Cloudsmith

No entries match these filters. Clear filters

1. changelog Oct 28, 2026 · issue 123

   CLI v1.30.0 adds TLS-intercepting proxy support and anonymous error reporting; npm provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. verification and install performance improved; exact usage-limit inputs added.

   • Adds TLS-intercepting proxy support to the Cloudsmith CLI v1.30.0, enabling connections through TLS-intercepting proxies without disabling certificate verification.
   • Cloudsmith's npm registry now serves npm attestations and signing-key APIs, enabling npm provenance verification through Cloudsmith just as it works against the upstream registry.
   • Workspace owners and managers can now type exact numerical values for usage limits on the workspace Settings tab under Usage limits, replacing imprecise sliders.
   • CLI v1.30.0 now sends anonymous error reports to Cloudsmith by default so crashes can be identified without a support ticket.
   • Reduces pnpm client request count against Cloudsmith and reduces upstream lookups per npm repository, speeding up npm installs with no configuration changes required.

   5 details in Everything

   • New supported platform Mumbai storage region
   └──▷ BREAKING ON UPGRADE

   • !Username and password login via cloudsmith login and cloudsmith token stops working on November 20, 2026 — scripts and CI jobs using these commands must switch to API key authentication before that date.
2. CLI v1.30.0: Error reporting, TLS-intercepting proxy support, and a username and password login deprecation (2026-10-22) Oct 22, 2026 · issue 117

   Cloudsmith CLI v1.30.0 adds anonymous error reporting, TLS-intercepting proxy support, and persistent credential helper installation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Supports TLS-intercepting proxies without disabling certificate verification, enabling CLI use in enterprise environments with SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Installs credential helpers in a location that survives package-manager upgrades, preventing accidental removal.
   • Sends anonymous reports of unexpected errors to Cloudsmith by default, allowing crash detection without manual support tickets.
   • Supports TLS-intercepting proxies without disabling certificate verification, enabling CLI use in enterprise environments with SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Sends anonymous reports of unexpected errors to Cloudsmith by default, allowing crash detection without manual support tickets.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Username and password login via cloudsmith login and cloudsmith token is deprecated and stops working on November 20, 2026.
3. docs update Oct 22, 2026 · issue 116

   Cloudsmith now supports Hugging Face repositories, with commit-based snapshot tracking for reproducible AI model, dataset, and space builds.

   • New integration Hugging Face repository format support
4. Set exact usage limits with numerical inputs (2026-10-21) Oct 21, 2026 · issue 116

   Cloudsmith replaces imprecise sliders with exact numerical inputs for workspace usage limits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ HOW TO FIND IT
   Set a precise usage limit for your workspace without rounding errors from slider controls.
   📍In the Cloudsmith console, go to Workspace Settings › Usage limits and type an exact numerical value into the limit field.
   • Enables typing exact numerical values for usage limits in the workspace Settings tab under Usage limits, replacing the former slider controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

5. changelog Oct 20, 2026 · issue 114

   Cloudsmith adds ActiveState upstream proxying, Buildkite/GCP OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth, package listing from connected repos, and Ruby cooldown policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds ActiveState Curated Catalog upstream support, configurable via the Libraries tab, so teams can proxy and cache packages from the ActiveState catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds OIDC authentication for Buildkite pipelines and Google Cloud workloads in CLI v1.29.0, eliminating the need to store Cloudsmith API keys on build hosts.
   • Adds the ability to list packages from connected repositories alongside your own packages in CLI v1.29.0.
   • Extends cooldown policies to Ruby gem packages, protecting supply chains from newly published versions that may carry malware or lack community scrutiny.
   • Adds ActiveState Curated Catalog upstream support, configurable via the Libraries tab, so teams can proxy and cache packages from the ActiveState catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds OIDC authentication for Buildkite pipelines and Google Cloud workloads in CLI v1.29.0, eliminating the need to store Cloudsmith API keys on build hosts.
   • Adds the ability to list packages from connected repositories alongside your own packages in CLI v1.29.0.

