Artifact Registry release notes

Artifact Registry is available in the northamerica-south1 region (Querétaro, Mexico, North America). For more information, see Global locations.

Artifact Registry now provides the option to enable or disable vulnerability scanning on individual repositories. By giving you more granular control over the number of images scanned, this feature can help you manage scanning costs and reduce noise in vulnerability scanning results.

This feature is Generally Available.

For more information, see Enable or disable automatic scanning.

The Container Registry -> Artifact Registry Migration Admin role simplifies the IAM roles required for the transition from Container Registry to Artifact Registry. For instructions on how to use the role, see Automatically migrate from Container Registry to Artifact Registry.

Artifact Analysis now supports scanning for vulnerabilities in the following types of operating systems:

• AlmaLinux OS
• Chainguard
• Google Distroless
• Red Hat Universal Base Image (UBI)
• Rocky Linux
• SUSE Linux Enterprise Server (SLES)
• Wolfi

If the Container Scanning API is enabled, it scans container images pushed to Artifact Registry addressing these new operating systems, in addition to already supported operating system and language package vulnerabilities.

These capabilities are Generally Available.

For more information, see Container scanning overview, or enable Container Scanning API.

Artifact Analysis now supports manual scans for vulnerabilities in the following types of packages:

• AlmaLinux OS
• Chainguard
• .NET
• Google Distroless
• NPM
• PHP
• Python
• Ruby
• Rust
• Red Hat Universal Base Image (UBI)
• Rocky Linux
• SUSE Linux Enterprise Server (SLES)
• Wolfi

You can use the On-Demand Scanning API to manually scan container images locally on your computer or in your registry. Artifact Analysis scans for vulnerabilities in these new packages types, in addition to already supported package types.

These capabilities are Generally Available (GA).

For more information, see Container scanning overview.

Artifact Registry remote repositories support setting standard Artifact Registry repositories as upstreams for supported formats.

To learn more about how remote repositories work, read the Remote repository overview.

Organization policy constraints for Artifact Registry is available in General Availability.

For more information, see Use custom organization policies.

Artifact Registry artifact download rules are in Preview.

Download rules let you restrict downloads at the repository and package level. To learn more, see Restrict artifact downloads. To configure download rules, follow the instructions in Restrict artifact downloads with download rules.

Artifact Registry support for OCI specifications v1.1 is generally available in Docker format repositories.

You can upload containerized metadata about another container image to Artifact Registry as an attachment. To learn more, see Manage container metadata.

Artifact Analysis is gradually rolling out regionalized data storage and endpoints to help support compliance with data residency requirements. The Container Analysis API stores metadata in the same region or multi-region as the Artifact Registry repository where your image is scanned.

For more information, see Metadata storage locations.

Artifact Registry records metrics and logs for your projects. To explore the available Artifact Registry metrics and logs, view your project in the Metrics Explorer or the Logs Explorer.

For more information about metrics and logs, read Observability in Google Cloud.

Cleanup policies for Artifact Registry are Generally Available (GA).

Cleanup policies help you manage artifacts by automatically deleting artifacts that you no longer need, while keeping artifacts that you want to store.

Deletions requested by Cleanup policies count against Artifact Registry delete request quota and limits.

Artifact Registry generic repositories are available in Preview.

Generic repositories store versioned, immutable artifacts that don't have to adhere to any specific package format in Artifact Registry. You can store and manage arbitrary files such as archives, binaries, and media files with no package specifications or management clients.

To get started with generic repositories, see the quickstart.

Artifact Registry download file feature is Generally Available (GA) for standard repositories and remote repositories.

The download file feature allows users to download individual files without configuring authentication for format-specific tooling. For more information, see Download files.

The immutable tags setting is generally available for Docker repositories. When tags are immutable, you can't change the image digest that a tag references in the repository. You can configure this setting when you create a repository or change the setting on an existing repository.

Artifact Analysis automatic scanning for Ruby, Rust, .NET and PHP vulnerabilities in container images is now generally available. If the Container Scanning API is enabled, it scans container images pushed to Artifact Registry for Ruby, Rust, .NET and PHP vulnerabilities, in addition to already supported operating system and language package vulnerabilities.

Artifact Analysis returns Ruby, Rust, .NET and PHP vulnerability results for images that have a supported or unsupported operating system. When you push new versions of images to the registry, you might see more successful vulnerability scans against images without a supported operating system.

For more information, see Container scanning overview.

The software bill of materials (SBOM) feature is now Generally Available (GA). To learn more, see SBOM overview.

