Released: 2026-11-10
cargo, crates.io’s sparse index) is now a supported ecosystem, also behind a JFrog Artifactory Cargo repository. Rules match pkg:cargo/<crate> with vers:cargo/ ranges. Both deny and hide keep a version in the index marked as yanked, so cargo does not pick it. A lockfile that pins a hidden version still downloads it, and one that pins a denied version gets a 403 naming the rule. Quarantine reads the index’s publish times. In standalone mode, route crates.io by host to https://index.crates.io, and the firewall fetches its crates from https://static.crates.io under the same registry. A crate download is checked when its URL follows cargo’s default .../<crate>/<version>/download form, as crates.io’s and Artifactory’s do.remote_url is now logged as a warning at startup and on a reload that changes the firewall section. Only the scheme and host have ever been used, so a remote_url such as https://repo1.maven.org/maven2 loaded without a word and answered 404 for every artifact. Clients send the path themselves, as they would to the upstream: point Maven at /maven2 below the firewall, as at Maven Central./artifactory and /nexus context paths, or at the root, as the Virtual Registry detects them. A repository manager under any other context path is no longer detected, so rules do not match its packages./api/mode now sends the webhook, as a config mode change does, so manifests cached under the old mode are purged.path_prefix route, such as path_prefix: /artifactory with clients at /artifactory/api/npm/<repo>/, so denied versions downloaded. Repository manager paths are now detected below a path_prefix too.path_prefix, which said a matched prefix is stripped before the request goes upstream. It is forwarded with the rest of the path, as it always was, so clients pointed at the firewall keep their URLs, and it has to be a path the upstream serves, such as Artifactory’s /artifactory. A made-up prefix such as /registry/npmjs in front of https://registry.npmjs.org answers 404; use a host route for a registry served at its root.@acme/repository. Only /artifactory and /nexus are taken for one now..../registration/Download/<id>/<version>, which was taken for package metadata. It is now handled as a download, so rules apply to it.report mode, npm, PyPI (JSON simple index), NuGet and VS Code metadata kept the origin’s download links, so clients downloaded around the firewall and the downloads were neither evaluated nor logged. report mode now points those links at the firewall as normal mode does, and still applies no rule to them.AWSSDK.Core, and Artifactory virtual repositories. Those links now point at the firewall, which filters the pages.totalHits), so a search for json with 12,597 matches reported 20. The total is now the origin’s, so clients page through every match; it counts the firewall’s removed results only when one response holds them all.dotnet package search. nuget.org serves search from another host, which the firewall cannot reach. The firewall now leaves links to other hosts in the NuGet service index unchanged, so clients search nuget.org directly. Search results are not filtered, but downloads still go through the firewall.