   1 more in Everything

6. Proxy and cache packages from your ActiveState Curated Catalog (2026-10-15) Oct 15, 2026 · issue 110
   • New integration ActiveState Curated Catalog upstream
7. changelog Oct 12, 2026 · issue 105

   Cloudsmith adds a RegoRegoA declarative policy language created by the Open Policy Agent project, used to express authorization and compliance rules as code so cyber tools can evaluate structured data against those rules consistently. policy validate endpoint, CLI self-update, Terraform credential helper, and a new --workspace option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Upgrade the Cloudsmith CLI to the latest version using its built-in self-update, then switch to a specific workspace context.
   copy

   $ cloudsmith update
   cloudsmith --workspace <workspace-slug> <subcommand>

   • Adds a validate API endpoint that returns syntax and type errors in Rego policy logic without creating or updating anything, enabling pre-submission policy checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a --workspace option to the Cloudsmith CLI to read workspace settings from the command line.
   • Adds a built-in self-update capability to the Cloudsmith CLI (v1.27.0+) so the CLI can upgrade itself without external tooling.
   • Adds a Terraform credential helper to the Cloudsmith CLI that authenticates Terraform to Cloudsmith registries without storing a token.
   • Adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. session resilience to the Cloudsmith CLI, keeping single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. sessions alive through temporary network failures.
   • Adds a validate API endpoint that returns syntax and type errors in Rego policy logic without creating or updating anything, enabling pre-submission policy checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a --workspace option to the Cloudsmith CLI to read workspace settings from the command line.
   • Adds a built-in self-update capability to the Cloudsmith CLI (v1.27.0+) so the CLI can upgrade itself without external tooling.
   • Adds a Terraform credential helper to the Cloudsmith CLI that authenticates Terraform to Cloudsmith registries without storing a token.

   1 more in Everything

8. docs update Oct 11, 2026 · issue 102

   Cloudsmith OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. repository docs add ORASORASA CNCF project implementing the OCI Registry as Storage specification, letting tools push and pull arbitrary artifacts—not just container images—to and from any OCI-compliant registry.-based generic artifact upload/download, referrer attachments, and key signing support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Supports uploading Generic artifacts to an OCI repository using ORAS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports attaching files (SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., signatures, provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. files) to existing OCI artifacts via the Referrers API.
   • Supports downloading/pulling Generic artifacts from OCI repositories using ORAS, for both public and private registries.
   • Adds key signing support for OCI repository artifacts.

   4 details in Everything

9. changelog Oct 5, 2026 · issue 095

   Cloudsmith: Adds connected_repositories field to client log exports, listing the connected repositories a package was served through so downloads can be traced back to their source.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Supports pushing Nix packages via the Cloudsmith CLI (v1.21.0–v1.26.0).

   1 detail in Everything

10. changelog Oct 4, 2026 · issue 094

    Client log exports gain a connected_repositories field for download tracing; SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. group provisioning is now GA on Ultra and Enterprise plans; CLI adds repo GPG key and access management.

    • Adds connected_repositories field to client log exports so you can trace a download back through every connected repository that served it.
    • Promotes SCIM group provisioning to general availability on Ultra and Enterprise plans, automatically syncing Cloudsmith team membership when users are added or removed from mapped IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups.
    • CLI v1.21.0–v1.26.0 adds commands to manage a repository's GPG key and access privileges from the terminal.

    3 details in Everything

    • New integration Nix package format support in Cloudsmith CLI
    • New integration Cargo and pnpm credential helpers in Cloudsmith CLI
11. Trace downloads through connected repositories in client log exports (2026-10-01) Oct 1, 2026 · issue 092

    Client log exports gain a connected_repositories field to trace package downloads through the serving repository chain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

12. Trace downloads through connected repositories in client log exports Oct 1, 2026 · release notes

    Adds connected_repositories field to client log exports (JSON/CSV) for traceability

13. SCIM group provisioning is now generally available Sep 30, 2026 · release notes

    Cloudsmith adds generally available SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. group provisioning for automatic team membership sync.

    • Adds SCIM 2.0SCIM 2.0A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. compliance to automatically provision Cloudsmith team membership based on identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. (IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.) groups
    • Automatically creates Cloudsmith teams if they do not exist during the next IdP sync

    2 details in Everything

14. docs update Sep 28, 2026 · issue 088

    Cloudsmith adds a pnpm credential helper that feeds registry tokens from the CLI credential chain, removing static token management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Install the pnpm credential helper for a workspace so pnpm retrieves tokens automatically without storing them in plaintext.
    copy

    $ credential-helper pnpm --workspace WORKSPACE

    Preview what the uninstaller would remove before committing, to verify no unintended entries are touched.
    copy

