Cloudsmith Changelog

The Cloudsmith CLI now sends anonymous reports of unexpected errors to Cloudsmith by default, so we can find and fix crashes without waiting for a support ticket. It also connects through Transport Layer Security (TLS) intercepting proxies without turning off certificate verification, and installs credential helpers where package-manager upgrades can't remove them. Username and password login with 'cloudsmith' login and 'cloudsmith token' is deprecated and stops working on November 20, 2026…

Username and password login with cloudsmith login and cloudsmith token is deprecated and stops working on November 20, 2026. If you authenticate the CLI by running cloudsmith login or cloudsmith token with a username and password — including from scripts and CI jobs — you need to switch to an API key before that date…

Store artifacts closer to your users and CI/CD pipelines in India, so downloads are faster…

Usage limits used to be set with sliders, which were imprecise and cumbersome. Based on customer feedback, you can now type an exact value instead. Workspace owners and managers can set them on the workspace Settings tab, under Usage limits…

Cloudsmith now supports ActiveState Curated Catalog upstreams, with configuration built into the Libraries tab…

The Cloudsmith CLI now authenticates from Buildkite pipelines and Google Cloud workloads with OpenID Connect (OIDC), so no Cloudsmith API key needs to live on your build hosts. It can also list packages from connected repositories alongside your own…

You can now apply cooldown policies to Ruby gem packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny…

A new validate endpoint returns syntax and type errors in Rego policy logic without creating or updating anything, so you can fix them before you submit…

The Cloudsmith CLI can now update itself, so you can upgrade quickly and get back to work. The CLI also authenticates Terraform to your Cloudsmith registries without storing a token, reads your workspace settings from a new --workspace option, and keeps single sign-on (SSO) sessions alive through temporary network failures…

A connected_repositories field in client log exports lists the connected repositories a package was served through, so you can trace a download back from the repository that served it…