Release Notes

PyPI is undergoing changes and the PyPI administrators have announced that by April 30th, the current URL at which the index is available will be deprecated, and the PyPI public repository will only be available at http://pypi.org.

In addition, the internal structure of the PyPI index is changing.

These are breaking changes if you are using Artifactory remote PyPI repositories that proxy the PyPI index at its current URL of http://pypi.python.org.

Important notes: 

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.9.3

Released: March 21, 2018

Issues Resolved

1. Fixed an issue with Artifactory instances running versions 5.9.0 and above which displayed the following behavior: in some cases certain users would not be able to login to Artifactory, retrieving the list of users through the UI or the REST API would fail with an exception, and Backups and System Exports would fail. For details, please refer to the relevant JIRA item in the link below.

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.9.5

Release: April 18, 2018

Issues Resolved

• We strongly recommend upgrading to this patch only if you are using remote PyPI repositories that proxy the public PyPI index at http://pypi.python.org
• As part of the change PyPI have introduced, the index is now located under http://pypi.org and the binaries (packages) are stored under a different URL: (https://files.pythonhosted.org). 
• In this patch, Artifactory aligns with the changes introduced on PyPI, both new index structure and the new URL.

To continue working with PyPI remote repositories, follow these instructions:

• Upgrade to Artifactory 5.9.5 or 5.10.3 and above. 
• For all Artifactory PyPI remote repositories that are configured with the URL of https://pypi.python.org
  • Change the URL field to https://pypi.org

Note: upon upgrading to this version, the Registry URL of all of the remote PyPI repositories will be set to the same value as repository's URL. 
If the index file and the binaries are stored in the same URL, you should not make any changes in these remote PyPI repositories. 

For a complete list of changes, please refer to our JIRA Release Notes.

Artifactory 5.9.7

Released: April 30, 2018

Issues Resolved

1. Fixed an issue that caused a degradation in PyPI API performance when a Derby database has node_props table containing many entries.

For a complete list of changes, please refer to our JIRA Release Notes.

Artifactory 5.9.8

Released: November 29, 2018

Issues Resolved

1.  Fixed an issue in which under certain circumstances, an unauthorized user may be able to send malformed REST API calls to Artifactory that execute under the identity of another user. JFrog would like to thank the Adobe Security Team for reporting this issue and for working with JFrog to help protect our customers.

Artifactory 5.9.9

Released: 12 March, 2019

Issue Resolved

1. Fixed an issue whereby under certain circumstances, users could gain access to security APIs that are otherwise exposed only to administrators.
   JFrog would like to thank CipherTechs for reporting this issue and for working with JFrog to help protect our customers.

Artifactory 5.8

Released: January 1, 2018

Highlights

Helm Chart Repositories

Artifactory now natively supports Helm Chart repositories, giving you full control of your deployment process to Kubernetes. You can create secure and private local Helm chart repositories with fine-grained access control. Remote Helm chart repositories proxy remote Helm chart resources and cache downloaded Helm charts to keep you independent of the network and the remote resource, and virtual Helm chart repositories give you a single URL through which to manage the resolution and deployment of all your Helm charts.

YAML Configuration File

Applying configuration changes to Artifactory can now be done using an easy to use YAML configuration file. Run a single or multiple configuration changes as needed, to create, update and delete any elements in the your Artifactory instance. For example, creating new repositories, setting up replication, and modifying any specific configuration changes. 

Multiple Secure Private Docker Registries Without a Reverse Proxy

Artifactory has supported multiple secure private Docker registries since the early days of Docker, however that support required the use of a reverse proxy. From version 5.8, the need for a reverse proxy is removed, and you can create and use multiple Docker registries out-of-the-box without the need for any reverse proxy configuration. All you need to do is select the Repository Path 

Feature Enhancements 

Automatically associate a HTTP SSO user to an LDAP Group

Artifactory will now accept users logging in through HTTP SSO to be associated with existing LDAP groups. HTTP SSO users will now inherit the permissions specified in the corresponding LDAP group in Artifactory. This is supported for both HTTP SSO users that are internally created in Artifactory and also for transient users.

Issues Resolved

1. Fixed an issue where overwriting an existing artifact would permanently delete it. These artifacts will now be sent to the trash can, available to be recovered if needed.

2. Fixed an issue in which enabling the External Dependency Rewrite configuration in npm virtual repositories, caused some npm packages, such as "equals", to not be resolved with an npm 500 error displayed in the logs. This occurred only for packages where dependencies were declared in the following format:
   https://github.com/<repo>/<...>

3. Fixed an issue where adding a keypair in the Signing Keys UI admin component, caused the remote repo admin page in the UI to appear as empty without any fields.
4. Fixed an issue with an incorrect response for cached Chef cookbooks.
5. Fixed an issue where the metadata for some PyPI packages, such as nose 1.3.3 and above, would not be extracted correctly and incorrect information would be displayed in the UI for the package. This would happen only for packages that had multiple PKG-INFO file, causing Artifactory to identify the wrong PKG-INFO package metadata file.
6. Fixed an issue in which adding more than 1,000 users to a group using Oracle DB would fail with an ‘error updating groups’ or a ‘maximum number of expressions in a list is 1000’ SQLSyntaxErrorException.
7. Fixed an issue where some Debian packages were not added to the Debian repository index.
8. Fixed an issue where running an npm search against an npm repository failed to return packages that contained the maintainers field in the package.json in the following structure:
   “maintainers” : { "name": "john", "email": "john@company.com" }
9. Fixes to remediate CVE-2017-7525 and CVE-2017-15095 vulnerabilities.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 5.8.1

Released: January 4, 2018

Issues Resolved

1. Fixed an issue in which an upgrade from versions below 5.7, to versions 5.7 and above with the Artifactory Key Encryption activated, failed with the following error:
   Couldn't convert configs encryption: javax.crypto.BadPaddingException: Given final block not properly padded : Couldn't convert configs encryption

2. Fixed an issue, for HA setups, in which an upgrade process with the following steps failed with the following error:
   Encrypted password found and no Master Key file exists at /clusterhome/ha-etc/security/artifactory.key
   Steps:
   1. upgrade to version 5.x (below 5.7), from version 4.x with NFS and the Artifactory Key Encryption deactivated
   2. upgrade to version 5.7 and above, with the Artifactory Key Encryption activated

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.8.2

Released: January 8, 2018

Issues Resolved

1. Fixed an issue with HA clusters in which in rare cases, when modifying files that are synced through the database (for example, adding/modifying user plugins, changing the Artifactory Encryption Key, or modifying Artifactory system properties), the changes would not be propagated to the secondary nodes in the cluster.

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.8.3

Released: January 9, 2018

Issues Resolved

1. Fixed an issue in which pushing or pulling from an Artifactory Docker registry would fail when using Docker client version 1.12 or below and while the reverse proxy is configured to listen on ports 443/80.

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.8.4

Released: February 7, 2018

Issues Resolved

1. Fixed an issue with Artifactory Docker registries in which in some cases, file descriptors created following a HEAD request for a Docker manifest, would not be closed at the end of the request, but only when garbage collection was run.

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.8.9

Release: April 18, 2018

Issues Resolved

• We strongly recommend upgrading to this patch only if you are using remote PyPI repositories that proxy the public PyPI index at http://pypi.python.org
• As part of the change PyPI have introduced, the index is now located under http://pypi.org and the binaries (packages) are stored under a different URL: (https://files.pythonhosted.org). 
• In this patch, Artifactory aligns with the changes introduced on PyPI, both new index structure and the new URL.

To continue working with PyPI remote repositories, follow these instructions:

• Upgrade to Artifactory 5.8.9, 5.9.5 or 5.10.3 and above. 
• For all Artifactory PyPI remote repositories that are configured with the URL of https://pypi.python.org
  • Change the URL field to https://pypi.org

Note: upon upgrading to this version, the Registry URL of all of the remote PyPI repositories will be set to the same value as repository's URL. 
If the index file and the binaries are stored in the same URL, you should not make any changes in these remote PyPI repositories. 

Additional Issues Resolved

For a complete list of changes, please refer to our JIRA Release Notes.

Artifactory 5.8.10

Released: April 30, 2018

Issues Resolved

1. Fixed an issue that caused a degradation in PyPI API performance when a Derby database has node_props table containing many entries.

For a complete list of changes, please refer to our JIRA Release Notes.

Artifactory 5.8.12

Released: November 29, 2018

Issues Resolved

1.  Fixed an issue in which under certain circumstances, an unauthorized user may be able to send malformed REST API calls to Artifactory that execute under the identity of another user. JFrog would like to thank the Adobe Security Team for reporting this issue and for working with JFrog to help protect our customers.