    $ credential-helper uninstall pnpm --dry-run

    • Adds pnpm-credential-cloudsmith, a credential helper that lets pnpm authenticate to Cloudsmith registries using the CLI credential chain (API key, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. keyring token, or OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.) via pnpm's tokenHelper setting in the user-level .npmrc.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Installer writes a //npm.cloudsmith.io/:tokenHelper=/path/to/pnpm-credential-cloudsmith entry to the user-level .npmrc; set NPM_CONFIG_USERCONFIG to target a non-default user config file.
    • Supports -w/--workspace WORKSPACE flag on credential-helper pnpm to discover custom Cloudsmith npm domains for a workspace, with --domain HOSTNAME, --no-discover, --refresh, --dry-run, and --bin-dir DIRECTORY options.
    • Adds credential-helper list and credential-helper uninstall pnpm subcommands to inspect or remove installed helpers, with --dry-run support to preview uninstall changes.

    4 details in Everything

15. docs update Sep 28, 2026 · issue 088

    Cloudsmith adds Early Access Nix binary cache support: push NAR packages via CLI and consume via native Nix substitutersNix substitutersBinary cache servers in the Nix package ecosystem that supply pre-built store paths so a Nix-based tool can skip compiling dependencies from source, cutting build times dramatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Push a locally built NAR and its narinfo to Cloudsmith in one command so the package is immediately resolvable by Nix clients.
    copy

    $ cloudsmith push myorg/mynixrepo abc123def456.nar --narinfo-file abc123def456.narinfo --tags nix,ci

    Point a Nix client at a private Cloudsmith binary cache so nix-build or nix shell can substitute store paths without rebuilding.
    /etc/nix/nix.conf copy

    extra-substituters = https://token:TOKEN@nix.cloudsmith.io/myorg/mynixrepo

    Mirror a NixOS channel through Cloudsmith so consumers get cached upstream packages alongside your own, with a reusable JSON-driven workflow.
    copy

    $ cloudsmith upstream create myorg/mynixrepo nix-upstream.json

    • Adds Nix binary cache format (Early Access) with upload via cloudsmith push WORKSPACE/REPOSITORY STORE_HASH.nar --narinfo-file STORE_HASH.narinfo, supporting optional narinfo sidecars and standard push flags --tags, --republish, and --no-wait-for-sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Serves Nix packages at https://nix.cloudsmith.io/WORKSPACE/REPOSITORY using the native Nix binary cache protocol, with server-side ED25519 signing of every narinfo on read.
    • Supports authenticated consumption by embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. a token in the substituter URL: https://token:TOKEN@nix.cloudsmith.io/WORKSPACE/REPOSITORY.
    • Adds Nix upstream management via cloudsmith upstream create, list, update, and delete subcommands, driven by a JSON config file (e.g. nix-upstream.json) supporting modes Cache and Proxy and auth modes including None.
    • Supports --yes flag on cloudsmith upstream delete for unattended/scripted upstream removal.

    5 details in Everything

16. docs update Sep 28, 2026 · issue 088

    Cloudsmith: Adds the cargo-credential-cloudsmith credential helper, installable via credential-helper, which registers itself in $CARGO_HOME/config.toml (or ~/.cargo/config.toml) under the [registry] global-credential-providers list and resolves Cloudsmith API keys, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. tokens, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. credentials automatically — requires Cargo 1.74+.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Set up a private Cloudsmith Cargo registry using the credential helper so that existing Cloudsmith CLI credentials are used automatically — no token stored in Cargo config.
    copy

    $ # 1. Add the registry (no token) in ~/.cargo/config.toml
    # [registries]
    # my-org-myrepo = { index = "sparse+https://cargo.cloudsmith.io/my-org/my-repo/" }
    
    # 2. Install the credential helper, discovering custom domains for the workspace
    credential-helper --workspace my-org

    Register a Cloudsmith sparse Cargo registry for a private workspace without a hardcoded token, relying on the credential helper for auth.
    ~/.cargo/config.toml copy

    [registries]
    my-org-my-repo = { index = "sparse+https://cargo.cloudsmith.io/my-org/my-repo/" }
    
    [registry]
    global-credential-providers = ["cargo:token", "cargo-credential-cloudsmith"]

    List or remove installed Cloudsmith credential helpers to audit or clean up a CI runner without disturbing crates.io authentication.
    copy

    $ credential-helper list
    credential-helper uninstall

    • Supports the sparse Cargo registry protocol via sparse+https://cargo.cloudsmith.io/WORKSPACE/REPOSITORY/ in addition to the existing git-index endpoint.