Artifact Registry remote repositories support basic authentication to user-defined and preset upstream sources for Docker, Maven, npm, and Python formats.

To create a remote repository using a preset or user-defined upstream source, see Create remote repositories. For more information on remote repository authentication, see Configure authentication to remote repositories.

Artifact Registry is available in the africa-south1 region (Johannesburg, South Africa).

Artifact Registry Tags are Generally Available (GA). Tags are key-value pairs that you can use to group repositories and other resources across Google Cloud for reporting, auditing, and access control within your Google Cloud organization. To learn more, see Tag repositories.

Artifact Registry remote repositories now support authentication to Docker Hub upstream repositories.

To create a Docker Hub remote repository, take the quickstart.

Artifact Registry remote repositories are now generally available.

Remote repositories store artifacts from external sources such as Docker Hub or PyPI. A remote repository acts as a proxy for the external source so that you have more control over your external dependencies. The first time that you request a version of a package, Artifact Registry downloads and caches the package in the remote repository. The next time you request the same package version, Artifact Registry serves the cached copy.

To get started with remote repositories, try the quickstart.

Artifact Registry virtual repositories are now generally available.

Virtual repositories act as a single access point to download, install, or deploy artifacts in the same format from one or more upstream repositories. An upstream repository can be an Artifact Registry standard or remote repository.

To get started with virtual repositories, create a virtual repository, or see an example of how to use the different repository modes together in the repository overview usage example.

Artifact Registry now supports HTTP access to Apt repositories. For more information, see Configure HTTP access to an Apt repository.

Artifact Analysis automatic scanning for Python and Node.js (npm) vulnerabilities in container images is now generally available. If the Container Scanning API is enabled, it scans container images pushed to Artifact Registry for Python and Node.js vulnerabilities, in addition to operating system vulnerabilities.

Artifact Analysis returns Python and Node.js vulnerability results for images that have a supported or unsupported operating system. When you push new versions of images to the registry, you might see more successful vulnerability scans and corresponding charges against images without a supported operating system.

For more information, see Python overview and Node.js overview.

Artifact Analysis now offers support for Vulnerability Exploitability eXchange (VEX). VEX is a type of security advisory that indicates whether a product is affected by a known vulnerability. For every container image pushed to Artifact Registry, Artifact Analysis can store an associated VEX statement.

You can upload VEX files to describe any vulnerabilities discovered in specific artifacts and provide context about their impact. VEX statuses can be used to assist your organization in triaging vulnerabilities.

This feature is in Preview. To learn more, see Upload and view VEX statements.

Artifact Analysis now offers the ability to export a consolidated software bill of materials (SBOM) for scanned containers in Artifact Registry. SBOMs are generated in the Software Package Data Exchange (SPDX) format; however, you can also ingest externally created SBOMs in either SPDX or CycloneDx formats. With this new capability, you can centrally manage SBOMs to gain visibility into key information about your software supply chain.

This feature is in Preview. To learn more about our SBOM capabilities, see SBOM overview.

Artifact Registry is now available in the europe-west10 region (Berlin, Germany).

Artifact Registry remote repositories for OS packages are now in Preview.

A remote repository stores artifacts from external sources such as Docker Hub, Maven Central, the Python Package Index (PyPI), Debian or CentOS. A remote repository acts as a proxy for the external source to enable more control over external dependencies.

For more information on which public OS package repositories are supported by Artifact Registry remote repositories, see OS packages supported upstreams. To create a remote repository for OS packages, see Create remote repositories.

Cleanup policies for Artifact Registry are now in Preview. Cleanup policies help you manage artifacts by automatically deleting artifacts that you no longer need, while keeping artifacts that you want to store.

Deletions requested by Cleanup policies count against Artifact Registry delete request quota and limits.

Go repositories are now generally available.

Storage and network egress charges apply to all formats that are generally available.

Artifact Registry is now available in the me-central1 region (Doha, Qatar).

Artifact Registry is now available in the europe-west12 region (Turin, Italy).

Artifact Registry repositories with gcr.io domain support are now generally available. These repositories can host your existing Container Registry images and automatically redirect requests for gcr.io hosts to corresponding Artifact Registry repositories.

The immutable tags setting is now in Preview for Docker repositories. When tags are immutable, you cannot change the image digest that a tag references in the repository. You can configure this setting when you create a repository or change the setting on an existing repository.

Artifact Registry remote repositories and virtual repositories are now in Preview. These features help you to optimize your build and deployment workflows.