Artifactory 5.8.14

Released: 12 March, 2019

Issue Resolved

1. Fixed an issue whereby under certain circumstances, users could gain access to security APIs that are otherwise exposed only to administrators.
   JFrog would like to thank CipherTechs for reporting this issue and for working with JFrog to help protect our customers.
   
   

Artifactory 5.7

Released: December 20, 2017

Highlights

Improved HA Installation and Upgrade Process

The HA installation and setup process has been redesigned to create a simple and even more secure infrastructure for your Artifactory HA clusters. Through the use of a Master Key, Artifactory adds a new security layer that replaces the previously used Bootstrap bundle mechanism, which is now deprecated.

With this release, Artifactory will handle all configuration and encrypted security related files. To create new Artifactory nodes in a cluster, administrators will only need to supply a single Master Key and db.properties file, used by all nodes in the cluster.

Existing Artifactory installations will be upgraded to this new infrastructure automatically when updating from version 5.x and up.

Sort, Filter and Add Favorite Repositories in the UI Tree

View only the repositories you need by customizing the Artifact Repository Browser with your favorite repositories, and applying sort and filter options. Use as many different favorite, sort and filter combinations to narrow down the Artifact tree to display exactly what you need.

Feature Enhancements

Promote Build to Virtual Repository REST API

Promoting builds to a virtual repository is now supported, in addition to the previously supported local repositories, using the Build Promotion REST API. Upon build promotion to a virtual repository, the files will be promoted (copied/moved) to the Default Deployment Repository that is configured as part of the virtual repository. 

Support for AWS SSE-KMS

Added support for AWS SSE-KMS (Key Management Service) for your S3 Object Storage. This allows you to set an AWS KMS encryption key on the S3 bucket that your Artifactory uses as an object store.

Support for LZMA and XZ Index Compression Formats in Debian Repositories

Artifactory now lets you create LZMA (.lzma) and XZ (.xz) compression Debian indices, in addition to the already supported Gzip (.gzip) and Bzip2 (.bz2) extensions. The Bzip2 index file can be disabled if it's not needed.

Improved AQL Performance

Significant performance improvement for AQL queries when searching artifacts according to build name and number.

Improved Concurrent Configuration Changes Performance

Performance improvement when concurrently applying configuration changes to the Config Descriptor file. 

Issues Resolved

1. Fixed an issue in which users, associated with groups that are configured with admin privileges, could not perform admin-only actions through REST API when using an API key for authentication.

2. Fixed an issue in which deploying a large NuGet package (larger than 2GB) would fail with an OutOfMemory exception.

3. Fixed an issue in which TCP connections were not being closed when push replication was configured with an incorrect target URL or bad credentials, causing unresponsiveness. The TCP connections were not being closed on the source Artifactory (the instance where artifacts were replicated from).

4. Fixed an issue where when clients (such as Yum clients) tried to fetch sqlite.bz2 files from Yum virtual repositories, it took longer than expected since it triggered a synchronous calculation, even though Artifactory does not aggregate sqlite files. Artifactory responses to YUM clients in returning sqlite.bz2 files will now be faster.
5. Fixed an issue where the email address of users imported into Artifactory from a Crowd server was not updated in Artifactory when it was updated on the Crowd server.
6. Fixed an issue in which resolving artifacts from a remote repository with a URL that contained spaces in it did not work.
7. Fixed an issue when aborted upload processes, to an Artifactory with a filestore configuration on the cloud (S3/GCP/Azure), would leave a partial file in the Eventual folder that would not get cleaned up.
8. Fixed an issue in which an API key created by exernally authenticated users (eg. OAuth) would not get inserted correctly into code snippets generated by the Set Me Up page.
9. Fixed an issue with the indexing rpm metadata files which caused clients (such as Yum clients) to fetch the src.rpm file instead of the rpm package file. This would happen when the RPM repository contained both source and corresponding package.
10. Fixed an issue where "NA" was recorded in the access log instead of the user id for denied login attempts. The user id will now be displayed.
    For example: [DENIED LOGIN] for john/0:0:0:0:0:0:0:1
11. Fixed an issue in which include and exclude patterns would be ignored on local NuGet repositories.
12. Fixed an issue in which deploying files that contained a colon in the artifact name, ‘:’ or %3a (encoded or decoded), would fail with an 409 error.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 5.7.1

Released: December 22, 2017

Issues Resolved

1. Fixed an issue in which, when upgrading to version 5.7.0, if you have more than 2 Docker repositories that are configured using the ports method, an exception is generated during the upgrade process. Artifactory does start up, but you are unable to save the configuration descriptor unless you remove the configuration.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 5.7.2

Released: December 24, 2017

Issues Resolved

1. Fixed an issue that prevented upgrading to version 5.7.x with an MS SQL database (version 2014 and below) when you have an artifact with a property and value whose combined length is greater than 900 characters.

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.7.3

Released: November 29, 2018

Issues Resolved

1.  Fixed an issue in which under certain circumstances, an unauthorized user may be able to send malformed REST API calls to Artifactory that execute under the identity of another user. JFrog would like to thank the Adobe Security Team for reporting this issue and for working with JFrog to help protect our customers.

Artifactory 5.7.4

Released: 12 March, 2019

Issue Resolved

1. Fixed an issue whereby under certain circumstances, users could gain access to security APIs that are otherwise exposed only to administrators.
   JFrog would like to thank CipherTechs for reporting this issue and for working with JFrog to help protect our customers.

Artifactory 5.6

Released: November 15, 2017

Upgrade Notice

Highlights

Improved Debian Performance

Significant improvement in performance when indexing Debian repositories.

Feature Enhancements

Tomcat Version Upgrade

The Tomcat bundled with Artifactory has been upgraded to version 8.5.23. 

Get Distribution Repository Details

The Get Repositories REST API now also includes distribution repositories. To get the distribution repositories details only, you can add type=distribution as a query param. 

UI Performance Improvement

Performance of displaying the environment and system variables data in the Builds module in the UI has been significantly improved.

Downloading a Folder for Anonymous Users 

Admin users can now also enable folder download configuration for anonymous users, in addition to internal users.

Limit REST API Search Results

Added the ability to limit the number of API search results for internal users, previously available only for anonymous users. To add a limit, edit the artifactory.system.properties file with artifactory.search.limitAnonymousUsersOnly=false (default is true), and a limit artifactory.search.userQueryLimit  (default is 1000).

Filter Expirable Access Tokens

Added an option to filter the expirable tokens in the Access Tokens page in the Artifactory UI. 

Issues Resolved

1. Fixed an issue allowing unsupported special characters to be used in the key field when adding properties via REST API, as already enforced in the UI.
   The following characters are forbidden: )(}{][*+^$\/~`!@#%&<>;=,±§ and the Space character.

2. Fixed an issue where a file with the same filename and filepath of a file that was previously deleted, could not be deleted a second time. For this scenario, the latest file deleted will now be under the file path in the trash.

3. Fixed an issue where NuGet package names containing a hyphen character "-" would be automatically considered as pre-release packages which allowed users without Delete/Overwrite permissions to overwrite them.
   For example: Sample-Package.1.0.0.nupkg
   Artifactory is now aligned with the NuGet spec, and these packages will only be considered as pre-release if the hyphen character follows the version number.
   For example: Sample-Package.1.0.0-RC.nupkg

4. Fixed an issue where installing an npm package, with the following date format (2010-11-09T23:36:08Z) in its metadata file, would fail with an IllegalArgumentException.

5. Fixed an issue in which installing an npm package from a virtual repository would fail if the package did not have the time closure in the package.json.
6. Fixed an issue in which users imported from Crowd and associated to a group with admin privilages would be created in Artifactory with the “Can Update Profile” option disabled. This option will now be enabled for this usecase.
7. Fixed an issue in which users associated to a group imported from SAML and associated with admin privileges were not granted the appropriate admin privilages.

8. Fixed an issue where uploading a Conan package that contains declared environment variables with the "=" character, the package would be deployed without its metadata.
   For Example: conan install lib/1.0@user/stable -e MYFLAG="one==tricky==value" --build

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 5.6.1

Released: November 22, 2017

Issues Resolved

1. Fixed an issue in which a single-phase upgrade of an HA cluster with downtime (by adding the artifactory.upgrade.allowAnyUpgrade.forVersion system property) from a version below 5.0 directly to version 5.6.0 would fail. Note that the recommended two-phase upgrade with zero downtime was not affected.  

2. Fixed an issue in which when logging into Artifactory, if the group name sent in a SAML assertion as a SAML attribute was in mixed-case (i.e., at least one character is not lower-case), and the corresponding group in Artifactory was all in lower case, then the SAML user would not inherit the permissions associated with that group. This affected both internal groups and imported LDAP groups.