    1 detail in Everything

17. docs update Sep 28, 2026 · issue 088

    Cloudsmith adds Nix upstream repository support in Early Access via web app, API, and CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
18. CLI v1.21.0 to v1.26.0: Nix support, Cargo and pnpm credential helpers, and repository administration from your terminal (2026-09-28) Sep 28, 2026 · issue 088

    Cloudsmith CLI v1.21–v1.26 adds Nix package push, Cargo and pnpm credential helpers, and terminal-based repo GPG/access management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Nix package support, enabling cloudsmith push for Nix packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Cargo credential helper so Rust projects authenticate to Cloudsmith repositories automatically.
    • Adds a pnpm credential helper so pnpm authenticates to Cloudsmith repositories automatically.
    • Enables GPG key management for repositories directly from the CLI, without using the web UI.
    • Enables repository access-privilege administration from the CLI terminal.

    5 details in Everything

19. Client logs now show the full request chain behind a package download (2026-09-25) Sep 25, 2026 · issue 086

    Cloudsmith client logs now capture format-specific metadata for all package formats, revealing full request chains beyond direct downloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
20. changelog Sep 15, 2026 · issue 075

    Cloudsmith adds vulnerability export, per-package audit logs, granular billing/OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. read-only roles, and richer GitHub secret-scanning alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Review and archive all vulnerability findings for a package outside the UI — useful for feeding results into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or ticketing system.
    📍In the Cloudsmith web app, open the repository, navigate to the target package, go to the Security or Vulnerabilities tab, and click Export to download findings as a JSON file.
    Audit who made changes to a specific package and when — handy during an incident investigation.
    📍In the Cloudsmith web app, open the repository, select the package, and open the Package Logs tab to view the full per-package audit trail.
    Give a finance or compliance team member visibility into billing and OIDC configuration without elevating their role to Manager or Owner.
    📍In the Cloudsmith web app, go to Workspace Settings › Members, select the member, and enable the individual Billing, Usage, or OIDC read-only privilege toggles separately.
    • Lets workspace owners grant members read-only access to billing, usage, and OIDC data individually, without assigning the Manager or Owner role.
    • GitHub secret-scanning email notifications now list every location an exposed Cloudsmith API key was found in a GitHub repository, with a direct link to each detection.
    • Lets workspace owners grant members read-only access to billing, usage, and OIDC data individually, without assigning the Manager or Owner role.

    1 more in Everything

21. Download package vulnerability findings from the Cloudsmith web app (2026-09-14) Sep 14, 2026 · issue 074

    Cloudsmith now lets you export vulnerability and malicious package findings as a JSON file from the web app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ HOW TO FIND IT
    Download a snapshot of all vulnerability and malicious package findings for offline analysis or compliance reporting.
    📍In the Cloudsmith web app, navigate to your repository's vulnerability findings view and select the option to export findings as a JSON file.
22. Track every change to your packages with package logs (2026-09-14) Sep 14, 2026 · issue 074

    Cloudsmith adds per-package audit logs showing what changed, who changed it, and when.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
23. Track every change to your packages with package logs Sep 14, 2026 · release notes

    Cloudsmith adds package logs feature to track audit trails for package changes.

    • Adds Package logs in the Cloudsmith web app UI under Logs, providing a per-package audit trail with timestamp, action, actor, and metadata like package size and IP address
    • Enables filtering package logs by action (Copy, Delete, Hard delete, Move, Policy violation, Quarantine, Restore, Resync, Sync, Tags changed) to isolate specific events

    2 details in Everything

24. Download package vulnerability findings from the Cloudsmith web app Sep 14, 2026 · release notes

    Export package vulnerability findings as JSON via web UI or API

25. GitHub secret scanning notifications now link to each detection location (2026-09-11) Sep 11, 2026 · issue 072

    GitHub secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. email alerts now include direct links to every location a leaked Cloudsmith API key was detected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

26. GitHub secret scanning notifications now link to each detection location Sep 11, 2026 · release notes

    Cloudsmith GitHub secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. notifications now link directly to each detection location

    • Email notifications for exposed Cloudsmith API keys in GitHub repositories list every detection with a direct link to the specific location.
    • Detections are grouped by content type: file contents, commits, issue titles/descriptions/comments, pull request titles/descriptions/comments/reviews, discussion titles/bodies/comments, and wiki commits.
    • The Cloudsmith workspace audit log records an API_KEY_EXPOSED event for each detection, including the masked key and specific detection location.

