JFrog is moving download blocking for remote repositories from Xray to JFrog Curation. Its published rollout runs from 1 April through November 2026. Xray continues to scan local and remote repositories for vulnerabilities and to block downloads from local repositories. If your team uses Block Download on a remote repository, confirm the timing for your instance with JFrog. JFrog’s deprecation notice.
You need to act if an Xray policy uses the Block Download action on a remote repository, or on a virtual repository that includes one. Blocking on local repositories and Xray scanning are unaffected. To find out whether that applies to you, start with a build that pulls an external dependency through Artifactory. A CI runner might request an npm package through a virtual repository that combines an internal repository with a remote proxy for npm. The install command alone won’t tell you where the package came from. Follow the request to the repository that served it, then identify which policy was supposed to block it.
In Xray, review the Watches and Policies covering that repository. Look for a rule with the Block Download action, then confirm that its scope includes a remote repository your developers or CI runners actually use. A scan finding or a failed build tells you something different from a refused download. JFrog’s guide to Watches and Policies
Platform engineering: list the remote repositories affected, the clients that use them and one package version each policy should refuse.
Security: identify the control that will handle that download after the change. If you already use Curation, check which repositories its policies cover and whether the settings reflect your existing rules.
The JFrog account owner: confirm the transition date and Curation entitlement for your instance, then share both with the people who operate the build.
JFrog Curation applies package policies as dependencies enter through Artifactory remote repositories. If you already have another download control, check the same package through a developer machine and a CI runner before relying on it. A successful test on one route says little about a client that goes directly to a public registry.
You can also keep Artifactory as it is and put the blocking decision in front of it. Varnish Artifact Firewall evaluates supported package requests on the traffic you route through it. That gives you a separate place to manage download policy while Xray handles scanning.
Next step: compare JFrog Curation and Varnish Artifact Firewall for remote package blocking.