3. Fixed an issue in which running apt-get update on Ubuntu Trusty (14.04) against Debian repositories would fail with the following error: 
   Sub-process https received a segmentation fault

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.6.2

Released: November 27, 2017

Issues Resolved

1. Fixed a critical issue in which a user would sometimes lose permissions due to a collision between an update action and a "GET" operation that occurred concurrently.

2. Fixed an issue that prevented connection to Artifactory through SSH. This also resulted in JFrog CLI not being able to work with Artifactory.

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.6.3

Released: December 18, 2017

Issues Resolved

1. Fixed an issue in which deployment of an artifact which already existed in Artifactory would result in its SHA-256 value being null. This would cause the indexing of repository types like Debian and Git LFS to be incorrect since they rely on artifacts' SHA-256 value.

2. Fixed a performance issue in which users being authenticated via external means (e.g. LDAP) would sometimes experience unusually long authentication time due to a large number of database queries causing an increased load on the database.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 5.6.8

Released: November 29, 2018

Issues Resolved

1.  Fixed an issue in which under certain circumstances, an unauthorized user may be able to send malformed REST API calls to Artifactory that execute under the identity of another user. JFrog would like to thank the Adobe Security Team for reporting this issue and for working with JFrog to help protect our customers.

Artifactory 5.6.9

Released: 12 March, 2019

Issue Resolved

1. Fixed an issue whereby under certain circumstances, users could gain access to security APIs that are otherwise exposed only to administrators.
   JFrog would like to thank CipherTechs for reporting this issue and for working with JFrog to help protect our customers.

Artifactory 5.5

Released: September 25, 2017

Due to a critical issue discovered in this version, you should not install it. Instead, you should upgrade to version 5.5.1 or later.

Upgrade Notice 

Highlights

Event-based Pull Replication

JFrog Artifactory now supports event based pull replication, in addition to the already supported event based push replication. This configuration allows your remote Artifactory instances get updated in near-real-time by a pull replication that's triggered by any changes made to your local repositories, such as new or deleted artifacts. This is great for automation purposes where you want to make your artifacts available in all of your instances as soon as they are deployed.

As a best practice, setting a Cron expression for regularly scheduled replication is still required in addition to event-based replication. This will ensure that all of the artifacts in your repository are synced and up to date, which is important in case of an event sync failure (for example, due to maintenance operations).

Native Support for SHA-256 Checksums

Artifactory now supports SHA-256 checksums. This improved algorithm to calculate checksums enables a more secure environment for your binaries letting you use SHA-256 checksums to validate the integrity of downloaded artifacts. You can also use the SHA-256 value for a variety of features as described in SHA-256 Support. Whenever a new artifact is deployed, in addition to automatically calculating its MD5 and SHA1 checksums, Artifactory will now also calculate and store its SHA-256 checksum. The SHA-256 value can be used when searching for artifacts, or displayed as output for AQL queries in the same way SHA1 and MD5 checksums are used from both the UI and the REST API.

From version 5.5, Artifactory will automatically calculate the SHA-256 checksums for new artifacts deployed to your instance. . Depending on the number of artifacts in your system, this process may take some time. To help you monitor the process, progress and status messages will be printed to a dedicated log file, sha256_migration.log, with some additional general messages to the artifactory.log file.

To maintain backward compatibility with existing scripts, the Set Item SHA256 Checksum REST API endpoint is still supported. 

Feature Enhancements

Improve Performance on RPM Repositories

The performance of metadata calculation on RPM repositories has been significantly enhanced by performing different metadata calculations in parallel making resolving and deploying packages with RPM repositories much faster. 

Improve Performance of NuGet Repositories

NuGet repository performance has been significantly improved when resolving dependencies or searching for artifacts. The improved performance is especially significant for repositories that host many artifacts. 

Keep Multiple Versions of  Metadata Files on RPM Repositories

Artifactory will now maintain previous metadata file versions on RPM repositories (primary, other, filelists) making them available for download while new ones are being generated.

This is very useful when RPM metadata is updated very frequently. If a client working with an Artifactory RPM repository downloads the repomd.xml file, and the rest of the metadata files (primary, other, filelists) expire in the meantime, the expired version of these files will still be available allowing the client to complete the required download.

Retrieve Plugin Source Code by Name

Artifactory now provides access to the Groovy source code of user plugins through the Retrieve Plugin Code REST API endpoint.  

Allow LDAP Users to Access Profile Page

You can now configure Artifactory to allow new users who are created by logging in via LDAP to be able to access their profile page. This means that these users can now access a set of functions such as generating their API key, setting their SSH public key, configuring their JFrog Bintray credentials, and updating their password. 

Support Additional MIME types in the UI

Artifactory now supports additional MIME types to allow viewing .log, .yml and .yaml files directly in the UI (as opposed to having to download them first). These file types are now added to the preconfigured mimetypes.xml file. 

Enable Password Encryption by Default

For new Artifactory installations, Artifactory automatically generates a Master Encryption Key and then uses it to encrypt all passwords hosted on the instance. Decrypting passwords and encrypting them back is possible through the REST API. 

To maintain consistent behavior for existing installations, upgrading to this new version will not automatically encrypt passwords.

Configurable Web Session Timeout

You can now configure Artifactory's UI session timeout using the artifactory.ui.session.timeout.minutes system property.

Checksum-Based Storage with S3 Object Store

Artifactory's checksum-based storage stores files in folders named after the first two characters of their checksum. When using S3 object storage, this feature has been enhanced allowing you to configure the number of characters that should be used to name the folder. For example, you can configure your S3 binary provider to store objects under folders named after the first 4 characters of their checksum. 

Issues Resolved

1. Fixed an issue in which Artifactory would return an error when trying to resolve an npm package because it would fail to parse an npm dependency declaration that was presented in an unexpected format.
2. Fixed an issue in which the Set Me Up screen for virtual repositories that aggregated only remote repositories would be blank.
3. Fixed an issue that caused batch download from a virtual Git LFS repository, that aggregated more than one repository, to fail.
4. Fixed an issue in which the Build Artifacts Search REST API endpoint would not return Artifacts that had been promoted to it from a different repository correctly.
5. Fixed an issue in which resolving private Docker images from a Docker remote repository that points to Docker hub failed when passwords in Artifactory were encrypted.
6. Fixed an issue in which NuGet virtual repositories that aggregated several repositories would omit results when searching for a package.
7. Fixed an issue that would sometimes cause a NullPointerException to be thrown when there were many deployments on a Maven repository that had a watch configured on it. The NullPointerException would cause metadata calculation to stop and was due to the multiple deployments causing a race condition.  

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.5.1

Released: September 26, 2017

This version replaces version 5.5.0 in which a critical issues was discovered.

Upgrade Notice 

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.4

Released: June 20, 2017

Highlights

Access Tokens as a Separate Service

The management of Access Tokens, which were introduced in Artifactory 5.0, has moved to a separate service named Access. which is installed as a separate web application. This change has no impact on how access tokens are used, however, the Artifactory installation file structure now also includes an added WAR file, access.war, under the $ARTIFACTORY_HOME/webapps folder. Artifactory communicates with the Access Service over HTTP and assumes it is running in the same Tomcat using the context path of "access". 

Using access tokens through the new Access service is backwards compatible, so tokens created with earlier versions can be used for authentication with this latest version of Artifactory.

Breaking Change: Note that the change is not forwards compatible, so tokens created from version 5.4 and above cannot be used for authentication with versions previous to 5.4. This may impact a circle of trust in which some instances are running versions below 5.4 while others are running version 5.4 and above.

Support for Microsoft Azure Blob Storage

JFrog Artifactory now supports Azure Blob Storage as a new object storage provider to store artifacts. Azure Blob Storage offers massively scalable enterprise storage for Artifactory supporting unstructured data of any type with strong consistency, object mutability, geo-redundancy and more. This new option opens up the opportunity to co-locate Artifactory and its storage together with all the other services that you use on the Microsoft Azure platform.

Secure Connection to Remote Repositories via SSL/TLS Client Certificates

Artifactory now supports client certificates for remote repositories facilitating secure connections with remote resources that require them (e.g., Red Hat Network that requires a Red Hat client certificate for authentication). This means that Artifactory will now be able to send the client certificate when attempting to connect to the remote resource over HTTPS.  