    3 details in Everything

27. Cooldown policies now support Cargo (2026-09-03) Sep 3, 2026 · issue 064

    Cloudsmith cooldown policies now extend to Cargo packages for supply chain protection.

    ⤢
    • Extends cooldown policies to Cargo packages, blocking newly published versions from being consumed until a configured delay period has passed.

    1 detail in Everything

28. Cooldown policies now support Cargo Sep 3, 2026 · release notes

    Cooldown policies now support Cargo packages in Cloudsmith

    • Adds Cargo to the list of package types supported by cooldown policies (npm, Python, Go, Maven, NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code., Conda, Docker, and Cargo).
    • Enables creation of cooldown policies for Cargo via the Cloudsmith API, Terraform provider, and web app.

    2 details in Everything

29. changelog Aug 31, 2026 · issue 060

    Cloudsmith adds Nix format support, Conda/Docker cooldown policies, Broadcasts consumption tracking, and a Libraries upstream tab

    • Supports the Nix package format, enabling hosting of public or private Nix binary caches with Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe.-signed packages and upstream proxying/caching against NixOS release channels.
    • Extends cooldown policies to Conda and Docker packages, protecting supply chains from newly published versions that may carry malware or lack sufficient community scrutiny.
    • Adds a Libraries tab for quickly configuring library registries as upstreams, providing access to vendor-curated, pre-vetted, and security-scanned open source package feeds.
    • Adds download tracking, entitlement token usage, and client log visibility directly within the Broadcasts app.

    4 details in Everything

30. Cooldown policies now support Conda and Docker (2026-08-27) Aug 27, 2026 · release notes

    Cooldown policies now apply to Conda and Docker packages

    • Adds cooldown policy support for Conda and Docker package types

    1 detail in Everything

31. docs update Aug 25, 2026 · issue 056

    Cloudsmith adds Early Access Nix binary cache hosting with ED25519 signing, upstream proxying, and nix copy publish/fetch support.

    └──▷ TRY IT
    Publish a locally built Nix package and its full dependency closure to a private Cloudsmith Nix repository.
    copy

    $ STORE_PATH="$(readlink -f result)"
    nix copy --to 'https://nix.cloudsmith.io/OWNER/REPOSITORY' --no-check-sigs "$STORE_PATH"

    Configure a Cloudsmith Nix repository as a system-wide substituter so nix build transparently fetches cached packages instead of building locally.
    /etc/nix/nix.conf copy

    extra-substituters = https://nix.cloudsmith.io/OWNER/REPOSITORY
    extra-trusted-public-keys = KEY_NAME:PUBLIC_KEY

    • Adds Nix binary cache repository support (Early Access), hosting NAR and narinfo files over the standard Nix HTTP binary cache protocol at https://nix.cloudsmith.io/OWNER/REPOSITORY.
    • Supports publishing packages via nix copy --to 'https://nix.cloudsmith.io/OWNER/REPOSITORY' --no-check-sigs — no separate upload format required.
    • Supports fetching packages via nix copy --from 'https://nix.cloudsmith.io/OWNER/REPOSITORY' STORE_PATH once a repository is configured as a substituter.
    • Configures Nix repositories as substituters using extra-substituters and extra-trusted-public-keys in nix.conf (e.g. /etc/nix/nix.conf or ~/.config/nix/nix.conf).
    • Supports embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. entitlement tokens directly in the substituter URL (https://token:TOKEN@nix.cloudsmith.io/OWNER/REPOSITORY) or via a netrc file with netrc-file for private repository access.

    +2 more show less

    • Per-repository ED25519 signing key — Cloudsmith re-signs every narinfo on every read, enabling immediate key rotation and simultaneous multiple active keys.
    • Upstream proxying and caching for NixOS release channels (e.g. https://channels.nixos.org/nixos-26.05); each upstream maps to exactly one channel, configured via the Proxy URL field.

    7 details in Everything

32. docs update Aug 25, 2026 · issue 056

    Cloudsmith adds Early Access Nix upstream proxying, supporting NixOS release channels via the web app.

