.

    ⤢ ⤢ ⤢
    • Supports On-Behalf-Of (OBO) token exchange (RFC 8693RFC 8693An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user.) between Amazon Bedrock AgentCore Gateway and JFrog Artifactory Access, so AI agent requests reach Artifactory authenticated as the originating user rather than a shared service account — preserving audit fidelity, least privilege, and containment.
    • Enables AgentCore Gateway to use JFrog Artifactory's MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server as a registered target, with onBehalfOfTokenExchangeConfig configured on the gateway target so each inbound user JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. is exchanged for a short-lived, per-user JFrog token.
    • Supports listingMode field on AgentCore Gateway targets (requires a recent AWS CLI) to enable dynamic tool listing, allowing tool discovery to run under the user's token instead of a shared credential.
    • Integrates JFrog Access OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. identity mappings with AgentCore Identity: JFrog trusts the external IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. issuer ($IDP_ISSUER) and maps verified access-token claims (e.g. preferred_username, team) to JFrog users, groups, or project roles via the JFrog OIDC integration API.
    • Requires the user's OIDC access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. aud claim to equal the AgentCore Gateway URL ($GATEWAY_URL) and iss to match $IDP_ISSUER, with a mappable identity claim (e.g. preferred_username) present on the access token — not only the ID token.

    +2 more show less

    • Compares three identity-propagation options across the gateway-to-Artifactory hop: header whitelisting (forwards X-Authenticated-User-style headers), three-legged OAuth (authorization-code grant with per-user token vault in AgentCore Identity), and On-Behalf-Of exchange — with OBO being the only option that delivers verifiable per-user identity at Artifactory without a second login.
    • Requires JFrog EnterpriseX or higher for OIDC token exchange support on the Artifactory Access service.

    7 details in Everything

29. docs update Aug 19, 2026 · issue 050

    JFrog AI Assistant (Ask AI) launches with platform guidance, navigation help, and Rego policy authoring for AppTrust users.

    └──▷ HOW TO FIND IT
    Enable JFrog AI for your entire subscription so all JPDs gain access to Ask AI.
    📍In MyJFrog, go to Settings › AI, then approve the AI Addendum. JFrog AI becomes available across all your JPDs immediately.
    Require explicit per-JPD approval before AI features activate, useful for orgs that want tighter control over which environments use AI.
    📍In MyJFrog AI settings, select the Require JPD level activation checkbox. Then, in each relevant JPD, click Approve to enable JFrog AI for that JPD.
    • Introduces Ask AI, an AI-powered assistant accessible via the top bar of the JFrog Platform, able to answer how-to questions, navigate users to relevant pages and workflows, and provide contextual guidance.
    • AppTrust users can use AI to help write unified policies in Rego, making policy creation and management easier.
    • Enables JFrog AI platform-wide from MyJFrog > Settings > AI by approving the AI Addendum; Primary Admins can also require JPD-level activation via the Require JPD level activation checkbox.
    • Each user is subject to a weekly token limit for AI capabilities; no additional cost is charged unless a paid AI capability is explicitly opted into.

    4 details in Everything