Feature Enhancements

1. RPM repositories have been enhanced to give you control over whether the RPM file lists metadata file should be indexed by Artifactory or not. Disabling indexing of the file lists metadata improves the performance of RPM repositories with many artifacts when different clients try to resolve packages from the repository. Note that for new RPM repositories, indexing the file lists metadata file is disabled by default, however, when upgrading from previous versions to 5.4.0 and above, indexing for RPM repositories that already existed will remain enabled to maintain consistent behavior with the previous version.
2. Artifactory now supports the  npm login command as a way to authenticate the NPM client. Basic authentication is also still supported. 
3. Previously, Artifactory was not able handle decoded slash characters in NPM scoped packages, so you had to modify your reverse proxy so that it wouldn't decode the slash. Artifactory now handles decoded slash characters correctly out-of-the-box, so there is no longer any need to modify your reverse proxy.  
4. Artifactory can now be configured to add Debian packages' MD5 checksum to the Packages metadata file in order to comply with the requirement of some tools (e.g. Aptly) that the MD5 is available for validation of the package.
5. The Control Build Retention REST API endpoint now accepts a query param to make deleting old builds an asynchronous process. When set, the API response acknowledges the request and outputs errors, if any, to the log. 
6. The default value of the lenientLimit parameter for a Sharding-Cluster Binary Provider has been modified to be 1. This will allow users to continue uploading to a cluster node even if it is the only active node without having to reconfigure this parameter. Note that for filestores configured with a custom chain, the lenientLimit parameter will remain 0 to maintain consistency with previous versions. Therefore, the lenientLimit parameter will only default to 1 when using built-in templates. 
7. Using the Create Token REST API endpoint, access tokens can now be created to provide the same access privileges that are given to the group of which the logged in user is a member. 

Issues Resolved

1. Fixed an issue in which performing a full system import on an Artifactory HA cluster would fail. The full system import on an Artifactory HA cluster has been changed and is fully described under System Import and Export for an HA Cluster.
2. Fixed an issue in which Python metadata calculation would fail if the metadata version in the METADATA or PKG-INFO files was set to 1.2.
3. Fixed an issue in which when Enable Dependency Rewrite was enabled for NPM repositories, Artifactory would only rewrite dependencies specified in the "dependencies" element of the package.json file and would skip the dependencies listed in the optionalDependencies and devDependencies elements.
4. Fixed an issue in which Artifactory would fail to install npm packages that contained square brackets ('[' or ']') in the "description" field of the package.json file. 
5. Fixed an issue in which externally authenticated users (i.e. those not created in Artifactory) logging in through an external provider (e.g. LDAP) would not be able to complete artifact downloads that took a long time since the LDAP token used for authentication with Artifactory would expire. This was fixed by exposing the artifactory.artifactory.tokens.cache.idleTimeSecs system property that managed this timeout and increasing its default value from 5 minutes to 10 minutes. 

6. Fixed an issue in which existing repositories enabled for indexing by JFrog Xray did not trigger indexing automatically and required you to manually trigger indexing through the JFrog Xray UI or using the REST API. 

7. Fixed an issue in which using mvn site-deploy with the maven-site-plugin to upload a site to Artifactory would fail when the site's URL contained a dot ('.') in its path (e.g. libs-snapshot-local/./file.jar)

8. Fixed an issue in which NuGet virtual repositories that aggregated more than one local or remote repository would omit results or return duplicate results when searching for a package.

9. Fixed an issue in which Artifactory 5.x would not display certain builds in the UI because it failed to parse dates presented in  ISO 8601format (e.g. 2016-09-08T21:02:17.781+03:00)

10. Fixed an issue in which upload to a repository would fail, if an event-based replication defined for the repository failed for any reason. Following the fix, uploading a file to the repository succeeds even if replication fails.
    

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.4.1

Released: June 22, 2017

Issues Resolved

1. Fixed an issue in which the schema version of a Docker image manifest would change from 2 to 1 when the image was distributed from Artifactory to JFrog Bintray.
2. Fixed an issue that caused batch downloads from a virtual Git LFS repository that aggregated both local and remote repositories to fail. 
   This happened when Artifactory would find one of the files in an aggregated local repository (and therefore should have stopped searching for it), but would still go on to search for it in the aggregated remote repositories. If the file did not exist in any of the remote repositories, Artifactory would not serve the file.

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.4.2

Released: June 30, 2017

Issues Resolved

1. Fixed an issue in which Artifactory failed to start up when Tomcat was configured to only serve HTTPS content, or was configured to serve both HTTP and HTTPS, but on different ports.
2. Fixed an issue in which when an Artifactory HA installation's filestore configuration used the eventual-cluster binary provider (for example, when using one of the cloud storage providers), in rare cases, when uploading files involving a large number of transactions, Artifactory would indicate that files were successfully uploaded to storage, when in fact, the uploads failed.
3. Fixed an issue in which Artifactory was unable to connect to the Access Service (and as a result failed to start) when Tomcat was configured with a self signed chain certificate.

For a complete list of changes please refer to our  JIRA Release Notes.

Artifactory 5.4.3

Released: July 3, 2017

Issues Resolved

1. Fixed an issue in which uploading or downloading files to Artifactory using access tokens may have failed with error 500. This happened when running Artifactory 5.4.2 and using access tokens with a subject that was longer than 64 characters.
2. Fixed an issue in which upgrading an RPM or Debian installation of Artifactory that use the systemd init system would have fail with a “The currently installed Artifactory version does not have the same layout as this DEB!” error.

For a complete list of changes please refer to our  JIRA Release Notes.

Artifactory 5.4.4

Released: July 6, 2017

1. Fixed an issue in which after upgrading an Artifactory HA cluster from version 5.x to 5.4.x, new nodes that were added to the Artifactory HA cluster would not start up.

For a complete list of changes please refer to our  JIRA Release Notes.

Artifactory 5.4.5

Released: July 18, 2017

Highlights

Puppet Repositories Support librarian-puppet and r10k

Artifactory's support for Puppet repositories has been significantly upgraded by introducing support for librarian-puppet and r10k  allowing extended configuration management with these popular Puppet clients. In addition, Artifactory also exposes new REST API endpoints to retrieve Puppet modules and releases to facilitate automated configuration management using Puppet.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 5.4.6

Released: August 7, 2017

Feature Enhancements

Support Pagination for Docker v2 APIs

Artifactory now supports pagination when listing Docker image tags and retrieving a registry's catalog using the REST API.
This can be useful for automation purposes and Docker clients that use pagination parameters.

Issues Resolved

1. Fixed an issue in which when resolving a package from an npm repository, Artifactory would throw a deserialize error to the log file if one of the package's dependencies in the corresponding package.json file was declared using the following format:“<dependency_name>” : { “version” : “<version_number>” }.
   For example: the "deep-diff" package uses this format. As a result, the npm client would fail to resolve the package.

2. Fixed an issue that prevented using Git LFS client v1.x with Git LFS repositories in Artifactory when using SSH. 
   

3. Fixed an issue in which NuGet virtual repositories that aggregated several repositories would omit search results when searching for a package.
   
   

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.3

Released: May 11, 2017

Due to a critical issue, if you are upgrading from a version below 4.4.1 directly to version 5.3, Artifactory will fail to start up. A patch has been released, and if your current version is below 4.4.1 you should upgrade to Artifactory 5.3.1. 

Highlights

Grant Admin Privileges to a Group of Users

Artifactory now supports granting Admin privileges to a group of users which greatly improves the user experience since previously you could only provide Admin privileges to users individually. 

This allows you to import a group from your LDAP or Crowd server and grant Admin privileges to the whole group in a single action. 

Automatically Associate a SAML SSO User to an Artifactory Group

Artifactory will now accept a custom SAML attribute that can be mapped to existing groups (including imported LDAP groups). If a SAML user has the custom SAML attribute he will now inherit the permission specified in the corresponding group in Artifactory for the current login session. 

Feature Enhancements

1. Performance of displaying data in the Builds module in Artifactory UI has been significantly improved. This creates a much better user experience, especially for Artifactory instances with many builds or when viewing a project with many builds. 
2. When importing users via SAML SSO, the users' email addresses are now also fetched and populate the corresponding field in their Artifactory user profile.
3. The installation script that installs Artifactory as a service has been enhanced to use systemd on Linux distributions that support it. The script will automatically detect if systemd is supported, and if not, will use init.d as currently implemented.
4. In the Tree Browser, when selecting the Effective Permissions tab for the selected repository, you may now view the permission targets associated with that repository.
5. Previously, virtual repositories would only provide a General tab with basic information about selected artifacts. Now, virtual repositories provide additional tabs that show all data about artifacts selected similar to the data that is provided when selecting the artifacts directly from the aggregated local or remote repositories.

Issues Resolved

1. Fixed an issue that prevented using Git LFS client v2.x with Git LFS repositories in Artifactory when using SSH.  

2. Fixed a resource leak that was introduced when "Enable Dependency Rewrite" was enabled in virtual NPM repositories. This issue may have caused depletion of different resources such as open file handles, database connections and storage streams.

3. Fixed an issue that prevented pushing or pulling Docker images that had foreign layers when the image also had a "history" field in its config.json file.

4. Fixed an issue that caused a login failure when the "List Contents" permission in Active Directory was enabled for an Admin, but not for the user that was attempting to log in.