    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Configure your Nix client to use a Cloudsmith repository as a substituter for a proxied NixOS release channel, with cache.nixos.org as a fallback for closure members Cloudsmith cannot index.
    /etc/nix/nix.conf copy

    extra-substituters = https://nix.cloudsmith.io/OWNER/REPOSITORY https://cache.nixos.org
    extra-trusted-public-keys = KEY_NAME:PUBLIC_KEY cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=

    Create a Nix upstream in Cloudsmith pointing at a specific NixOS release channel; create a separate upstream for each channel you want to proxy.
    📍In the Cloudsmith web app, go to your repository › Upstreams › Add Upstream › Nix, set the URL to https://channels.nixos.org/nixos-26.05, configure authentication (or select None), then save. Repeat with https://channels.nixos.org/nixos-25.11 for a second channel.
    • Adds Nix upstream proxy support (Early Access, web app only; API-based management not yet available), pointing at a single NixOS release channel URL such as https://channels.nixos.org/nixos-26.05.
    • Adds extra-substituters and extra-trusted-public-keys configuration to Nix client settings, enabling https://nix.cloudsmith.io/OWNER/REPOSITORY as a substituter alongside cache.nixos.org to cover dependency closures that Cloudsmith cannot index.
    • Adds upstream proxying for library registries (Chainguard Libraries, RapidFort Curated Libraries), allowing hardened or filtered open-source package replacements to be proxied through a Cloudsmith repository.
    • Adds upstream proxying for hardened image registries, providing minimal, vulnerability-reduced container images from vendor-maintained sources.

    4 details in Everything

33. docs update Aug 25, 2026 · issue 056

    Cloudsmith Broadcasts lets you publish repositories to a public, branded URL with aggregated analytics and native tooling support.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable broadcasting on an existing repository so end-users can pull packages using native tooling from your workspace's public broadcast URL.
    📍In the Cloudsmith dashboard, go to the main page for your repository, expand the dropdown next to Not broadcasting, and click Start broadcasting.
    • New Broadcasts feature lets you expose a standard Cloudsmith repository to the public through a customizable, branded URL rather than creating a separate public repository.
    • Adds a broadcast Overview section in the Cloudsmith dashboard showing aggregated analytics across all broadcasting repositories, including total requests per billing cycle, usage per package, recently downloaded packages, and recently created broadcasts.
    • Broadcasts analytics break down package requests by public, private, and open source packages, and show the number of entitlement tokens consumed in the current billing cycle.
    • Per-package analytics let you toggle between storage Usage and Requests views to identify which packages drive the most traffic or consume the most space.
    • Supports a default broadcast URL structure as well as workspace custom domains for both browser-based browsing and native tooling pull (Docker, npm, Maven, IDE, CI/CD).

    +1 more show less

    • Broadcasts can be enabled on repository creation via a toggle in the Create a new repository form, or enabled/disabled on existing repositories via a Start broadcasting / Stop broadcasting dropdown on the repository's main page.

    6 details in Everything

34. New format: Nix, with upstream support for NixOS (2026-08-24) Aug 24, 2026 · issue 056

    Cloudsmith adds Nix binary cache support with Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. signing and upstream NixOS channel proxying.

    • Adds Nix format repository support, enabling hosting of public or private Nix binary caches with Ed25519-signed packages.
    • Supports upstream proxying and caching against NixOS release channels, so Nix clients can pull from Cloudsmith as a transparent cache in front of official NixOS channels.

    2 details in Everything

35. Configure Go upstreams for any GOPROXY-compatible proxy (2026-08-19) Aug 19, 2026 · issue 050

    Cloudsmith Go upstreams now support any GOPROXYGOPROXYAn environment variable and protocol used by the Go toolchain to specify a module proxy server from which `go` commands fetch dependencies, enabling reproducible builds, caching, and access control over third-party packages.-compatible module proxy, not just proxy.golang.org.

    • Go upstream sources can now be configured to point to any GOPROXY-compatible module proxy, expanding beyond the previously supported public mirror at proxy.golang.org.

    1 detail in Everything

36. changelog Aug 17, 2026 · issue 048

    Cloudsmith GA: policy-as-code management and continuous OSV.devOSV.devAn open-source vulnerability database and API maintained by Google that aggregates CVEs and ecosystem-specific advisories in a unified schema, giving cyber tools a single feed to query for package-level vulnerability data.-powered risk detection now fully available.