• Remote repositories cache artifacts from external sources, including Docker Hub, Maven Central, PyPI, and the npm registry.
• Virtual repositories provide a single access point to download artifacts from multiple remote or standard repositories. Each upstream repository has a set priority to protect against issues with dependency confusion.

Container Analysis automatic scanning for Java and Go vulnerabilities in container images is now generally available. If the Container Scanning API is enabled, it scans container images pushed to Artifact Registry for Java and Go vulnerabilities, in addition to operating system vulnerabilities.

Container Analysis returns Java and Go vulnerability results for images that have a supported or unsupported operating system. When you push new versions of images to the registry, you might see more successful vulnerability scans and corresponding charges against images without a supported operating system.

For more information, see the Types of scanning in the Container Analysis documentation

When users enable the Container Scanning API and push container images to Artifact Registry, automatic container scanning now generates metadata including a software bill of materials (SBOM) dependency list. Users can analyze the metadata to gain insights into software dependencies and vulnerabilities. For more information, see Examine dependencies. This feature is in private preview.

Artifact Registry is now available in the me-west1 region (Tel Aviv, Israel).

Container Analysis automatic scanning for Java and Go vulnerabilities in container images is now in Preview. If the Container Scanning API is enabled, it scans container images pushed to Artifact Registry for Java and Go vulnerabilities, in addition to operating system vulnerabilities.

Container Analysis returns Java and Go vulnerability results for images that have a supported or unsupported operating system. When you push new versions of images to the registry, you might see more successful vulnerability scans and corresponding charges against images without a supported operating system.

For more information, see the Types of scanning in the Container Analysis documentation.

Artifact Registry is now available in the us-south1 region (Dallas, United States).

Audit logs for Maven, npm, and Python repositories are now available in Cloud Logging.

Apt and Yum repositories are now generally available.

Artifact Registry is now available in the us-east5 region (Columbus, United States).

Artifact Registry is now available in the europe-southwest1 region (Madrid, Spain).

Artifact Registry is now available in the europe-west9 region (Paris, France).

Artifact Registry is now available in europe-west8 region (Milan, Italy).

Artifact Registry support for attaching tags to repositories is now in Preview. Tags are key-value pairs that you can use to group repositories and other resources across Google Cloud for reporting, auditing, and access control within your Google Cloud organization.. To learn more, see Tagging repositories.

On-Demand Scanning for Go packages is now generally available.

You can scan your container images and identify Go package vulnerabilities.

Artifact Registry repositories with gcr.io domain support are now available in Preview. These gcr.io repositories provide some features that are backwards-compatible with Container Registry.

You can now specify a release or snapshot version policy for Maven repositories when you create them. You cannot change the version policy of an existing repository. Repositories created before availability of this feature accept both snapshot and release packages.

Maven, npm, and Python repositories are now generally available.

Storage and network egress charges apply to all formats that are in Preview or are generally available.

Apt and Yum repositories are now in Preview.

Storage and network egress charges apply to all formats that are in Preview or are generally available.

Artifact Registry now supports Cloud External Key Manager (Cloud EKM) when using customer-managed encryption keys.

On-Demand Scanning for Java packages is now generally available.

You can scan your container images and identify Java package vulnerabilities.

Maven, npm, and Python repositories are now in Preview.

Storage and network egress charges apply to all formats that are in Preview or are generally available.

Artifact Registry now supports Access Transparency. Access Transparency provides you with logs of actions that Google staff have taken when accessing your data. To learn more about Access Transparency, see the Overview of Access Transparency.

Artifact Registry now supports audit logging for container images in Cloud Audit Logs.

Support for Python packages in private Python repositories is now in alpha. This feature is only available to alpha users. If you are interested in joining the alpha, fill in the sign up form.

• See the quickstart to get started.
• Learn more about working with Python packages in the overview.

On-Demand Scanning is available in Preview. You can manually scan Docker container images stored locally on your computer or remotely in Artifact Registry. To get started with manual scanning, see On-Demand Scanning quickstart

You can now use Pub/Sub to configure notifications for changes in Docker repositories. For more information, see Configuring Pub/Sub notifications.

You can now use Customer-Managed Encryption Keys (CMEK) to protect repository data in Artifact Registry. For more information, see Enabling customer-managed encryption keys.

Artifact Registry is now in beta.

Artifact Registry is the evolution of Container Registry, with support for Docker as well as Maven and npm package formats.

If you currently use Container Registry, see Migration and upgrade from Container Registry for more information.