5. Fixed an issue related to Maven repositories in which the wrong artifact may have been retrieved for a download request since Artifactory did not consider the full path beyond the GAV coordinates.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 5.3.1

Released: May 24, 2017

Highlights

This is a patch that fixes a critical issue that was discovered in version 5.3.0 in which after upgrading from a version below Artifactory 4.4.1 directly to Artifactory 5.3.0, Artifactory failed to start up.

Note that this issue did not affect upgrades from Artifactory 4.4.1 and above.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 5.3.2

Released: June 7, 2017

Issues Resolved

1. Fixed an issue in which, when upgrading an Artifactory HA cluster with 2 or more nodes, from version 5.x to version 5.3.x, Artifactory would throw a HazelcastSerializationException when displaying the UI. In the process of upgrading the cluster, you will still encounter this issue from nodes that have not yet been upgraded. 

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.2

Released: March 28, 2017

Main Updates

1. Improved the performance of property search when using PostgreSQL. 
   This will significantly improve Docker operations on Artifactory Docker registries as the property search mechanism is used upon searching for Docker layers.

2. Improved the performance of Docker layers search mechanism on Artifactory Docker registries. This will be mostly significant when working with Docker layers that are being used by thousands of Docker images.
3. The Tomcat bundled with Artifactory has been upgraded to version 8.0.41.
   
4. Artifactory now regards the content.xml.xz and the artifacts.xml.xz files on a remote P2 repository as expirable resources, so whenever there is a metadata change in one of these files, Artifactory will use the updated file instead of the expired one. 
5. When working with Conan repositories, Artifactory now supports variables with multiple values in the conanfile.txt file. This enables Artifactory to fully extract [env] variables with multiple values and assign all those values to the corresponding property annotating the package in Artifactory.
6. Fixed an issue in which deploying multiple files to a virtual repository through the UI would fail. 
7. Fixed a bug related to remote Docker registries in Artifactory that left connections and input streams open following docker pull operations. 
   
8. Fixed an issue related to Debian repositories. Artifactory now adds an empty line at the end of the Packages file to fully support Debian tools such as debootstrap. 
9. Fixed an issue related to Debian repositories in which the Components section in the generated Release file was named "Component" when there was indeed only one component. This has been fixed by naming the section "Components", regardless of the number of components. Following the fix, Artifactory now fully support tools such as debootstrap. 
10. Fixed an issue occurring in Artifactory HA clusters. When a node was stopped for any reason, its state as reported by the UI remained as Running. This has now been fixed so the state for a stopped node is displayed as Unavailable.
    

For a complete list of changes please refer to our  JIRA Release Notes.

Artifactory 5.2.1

Released: April 13, 2017

Highlights

Access Tokens

Authentication using access tokens has undergone two significant enhancements. 

1. Any valid user in Artifactory can now create access tokens for personal use whereas previously only an Artifactory admin could create access tokens. This removes the burden of creating and managing access tokens for all users from the admin's shoulder, and gives non-admin users more freedom to operate within their ecosystem.
2. An Artifactory administrator can now create access tokens with admin privileges whereas previously, access privileges were specified by inclusion in different groups. This enhances the integration of external applications which may need admin privileges to work seamlessly with Artifactory.

Feature Enhancements

1. When upgrading an Artifactory HA installation from version 4.x to version 5.x, managing the bootstrap bundle has been improved to become an automatic and seamless process. Artifactory will now create the bootstrap bundle on the primary node automatically, and extract it to the secondary nodes, so there is no longer any need to create and copy the bootstrap bundle manually. 

2. Control Build Retention : A new REST endpoint that lets you specify parameters for build retention has been added. Previously build retention could only be specified when uploading new build info. This enhancement provides an easy way to configure cleanup procedures for different jobs, and reduces the risk of timing out when deploying heavy build info.

3. By default, the "latest" version of an NPM package is the one with the highest SemVer version number. NPM repositories have now been enhanced so you can override the default behavior by setting a system property to assign a "latest" tag to the package that was most recently uploaded.  
4. The Artifactory Docker image now comes with the PostgreSQL driver built in, so there is no need to mount it separately or build it into a separate Docker image. 

Issues Resolved

1. Artifactory is now aligned with the Docker spec and returns an authentication challenge for each Docker endpoint (even when anonymous access is enabled). This means that when using internal Artifactory Docker endpoints, you must first retrieve an authentication token which must then be used for all subsequent calls by your Docker client. 
   

2. Fixed an issue in which NuGet virtual repositories that aggregated more than one local or remote repository may have omitted results when searching for a package.

3. When an Artifactory user with no "Delete" permissions was trying to deploy a build while specifying build retention, Artifactory would try and delete old builds and return a 500 error. This has now been fixed, and Artifactory will, instead, return a 403 error.

4. Fixed an issue in which Artifactory failed to pull a Docker image according to the digest of the manifest file from a remote Docker registry. 
5. Fixed an issue in which aborting a download of a folder as an archive could leave open connections that were not closed which in turn would prevent further download of folders. 
   This has now been fixed so download slots are freed and the connection is closed properly. 

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 5.1

Released: February 21, 2017

Configuration Management with Chef

Artifactory meets the heart of DevOps adding full support for configuration management with Chef. Share and distribute proprietary Cookbooks in local Chef Cookbook repositories, and proxy remote Chef supermarkets and cache remote cookbooks locally with remote repositories. Virtual Cookbook repositories let you access multiple Cookbook repositories through a single URL overcoming the limitation of the Knife client that can only access one repository at a time.

Configuration Management with Puppet

Artifactory now also fully supports configuration management with Puppet. Use local Puppet repositories to share and distribute proprietary Puppet modules, and use remote Puppet repositories to proxy and cache Puppet Forge and other remote Puppet resources. Use a virtual Puppet repository so the Puppet client can access multiple repositories from a single URL. 

Main Updates

1. Support configuration management with Chef through Chef Cookbook repositories. Artifactory fully supports the Knife client for authenticated access, and also supports Berkshelf for anonymous access. Authenticated access for Berkshelf will be added in a forthcoming release. 
2. Support configuration management with Puppet through Puppet repositories. Full support for Puppet command line along with local, remote and virtual repositories for hosting and provisioning Puppet modules. 
3. For Artifactory administrators, a list of common actions is available from the top ribbon in the Artifactory UI for quick and easy access. This makes it easy to do things like creating repositories, adding users, adding groups and more. 
4. Artifactory can now be run as a standalone instance in a Kubernetes cluster. For details, please refer to JFrog's examples using Docker on GitHub.
5. Artifactory now supports disabling UI access (i.e. the user may only access Artifactory through the REST API) through the addition of the disableUIAccess element in the Security Configuration JSON.  
6. The default order of repository types in the tree browser has been changed to show virtual and distribution repositories first, as these are accessed more frequently, and then local and remote repositories.
7. Modified NGINX reverse proxy configuration generated by Artifactory to enable using NPM scoped packages. 
8. A performance issue with the login and logout procedure has been fixed, so the time to login or logout is now significantly reduced.
9. A bug in which duplicate files simultaneously uploaded to a sharded filestore occasionally caused deletion of the files, was fixed.
10. A bug in permissions management that disabled the Admin module after removing the default "Anything" and "Anonymous" permissions, was fixed.
11. Fixed an issue when upgrading Artifactory 4.x to 5.x in which the IAM role settings for S3 object storage in the binarystore.xml were not correctly migrated to the upgrade has been fixed.

For a complete list of changes please refer to our JIRA Release Notes

Artifactory 5.1.2

Released: March 8, 2017

Note: Due to a critical issue found when uploading files larger than 100MB to S3 compatible storage, this version has been removed from JFrog Bintray.

Main Updates

1. Fixed a performance issue related to the "Most Downloaded Artifacts" widget on the Artifactory Home Page which, when refreshed, could cause the Artifactory database to stall on instances with a large number of artifacts.

2. Added support for Conan client v0.20.0 which includes a new section in the conanfile to allow adding environment variables and custom properties. These are indexed in Artifactory as properties and can be used in searches.

3. Improved performance of queries for artifacts which include an underscore character ("_") in their name. This is especially important for resolution of Docker images since all Docker layers include an underscore in the layer name.

For a complete list of changes please refer to our  JIRA Release Notes. 

Artifactory 5.1.3

Released: March 9, 2017

Main Updates

1. Fixed issue related to uploading files larger than 100MB to S3 bucket.

2. Fixed issue causing display wrong information in “Most Downloaded Artifacts” when working with OraleDB.

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 5.1.4

Released: March 19, 2017

Main Updates

1. Fixed an issue preventing Artifactory from starting up following an upgrade to version 5.x on Windows when Artifactory is configured with a Keystore. 