    • Policy management is now generally available across the web app, API, and Terraform provider, enabling policy-as-code enforcement rules across the software supply chainsoftware supply chainThe dependencies, tools and processes used to build and deliver software. Compromising one part can affect the products or organizations that rely on it..
    • Continuous risk detection is now generally available, automatically checking every package in a workspace against known vulnerabilities and malicious packages with no scheduled or manual rescans required.
    • OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories..dev now replaces Trivy as the vulnerability data source shown in the web app and API for risk detection.
    • The policy editor now provides inline Rego error flagging and schema-field autocomplete as you type, surfacing mistakes before saving.

    4 details in Everything

37. Policy management is now generally available (2026-08-12) Aug 12, 2026 · issue 043

    Cloudsmith policy management (policy-as-code for software supply chainsoftware supply chainThe dependencies, tools and processes used to build and deliver software. Compromising one part can affect the products or organizations that rely on it. enforcement) is now generally available.

    ⤢ ⤢
38. Continuous risk detection is now generally available (2026-08-12) Aug 12, 2026 · issue 043

    Cloudsmith continuous risk detection is now GA, replacing Trivy with OSV.devOSV.devAn open-source vulnerability database and API maintained by Google that aggregates CVEs and ecosystem-specific advisories in a unified schema, giving cyber tools a single feed to query for package-level vulnerability data. as the vulnerability data source across the web app and API.

    ⤢
    • Enables continuous, automatic vulnerability and malicious-package checking for every package in a workspace — no scheduled or manual rescans required.
    • Replaces Trivy with OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories..dev as the data source powering vulnerability results in the web app and API, unifying it with the source that has driven policy evaluation since early access.

    2 details in Everything

39. Catch policy errors before you save (2026-08-12) Aug 12, 2026 · issue 043

    Cloudsmith's policy editor now surfaces Rego errors inline as you type, before saving.

    ⤢
    • Policy editor highlights Rego syntax and logic errors inline and in a dedicated error panel as you write, catching mistakes before saving.
    • Autocomplete in the policy editor now suggests schema fields as you type.

    2 details in Everything

40. changelog Aug 1, 2026 · issue 032

    Cloudsmith CLI 1.20.0 ships as a standalone binary, dropping the Python dependency, with a new bug bounty platform at bounties.cloudsmith.com.

    • New one-line installer, refreshed Homebrew tap, and updated Docker image available for the standalone CLI.
    • New bug bounty platform launched at bounties.cloudsmith.com for security researchers to submit vulnerability reports.

    2 details in Everything

41. CLI 1.20.0 no longer requires Python (2026-07-30) Jul 30, 2026 · issue 031

    Cloudsmith CLI 1.20.0 ships as a standalone binary, dropping the Python runtime dependency on Linux, macOS, and Windows.

    • Ships the Cloudsmith CLI as a self-contained binary for Linux, macOS, and Windows — no local Python installation required.
    • Adds a new one-line installer for the standalone binary.
    • Refreshed Homebrew tap and Docker image for the standalone CLI.
    • Updated GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., Azure DevOps, and CircleCI integrations to use the standalone binary.

    4 details in Everything

42. changelog Jul 25, 2026 · issue 025

    Cloudsmith CLI gains automatic OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth and Docker credential discovery; cooldown policies expand to Maven packages.

    • Introduces a Docker credential helper in the CLI to automatically authenticate to Cloudsmith registries.
    • Extends cooldown policies to Maven packages, enabling supply-chain protection against newly published versions that haven't undergone sufficient scrutiny.

    2 details in Everything

43. docs update Jul 25, 2026 · docs issue 004

    Cloudsmith CLI gains automatic OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth and Docker credential discovery; cooldown policies expand to Maven packages.

    • Introduces a Docker credential helper in the CLI to automatically authenticate to Cloudsmith registries.
    • Extends cooldown policies to Maven packages, enabling supply-chain protection against newly published versions that haven't undergone sufficient scrutiny.

    2 details in Everything

44. CLI v1.19.0: Authenticate automatically with OIDC and Docker credential discovery (2026-07-23) Jul 23, 2026 · issue 024

    Cloudsmith CLI v1.19.0 adds automatic OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. credential discovery for CI/CD and a Docker credential helper for registry auth.

    • Automatically discovers OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDC) credentials for all major CI/CD platforms, eliminating the need for static API keys in pipelines.
    • New Docker credential helper automatically authenticates to Cloudsmith registries without manual docker login steps.

    2 details in Everything

45. Cooldown policies now support Maven (2026-07-23) Jul 23, 2026 · issue 023

    Cloudsmith cooldown policies now extend to Maven packages for supply-chain protection.

