JFrog Curation: How Compliant Version Selection Stops Policies From Breaking Builds

Security policy enforcement has a developer experience problem: policies designed to stop supply chain attacks are also stopping builds. JFrog’s latest addition to its Curation platform is a direct attempt to resolve that conflict without compromising either side.

Supply chain attacks accounted for 30% of external breaches in 2025, according to JFrog’s own data. That number has pushed security teams to harden artifact repositories — blocking packages that are too new, unvetted, or non-compliant with organizational security standards. The side effect is a version of the boy-who-cried-wolf problem: when policies block too often, developers start finding workarounds. The policy that was supposed to prevent supply chain risk ends up being bypassed by the people it was designed to protect.

Context

The core tension in artifact repository management is that “block” is a blunt instrument. When a developer requests a package version that violates policy, a traditional policy engine does one thing: reject the request. The developer then opens a ticket, waits for security review, negotiates an exception, and eventually unblocks. That cycle takes days. For a developer running a CI/CD pipeline, it’s not a security improvement — it’s an obstacle.

JFrog Curation introduces Compliant Version Selection (CVS) as the alternative. The behavior shift is from “block-and-fail” to “block-and-serve.” When a requested version violates policy, CVS doesn’t stop at rejection — it automatically scans the remaining available versions within the requested range and serves the highest policy-compliant alternative.

The Detail

The CVS workflow operates in seven steps that happen transparently inside the existing Artifactory request chain:

1. Developer or CI pipeline requests a package at a specific version
2. JFrog Curation evaluates that version against active policies
3. If the version fails, CVS scans all other versions within the declared version range
4. The system identifies the most recent version that satisfies all active policies
5. Artifactory downloads and caches that compliant version
6. The build continues without interruption — no ticket required
7. All actions are recorded in audit logs for security review

From the developer’s perspective, the build works. From the security team’s perspective, the policy was enforced. The audit log provides the traceability that neither blocking nor silent passthrough provides.

JFrog puts the operational impact at up to 319,788 developer hours reclaimed annually for organizations running CVS at scale. That figure reflects time currently spent in the exception-request-and-review cycle — hours that compound across large engineering organizations where a single blocked dependency can stall multiple teams.

The scope extends beyond traditional software packages. CVS also applies to AI and ML model artifacts sourced from platforms like Hugging Face, where the same policy enforcement challenges apply: new model versions may carry licensing risks or fail compliance checks, but blocking them entirely creates friction for teams moving quickly on model evaluation.

The underlying principle JFrog cites is that 98% of vulnerabilities accumulate in the less-visible parts of the software stack — the transitive dependencies and indirect supply chain components that no one is actively reviewing. Intelligent tooling that enforces policy while maintaining developer velocity is, in their framing, the only way to cover that surface area without grinding engineering teams to a halt.

Source: JFrog Blog

Content created with AI assistance and reviewed for accuracy.