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 5.0

Released: January 31, 2017 

Improvements in Artifactory HA

• Cloud Native Storage: Artifactory HA infrastructure has undergone significant changes and now fully supports cloud native storage. We have completely removed the requirement for using a Network File System (NFS). This release introduces a new type of binary provider that manages distribution of files and configuration across the cluster nodes. This new functionality supports scaling out your storage by relying on object storage solutions or using the nodes' filesystem without the limitations of a traditional NFS, while enjoying other benefits such as distributed storage and redundancy.
• Removal of Sticky Sessions: Artifactory no longer requires that the load balancer used in the Artifactory HA network configuration support session affinity (sticky sessions). You may need to change or remove NGINX configurations that related to sticky sessions.
• Cluster License Management: Managing licenses for an Artifactory HA cluster is much simpler in Artifactory 5.x. Instead of registering a license per node, just upload all your cluster license keys to any cluster node, and Artifactory will transparently allocate them as new nodes are added to and removed from the cluster. This allows automatic provisioning of cluster nodes without the need to deal with manually assigning a license for each node. 

Compatibility with JFrog Mission Control

If you are managing your Artifactory licenses through JFrog Mission Control, Cluster License Management will also be supported in Mission Control, starting from version 1.8, scheduled for release with the next release of Artifactory which is scheduled for February 2017.

To perform a clean installation of Artifactory HA, please refer to HA Installation and Setup.

To upgrade your current installation of Artifactory HA, please refer to Upgrading Artifactory HA.

Running Artifactory as a Docker Container

Installing and running the Artifactory Docker image has been greatly simplified. Essentially it is now a matter of running docker pull and then docker run, while passing in mounted volumes to maintain persistence. 

Access Tokens

Artifactory 5.0 introduces access tokens as a new and flexible means of authentication allowing cross-instance authentication, authenticating both users and non-users, providing time-based access control and group-level access control. 

Enriched and Simplified Onboarding Experience

When starting up for the first time, Artifactory presents two new ways to get you through basic setup and configuration so you can get started immediately. The first is the Onboarding Wizard that creates default repositories for package types you select, sets up a reverse proxy, sets the Admin password and more. The second is a YAML Configuration File in which you can configure the same parameters that the wizard is used for. For example, once you have configured your first instance of Artifactory through the Onboarding Wizard, you can generate the YAML Configuration File from it and use that to spin up additional instances with the same initial configuration.

New Home Screen

The Artifactory Home Screen has been completely redesigned in version 5.0. The new Home Screen provides quick and easy access to some of the most common actions taken by users including searching for artifacts using any of the search methods available, creating new repositories, displaying the "Set Me Up" dialog for any repository, showing information on the latest builds and downloaded artifacts and more.

Breaking Changes

Artifactory HA Infrastructure has Undergone Several Changes

• Removal of NFS requirement: Previously, Artifactory HA required setting up a mount that was used by the $CLUSTER_HOME folder to synchronize configuration and binary files between the cluster nodes. This requirement is now removed. Configuration files are maintained in the database, and binaries may be stored on alternative storage such as local storage on each node or on a cloud storage provider.  To learn how to migrate your filestore from NFS to alternative storage, please refer to Migrating Data from NFS.
• Bootstrap Bundle: When setting up an HA cluster, you need to create a bootstrap bundle on the primary node, and then copy it to each secondary node you add to the cluster before starting it up. 
• License Management: Artifactory HA licenses are now fully managed through the Cluster License Manager. 
• Unlicensed Nodes: When adding and starting up a node, if a valid license is not available to the Cluster License Manager, the node will continue to run, but will remain unlicensed and return a 503 error to any requests it receives. To keep your HA cluster running until the node is licensed, you can modify your reverse proxy configuration to redirect requests to the next upstream if a 503 error is received by adding 
  proxy_next_upstream http_503 non_idempotent;. 
  
  Please refer to Configuring a Reverse Proxy where you can generate a new Reverse Proxy Configuration that includes the modification needed.

Black Duck Code Center Integration Deprecated

Artifactory's direct integration with Black Duck Code Center has been deprecated. To continue using the Black Duck service, you can connect Artifactory to JFrog Xray which has integrated with Black Duck as an external provider of issues and vulnerabilities. 

Global /repo Repository Deprecated

The Artifactory /repo repository endpoint is being deprecated. As part of the deprecation, any requests to the global /repo repository will no longer be valid, regardless to the value of the artifactory.repo.global.disabled system property. If you believe this deprecation will affect existing build jobs or scripts that are referencing the global repo, due to the deprecation, you will now be able to create your own standard Virtual Repository and call it “repo”, since the name will no longer be reserved.

Change in Startup and Shutdown Scripts

The startup and shutdown scripts have changed in Artifactory 5.0. Previously, these scripts used to create the "Artifactory" user as a standard user. To improve security, the user is now created without a login shell and the execution scripts use "su -s" (instead of "su -l") which means that the Artifactory user will not be available for any purpose other than for startup and shutdown.

Set Item Properties REST API Endpoint Changed

The version of Tomcat used in Artifactory 5.0 has been upgraded to 8.0.39. This version of Tomcat no longer supports unencoded URLs, so the REST API endpoints which used a pipe character ("|") as a separator have undergone corresponding changes so you can use a semicolon (";") as a separator instead, or use escaping to represent a pipe as %7C. Any scripts that use these endpoints may have to be changed to support the new specification. For details, please refer to Set Item Properties as an example. 

Session ID Cookie Changed

Your Artifactory session ID is now stored in a SESSION cookie (instead of a JSESSIONID cookie).

Main Updates

1. Artifactory can now be installed in a High Availability configuration without needing an NFS.  
2. Cluster License Manager for Artifactory HA installations automatically manages licensing for your cluster nodes. This will also be supported by JFrog Mission Control in its forthcoming release.
3. Greatly simplified Artifactory Docker image installation.
4. Authentication using Access Tokens. 
5. Greatly simplified onboarding using either a UI wizard or a YAML file. 
6. Home Screen has been redesigned with a new look and feel for easy access to common actions and a rich user experience.  
7. Search has been redesigned and is now available as a separate module for easy access from anywhere. 
8. UI notifications in Artifactory have been improved for clarity.
9. Monitoring Storage is updated with a new look and feel.
10. Removed the requirement for session affinity in the load balancer used in an Artifactory HA cluster.
11. Direct integration with Black Duck has been deprecated. You may continue using Black Duck through JFrog Xray.
12. Global /repo repository has been deprecated.
13. Artifactory Tomcat version was upgraded to 8.0.39.
14. From version 5, the YUM package type is replaced with RPM. i.e. what used to be a YUM repository is now referred to as an RPM repository. YUM will continue to be supported as a package type when creating repositories through the REST API for backward compatibility.  
15. Users who are logged in through a SAML server can be associated with LDAP groups through the use of a user plugin. Use this user plugin as a reference as an example of a user plugin.
16. LDAP login performance was improved by narrowing Arifactory's search filter so it only searches through groups that have been imported to Artifactory rather than the full set of LDAP groups.
17. Added support for Docker manifest to reference remote layers by URL that will be pulled by the Docker engine before running the image.
18. Added metadata validation for Debian packages to ensure Debian repositories are not corrupted by malformed packages. 
19. Fixed an issue in which Docker images which were imported to Artifactory and then exported sometimes failed to produce the correct schema.
20. Fixed an issue regarding email notifications for backups so that now, a notification is sent for both manual and automatic scheduled backups if the backup fails.
21. Fixed an issue in which downloading from a virtual Git LFS repository would fail if the file would not exist in the first positioned repository in the list. 
22. Fixed an issue in which YUM metadata GPG signing was skipped if the passwords in Artifactory were encrypted.
23. Fixed an issue in which Git LFS repositories that require authentication will fail push requests when Anonymous Access is enabled.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 5.0.1

Released: February 7, 2017

Main Updates

1. A memory leak that was discovered in the new cluster license manager implementation has been fixed. This issue may have caused Artifactory to stop responding and is now resolved.

2. A limitation in Artifactory HA, that potentially prevented you from accessing large support bundles, and prevented Artifactory from starting up, has been removed. Now, you can access the support bundle for any node in an HA cluster regardless of its size.

3. An issue preventing Artifactory from starting up when using IBM JDK 8 has been fixed.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.16

Released: January 16, 2017

Support for Xray CI/CD Integration

As a critical link between JFrog Xray and Jenkins CI (more CI servers will be added in future releases), Artifactory adds support for Xray's CI/CD integration allowing you to fail build jobs if vulnerabilities are found in the build. Artifactory acts as an intermediary between Jenkins and JFrog Xray. 

You can configure the Jenkins Pipeline to send a synchronous request to Xray to scan a build that has been uploaded to Artifactory. Artifactory passes the request on to Xray which scans the builds in accordance with Watches you defined, and respond with an indication to fail the build job if an alert is triggered.

Xray CI/CD integration is supported from Artifactory 4.16, JFrog Xray 1.6 and Jenkins Artifactory Plugin 2.9.0.