    • Supports cooldown policies for Maven packages, blocking newly published versions from being consumed until a configured delay period has elapsed.

    1 detail in Everything

46. Hardened images tab for configuring upstreams (2026-07-15) Jul 15, 2026 · issue 016

    Cloudsmith adds a Hardened Images tab for proxying and caching hardened, minimal container images via upstreams.

    └──▷ HOW TO FIND IT
    Configure a hardened image upstream directly from the Cloudsmith UI without manually entering format or URL details.
    📍In the repository settings, go to Upstreams › Hardened Images tab and select the hardened image source to proxy and cache.
47. Cooldown policies now support NuGet (2026-07-07) Jul 7, 2026 · issue 014

    Cloudsmith cooldown policies now extend to NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. packages for supply-chain protection.

    • Supports cooldown policies for NuGet packages, blocking newly published versions from being consumed until a configured quarantine period has elapsed.

    1 detail in Everything

48. Cloudsmith API keys are now detectable by GitHub secret scanning (2026-07-03) Jul 3, 2026 · issue 014

    Cloudsmith API keys are now automatically detected by GitHub secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. to prevent unauthorized use.

    └──▷ HOW TO FIND IT
    Enable GitHub secret scanning on your repository so exposed Cloudsmith API keys are flagged automatically before they can be exploited.
    📍In the GitHub repository, go to Settings › Security › Code security and analysis, then enable Secret scanning.
49. Speed up Python builds with PEP-658 support (2026-07-02) Jul 2, 2026 · issue 014

    Cloudsmith now supports PEP-658, letting Python clients fetch package metadata without downloading full wheels.

50. Cooldown policies now support Go (2026-07-01) Jul 1, 2026 · issue 014

    Cloudsmith cooldown policies now extend supply-chain protection to Go packages.

    • Supports cooldown policies for Go packages, quarantining newly published versions until a configured delay period has elapsed.

    1 detail in Everything

51. Set up Docker Hub and DHI upstreams with Cloudsmith-managed authentication (2026-06-29) Jun 29, 2026 · issue 014

    Cloudsmith now manages Docker Hub and DHI upstream auth automatically, raising rate limits without user-supplied credentials.

    └──▷ HOW TO FIND IT
    Configure a Docker Hub upstream proxy in Cloudsmith without supplying your own Docker Hub credentials to get higher pull rate limits.
    📍In the Cloudsmith console, go to your repository › Upstreams › Add Upstream › Docker Hub, and complete setup without entering credentials — Cloudsmith supplies a managed token automatically.
    • Supports Cloudsmith-managed authentication for Docker Hub upstreams, eliminating the need to provide personal credentials.
    • Supports Cloudsmith-managed authentication for Docker Hardened Images (DHI) upstreams with the same credential-free setup.
    • Enables higher Docker Hub and DHI pull rate limits automatically via managed authenticated tokens versus anonymous access.

    3 details in Everything

52. Enrich packages with custom metadata (2026-06-16) Jun 16, 2026 · issue 014

    Cloudsmith now supports attaching custom key-value metadata to packages for CI, provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., compliance, and cost attribution.

53. Vulnerability detection now covers ecosystem-native OSV advisories (2026-06-16) Jun 16, 2026 · issue 014

    Cloudsmith vulnerability detection now matches OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. advisories using ecosystem-native version ranges for Debian, Alpine, PyPI, and more.

54. Manage policies as code with Terraform (2026-06-16) Jun 16, 2026 · issue 014

    Cloudsmith's Terraform provider v0.0.75 adds full lifecycle management of policies and policy actions as code.

55. More events now trigger policy evaluations (2026-06-15) Jun 15, 2026 · issue 014

    Cloudsmith adds two new events that automatically trigger policy evaluations across repositories.

    • Adds two new policy evaluation triggers so policies are enforced automatically on additional repository events without manual intervention.

    1 detail in Everything

56. Create and manage connected repositories with Terraform (2026-06-15) Jun 15, 2026 · issue 014

    Cloudsmith Terraform provider gains a new resource to define and manage connected repositories as code.

    └──▷ USE IT
    Declare a connected repository in Terraform to manage upstream proxy or mirroring configurations alongside the rest of your Cloudsmith infra.
    hcl copy

    resource "cloudsmith_connected_repository" "example" {
      # configuration fields here
    }

    • New cloudsmith_connected_repository Terraform resource enables defining connected repository configurations alongside other Cloudsmith infrastructure as code.

    1 detail in Everything