Operations | Monitoring | ITSM | DevOps | Cloud

How we cut CI cycle times and flaky builds in half, and maintenance downtime to zero.

We’re excited to announce the launch of parent/child pipelines for Bitbucket Pipelines. This powerful new capability lets you define a step within a pipeline that triggers and encapsulates a whole other pipeline, which can help to streamline more complex workflows into modular pieces and achieve greater parallelism within your pipeline.

Working in front-end development involves writing features and bug fixes in different branches. But how do you ensure that reviewers, testers, and other stakeholders find it easy to view changes? Using preview deployments is one solution. Preview deployments allow you to automatically create a live URL each time someone opens a pull request (PR). It’s like giving every branch its mini website so that changes can be tested and proven in isolation.

We are delighted to share the exciting news that JFrog has earned the “Deployed on AWS” badge in AWS Marketplace, marking yet another milestone in our journey of innovation and collaboration with Amazon Web Services (AWS). This achievement underscores our commitment to providing cutting-edge solutions that leverage AWS’s robust infrastructure to enhance the user experience and drive efficiency.

Attestations, or as we like to call them, evidence, are a critical piece to proving software supply chain integrity and security. However, without the right tools and processes, reviewing and verifying attestations can be time-consuming. At JFrog, we’re deeply committed to empowering developers, DevOps, and Security teams to make these complex workstreams as simple as possible.

Platform engineering teams face a critical challenge: scaling software delivery across dozens of development teams without killing innovation and velocity. The traditional approach forces an impossible choice: rigid standardization or operational chaos. Platform teams get buried in manual configuration requests, security updates take weeks to roll out, and compliance gaps emerge from inconsistent practices and developer workarounds.

Downtime during deployments can affect the performance of your work. Data can be lost, and trust in your application can be destroyed. Luckily, zero downtime deployments do not need to be complex or involve a big infrastructure. This tutorial will teach you to establish a stable CI/CD pipeline with CircleCI and Render to automatically test and deploy a basic React application.

Hello, Bitbucket fans It’s Dave from the Bitbucket Cloud product team. We’re happy to introduce another enhancement to help your team better collaborate around code reviews, saving you valuable time – the ability to propose specific code suggestions within a pull request. Code authors can view and apply the proposed code changes without switching contexts, helping teams get pull requests completed even more efficiently. This feature is available today to all teams using Bitbucket Cloud.

Good news! You no longer have to be a DevOps or JFrog expert to harness the power of the JFrog Software Supply Chain Platform. With the introduction of JFrog’s MCP Server, we’re making the JFrog Platform accessible to your favorite large language models (LLMs). Now, every developer can take advantage of the detailed security and package information available in JFrog, such as vulnerability data from the JFrog Catalog, without needing to context-switch.

Fixtures may be one of Playwright’s most powerful yet under-used features. Playwright fixtures can be used to simplify repetitive setup or teardown in your tests, manage test data ,and test state better. Fixtures are key if your objective is to write cleaner, maintainable and manageable Playwright tests. This tutorial is aimed at helping you master using Playwright fixtures, understand their purpose, and showing how you can use them most effectively in your tests.

Docker layer caching (DLC) is a powerful technique that can significantly accelerate your CI/CD pipelines. By reusing unchanged image layers across builds, DLC not only cuts down on build times but also reduces cloud costs and boosts developer productivity. In this article, we’ll break down how Docker layer caching works, how to implement it effectively, and how to combine it with ephemeral environments for maximum impact.

Over the past few years, Platform Engineering has taken off as more and more as enterprise organisations adopt the practice of creating a centralised, self-service interface for developers to access the tools they need in order for them to do the job they were meant to do: build amazing software. At the heart of every Golden Path lies the ability to reliably produce, store, and consume build artifacts, from container images to internal libraries.

If there’s one thing we’ve learned from years of working with innovators across industries, it’s this: Progress happens when people come together—not just to showcase, but to share, ask questions, challenge one another, push both themselves and the industry to the next level, and co-create.

Improper artifact integrity validation is a critical vulnerability in CI/CD pipelines characterised by insufficient mechanisms to cryptographically verify the authenticity and integrity of code and build artifacts traversing the pipeline. When these controls are weak or absent, adversaries with access to any pipeline stage can inject malicious or tampered artifacts that appear legitimate, enabling undetected propagation through the pipeline and eventual deployment into production environments.

The Cloudsmith 2025 Artifact Management Report offers timely insights into how engineering and DevOps teams are evolving their approach to software artifact management and software supply chain security. With supply chain attacks on the rise and Generative AI reshaping development practices, teams are reevaluating how they manage, secure, and scale their artifact repository infrastructure.

The JFrog Security Research team has recently discovered and disclosed CVE-2025-6514 – a critical (CVSS 9.6) security vulnerability in the mcp-remote project – a popular tool used by Model Context Protocol clients. The vulnerability allows attackers to trigger arbitrary OS command execution on the machine running mcp-remote when it initiates a connection to an untrusted MCP server, posing a significant risk to users – a full system compromise.

Atlassian’s 2025 State of DevEx Survey reveals a paradox: AI is saving developers time, but they’re still losing time to organizational inefficiencies.