Main Updates

1. Add support for JFrog Xray CI/CD integration allowing you to fail build jobs if the build scan triggered an alert.

2. Fix a bug that caused a memory leak related to JFrog Mission Control DR configuration.

3. Fix an issue in which createdBy and modifiedBy fields were missing after running an import.

4. When a build is deleted, whether through the UI, via REST API or due to a build retention policy, Artifactory now sends a corresponding event to Xray so it can remove that build from its database and avoid triggering alerts for deleted builds.
5. A fix has been put in place to prevent a security vulnerability (CVE-2016-10036) that may have been exploited through a web UI API endpoint, which potentially allowed unauthorized uploading of files to unexposed locations in the Artifactory host. 
   JFrog would like to thank Alessio Sergi of Verizon Enterprise Solutions for reporting this issue and for working with JFrog to help protect our customers.

Artifactory 4.16.1

Released: March 15, 2017

Main Updates

1. The Tomcat bundled with Artifactory has been upgraded to version 8.0.41.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.15

Released: December 13, 2016 

Conan Repositories

Artifactory brings binary repositories to the world of C/C++ development with support for Conan repositories. By supporting the Conan client, Artifactory offers enterprise grade repository management supporting high-availability, fine-grained access control, multi-site development, CI integration and more. Providing an in-house local repository for C/C++ binaries, Artifactory is a secure, robust source of dependencies and a target to efficiently upload packages built through Conan. C/C++ development will never be the same again.

Main Updates

1. Add support for Conan repositories. 
2. Significantly improved performance in Artifactory installations serving thousands of users related to the intensive permission validation process. For example, this should solve slow NuGet search issues in these Artifactory installations.
3. Fixed an issue in which changing the severity specified for download blocking for a repository, or removing it altogether, did not update Xray correctly and the change was not registered. 
4. Fixed an issue in which the JSON returned from Get Repository Replication Configuration was not always compatible with REST API endpoints used to set repository replication configuration. 
   
   

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.14

Released: October 20, 2016

PHP Composer Repositories

Artifactory now supports development with PHP as a fully-fledged PHP Composer repository. Create local repositories to host your internal PHP packages, or proxy remote resources that host PHP index files or PHP binary packages. 

Main Updates

1. Support PHP Composer local and remote repositories.
2. Artifactory can now issue a warning before running a backup if there is insufficient disk space.
3. Performance when simultaneously calculating Debian metadata for multiple distributions in multiple repositories has been improved.

Known Issues

1. In case DR instance is manage by JFrog Mission Control there is a risk of a memory leak which may cause the Artifactory service to stop responding.
   Related issues are RTFACT-12854, RTFACT-13358. 

For a complete list of changes please refer to our  JIRA Release Notes.

Artifactory 4.14.1

Released: November 1, 2016

Main Updates

1. Fixed an issue related to clean up of YUM metadata index files.
2. Fixed a distribution issue related to packages with special characters (e.g. ':') in the package or version name.

Known Issues

1. In case DR instance is manage by JFrog Mission Control there is a risk of a memory leak which may cause the Artifactory service to stop responding.
   Related issues are RTFACT-12854, RTFACT-13358. 

For a complete list of changes please refer to our  JIRA Release Notes.

Artifactory 4.14.2

Released: November 27, 2016 

Main Updates

1. LDAP login performance improved

   Login performance has now been improved by only searching attributes that have been configured in the LDAP Group setting rather than for the entire set of attributes. This is especially noticeable when user belongs to many groups.
   
   

2. Npm search issue fix

   Due to breaking changes in npm client behavior, from version 4.0 of the Npm client, searching through Artifactory was failing. This was because the client could not parse the response with the "_updated" field of searches that used "since" . This has now been fixed by removing the field from the response for partial searches.
   
   

3. NuGet search issue fix

   When the results of NuGet package search required pagination, several results were omitted. This was due to a mismatch between how Artifactory returned each page of the results (using a "$skip" parameter), and how the NuGet client expected the result (based on the "$top" parameter. This has now been fixed by aligning Artifactory with the NuGet client so no results are omitted.
   
   

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.14.3

Released: December 7, 2016 

Using Previous Encryption Keys

If Artifactory is unable to decrypt data with the current Master Key (the contents of the artifactory.key file), you can now set the artifactory.security.master.key.numOfFallbackKeys property in the artifactory.system.properties file which specifies the number of previous keys Artifactory should try and use to decrypt data .

Main Updates

1. Enable Artifactory to use previous Master Keys keys to decrypt data.

Known Issues

1. In case DR instance is manage by JFrog Mission Control there is a risk of a memory leak which may cause the Artifactory service to stop responding.
   Related issues are RTFACT-12854, RTFACT-13358. 

For a complete list of changes please refer to our JIRA Release Notes .

Artifactory 4.13

Released: September 21, 2016

Xray Enhancements

Artifactory 4.13.1

Released: October 13, 2016

Main Updates

1. An issue, in which Bower packages downloaded from virtual repositories were returned "flat" rather than in their original structure, has been fixed.

2. The system logs are refreshed periodically. An administrator can now pause the countdown to refresh the system log. 

3. The order in which different repository types are sorted in the tree browser can now be set by a system property. 

4. Performance when managing Groups and Users for permission targets has been improved.

Known Issues

1. In case DR instance is manage by JFrog Mission Control there is a risk of a memory leak which may cause the Artifactory service to stop responding.
   Related issues are RTFACT-12854, RTFACT-13358. 

For a complete list of changes please refer to our  JIRA Release Notes.

Known Issues

1. RubyGems dependency query might cause unexpected DB behavior when working with a very large sets of artifacts.
   Related issue is RTFACT-12480, fixed in version 4.12.2. 

Artifactory 4.7.6

Released: May 9, 2016

Main Updates

1. Significantly improved performance of Maven metadata calculation on path which contains a large number of versions.

2. Disable the /repo repository for new Artifactory SaaS instances provisioned.
   NOTE: For existing customers this change will take effect next time the artifactory.system.properties is re-created. This can happen when an Artifactory server is migrated to another region, or during certain maintenance operations.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.6.1

Released: March 21, 2016

Main Updates

1. A fix, to accommodate a change in the Docker client, that enables re-pushing existing layers when working with Docker 1.10.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.5

Released: February 14, 2016

CocoaPods repositories

Manage your dependencies for Apple OS development  through Artifactory. Artifactory supports CocoaPods with local and remote repositories.

Main Updates

1. CocoaPods Repositories.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.5.1

Released: February 18, 2016

OAuth Security Fix

This release fixes a security vulnerability related to OAuth.

YUM performance

YUM memory management had undergone additional tuning to further improve performance.

Main Updates

1. OAuth security fix.
2. YUM performance tuning.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.5.2

Released: February 28, 2016

This is a minor update that provides several bug fixes. 

For a complete list of changes please refer to our  JIRA Release Notes.

Artifactory 4.4 brings more advancements to security capabilities including:

• Preventing brute force attacks at identity theft with increasingly delayed responses to repeated failed attempts at authentication, and locking out users after repeated failed login attempts.
• SSH Authentication for Git LFS and Artifactory CLI
• OAuth support for Docker client

Opkg Repositories

Artifactory is now a fully fledged Opkg repository, and generates index files that are fully compliant with the Opkg client. Create local repositories for your internal ipk packages, or proxy remote Opkg repositories. Provide GPG signatures for use with the Opkg client, and manage them using the UI or through REST API.

Trash Can

Artifactory now provides a trash can that prevents accidental deletion of important artifacts from the system. All items deleted are now stored for a specified period of time configured by the Artifactory administrator, before being permanently removed.

Main Updates

1. Local and remote Opkg repositories.
2. Deletion protection with a Trash Can. 
3. SSH Authentication for Git LFS and Artifactory CLI.
4. OAuth authentication for the Docker Client. In addition, users can be granted access to their profile page using OAuth instead of having to type in their passwords. 
5. Scan RubyGems to extract their licenses and display them as properties. 
6. To combat unauthorized logins that use brute force, an administrator can configure user locking. In addition, Artifactory also implements temporary login suspension for unauthorized REST API access.
7. Extract Docker labels and create corresponding properties on the image's manifest.json file.
8. Support for Virtual Repositories and Inserting User Credentials in Set Me Up dialogs.

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 4.4.1

Released: January 13, 2016

Password Expiration Policy

An Artifactory administrator can now force all users to change their password periodically by enabling a password expiration policy.

Externally Authenticated Users

An Artifactory administrator can now enable users, who are authenticated using external means such as SAML SSO, OAuth or HTTP SSO, to access their profile and generate an API Key or modify their password. 

Apache Reverse Proxy Configuration

In addition to NGINX, Artifactory now also provides you with the code snippet you need to configure Apache as your reverse proxy. Just feed in your reverse proxy settings, including your handling of Docker repositories, and Artifactory will generate the configuration script you can just plug into your Apache reverse proxy server.

Main Updates

1. Password expiration policy
2. Allow users authenticated by SAML SSO, OAuth, or HTTP SSO to access their profile and generate an API Key or modify their password.
3. Reverse proxy configuration for Apache. 

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.4.2

In addition to several bug fixes, this minor update fixes an issue with backward compatibility for S3 Object Store when upgrading to Artifactory v4.3 and above.

This version also presents a significant improvement in download performance.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.4.3

Basic Authentication

You can now use your API key as your password for basic authentication. This means that clients that cannot provide the API key in a header, can still be authenticated with the API key by including it instead of the password in the basic authentication credentials.

List Docker images

Using the List Docker Images REST API, you can get a list of images in your Docker repositories.

YUM Performance Improvements

Major improvements in performance when working with YUM  repositories, showing up to 300% faster indexing of RPM packages.

Main Updates

This release includes the following main updates: 

1. Compatibility with Docker v1.10 and the Docker Manifest v2 schema.
2. Major improvements in performance when working with YUM  repositories.
3. Use your API key for basic authentication.  
4. API key header changed to X-JFrog-Art-Api.
5. REST API to enable or disable replication tasks.
6. When authenticated externally, an admin can allow you to access your API key, Bintray credentials and SSH public key without having to unlock your profile.
7. REST API to list Docker repositories using /_catalog end point.

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 4.3

API Keys

You may now authenticate REST API calls with an API key that you can create and manage through your profile page or through the REST API.  

Package Search

Run a search based on a specific packaging format with dedicated search parameters for the selected format. Performance is improved since search is restricted to repositories with the specified format only. 

Support Zone

Generate the information that our support team needs to provide the quickest resolution for your support tickets.

Dependency rewrite for Bower and NPM

Remove the dependence on external artifact resources for Bower and Npm. When downloading a Bower or Npm package, Artifactory will analyze the package metadata to evaluate if it needs external dependencies. If so, Artifactory will download the dependencies, host them in a remote repository cache, and then rewrite the dependency specification in the original package's metadata and point it to the new location within Artifactory.

Improved support for S3 object store

JFrog S3 object store now supports S3 version 4 allowing you to sign AWS with Signature v4. Multi-part upload and very large files over 5 GB in size are now also supported.

Main Updates

1. Authentication using API keys.
2. Package search. 
3. Convenient Support Zone page for submitting support requests. 
4. Improved support for S3 object store with support for S3 version 4. 
5. Automatic rewrite of external dependencies for Npm and Bower repositories.  
6. HTTP request object is now accessible from Realms closures in user plugins ( RTFACT-8514 ).  
7. REST API to download a complete release from VCS repositories. 

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 4.3.1

Reverse Proxy 

Artifactory now provides a mechanism to generate reverse proxy configuration for NGNIX. This is very helpful when using clients, like Docker, that require a reverse proxy.

Support Google Cloud Storage (GCS)

Artifactory now supports GCS as a storage provider for you Artifactory instance.

Git LFS Batch API

Artifactory now supports batch calls from the Git LFS client allowing batch multiple file uploads.

Main Updates

1. Reverse proxy configuration generator
2. Google Cloud Storage 
3. Batch file uploads for Git LFS repositories

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 4.3.2

Artifactory 4.2

In addition to implementing several bug fixes and minor improvements, this release introduces a Debian Artifactory installation and Deploy to Virtual repositories .

Debian Installation

Artifactory can now be installed as a Debian package.

Deploy to Virtual

Artifactory now supports deploying artifacts to a virtual repository via REST API. All you need to do is specify a local repository aggregated within the virtual repository that will be the deploy target.

OAuth Login

Artifactory now supports login and authentication using OAuth providers. Currently, Google, Open ID and GitHub Enterprise are supported.

Artifactory Query Language (AQL)

AQL has been greatly extended to include several additional domains, including Build and Archive.Entry as primary  domains, giving you much more flexibility in building queries.

Main Updates

1. Artifactory installation as a Debian package 
2. Deploy artifacts to a virtual repository 
3. Authentication using OAuth providers
4. AQL has been extended to include additional domains
5. Improvements to Smart Remote Repositories 
6. REST API to retrieve storage information
7. Overwrite NuGet pre-release packages without delete permissions
8. Pushing Docker images to Bintray is now also supported for Docker V2 repositories
9. Several minor improvements to the UI

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 4.2.1

OAuth Provider

Cloud Foundry UAA is now supported as an OAuth provider.

SHA256

In addition to SHA1 and MD5, SHA2 checksums are now supported also.

Main Updates

1. Artifactory now supports Cloud Foundry UAA for OAuth authentication.
2. Since Artifactory now fully supports the Bower client, support for older versions of Bower (below v1.5) that were using bower-art-resolver beta version is now deprecated.
3. Internet Explorer compatibility issues have been fixed.
4. Artifactory's HTTP client has been upgraded to version 4.5.
5. Automatic license analysis is now also triggered when deploying RPMs.
6. SHA256 calculation is now available, on demand via the UI or via REST API.
7. Several minor improvements to the UI.

For a complete list of changes please refer to our JIRA Release Notes. 

Artifactory 4.2.2

Artifactory 4.1

In addition to implementing several bug fixes and minor improvements, this release introduces Smart Remote Repositories and Virtual Docker Repositories.

Smart Remote Repositories

Define a repository in a remote Artifactory instance as your remote repository and enjoy advanced features such as automatic detection, synchronized properties and delete indications.

Virtual Docker Repositories

Aggregate all of your Docker repositories under a single Virtual Docker Repository, and access all of your Docker images through a single URL.

Main Updates

Artifactory 4.1.2

This is a minor update that provides a fix for clients, such as Maven, that do not use preemptive authentication. 

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.1.3

This is a minor update that provides a fix for Docker Login with anonymous access. 

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.0

New User Interface

JFrog-Artifactory's user interface has been rebuilt from scratch to provide the following benefits:

• Intuitive: Configuration wizards for easy repository management
• Fresh and modern: New look and feel providing a rich user experience
• Set Me Up: Convenient code snippets to support simple copy/paste integration with software clients and CI tools
• Context-focused repositories: Repositories are optimized to calculate metadata for single package types
• Easy access control: Easily implement your access policies with intuitive user, group and permission management
• Smart tables: Group and filter any data that is presented in tables

Groovy 2.4 for User Plugins

JFrog Artifactory 4 supports Groovy 2.4 letting you enjoy the latest Groovy language features when writing User Plugins.

We strongly recommend you verify that all of your current User Plugins continue to work seamlessly with this version of Groovy.

Tomcat 8 as the Container

JFrog Artifactory 4.0 only supports Tomcat 8 as its container for both RPM and standalone versions. If you are currently using a different container (e.g. Websphere, Weblogic or JBoss), please refer to Upgrading When Using External Servlet Containers for instructions on how to migrate to Tomcat 8.

System Requirements

Java

JFrog Artifactory 4.0 requires Java 8

Browsers

JFrog Artifactory 4. 0 has been tested with the latest versions of Google Chrome, Firefox, Internet Explorer and Safari.

Breaking Changes

User Plugins

Some features of Groovy 2.4 are not backward compatible with Groovy 1.8. As a result, plugins based on Groovy 1.8 may need to be upgraded to support Groovy 2.4.

Multiple Package Type Repositories 

JFrog Artifactory 4.0 requires you to specify a single package type for each repository. For the specified package type, Artifactory will calculate metadata and work seamlessly with the corresponding package format client. For example, a repository specified as Docker will calculate metadata for Docker images and work transparently with the Docker client.

Artifactory will not prevent you from uploading packages of a different format to any repository, however, metadata for those packages will not be calculated, and the corresponding client for those packages will not recognize the repository. For example, if you upload a Debian package to a NuGet repository, Debian metadata will not be calculated for that package, and the Debian client will not recognize the NuGet repository.

You may specify a repository as Generic and upload packages of any type, however, for this type of repository, Artifactory will not calculate any metadata and will effectively behave as a simple file system. These repositories are not recognized by clients of any packaging format.

If your system currently includes repositories that support several package types, please refer Single Package Type Repositories to learn how to migrate them to single package type repositories.

Artifactory 4.0.1

This is a minor update that provides significant enhancements to our support for Docker, additional UI improvements as well as several bug fixes.

For a complete list of changes please refer to our JIRA Release Notes.

Artifactory 4.0.2

This is a minor update that provides support for the latest Docker client 1.8.

For a complete list of changes please refer to our JIRA Release Notes.

Previous Release Notes

For release notes of previous versions of JFrog Artifactory, please refer to Release Notes under the Artifactory 3.x User Guide