A crucial part of effective package management is package distribution. Whether you are dealing with distributed teams or deploying global applications, you need efficient, reliable delivery - anywhere in the world.

To support this, we are continuing to expand our global footprint and are now live in Tokyo.

: We have upgraded our edge infrastructure in APAC. Unlike standard CDNs, Cloudsmith’s PDN is context-aware and optimized specifically for software artifacts.

: Users and build pipelines in Asia will experience faster throughput.

: We now handle authentication logic directly at the Tokyo edge node. This significantly reduces round-trip times for "chatty" protocols (like Maven, NuGet, or Docker) by validating credentials locally rather than routing back to the origin.

: For organizations with strict data residency requirements, you can now explicitly select Tokyo as your storage region. This ensures your data rests physically within Japan, satisfying local compliance needs.

The Tokyo region is available when creating a new repository, and all customers will automatically experience the performance benefits of our expanded PDN.

This update to the Cloudsmith CLI introduces programmatic management for Policy Deny Rules, standardizes pagination parameters across the CLI, and upgrades core dependencies.

The CLI now supports full lifecycle management for Policy Deny Rules, enabling tighter integration with infrastructure-as-code workflows. Users can list, create, update, and delete deny policies directly via the command line.

cloudsmith policy deny create <org> POLICY_CONFIG_FILE

cloudsmith policy deny update <org> POLICY_CONFIG_FILE

 for contributing this feature. We welcome community pull requests and feedback to help drive the CLI forward.

To improve consistency, we have updated how pagination is handled across the CLI.

 is the new standard flag for listing all results, replacing 

 remains available as an alias, so existing scripts will not break. However, we recommend updating to 

 as values to instantly retrieve all results.

 Fixed the entitlement token list command to correctly support the new 

 Resolved a dependency conflict preventing installation on Python 3.9 environments.

For a full summary of changes, please visit the 

CLI v1.10.1: Policy deny rules and usability improvements

You can now download auto-generated Software Bills of Materials (SBOMs) for your Docker and OCI images directly from the Cloudsmith web app. This allows you to instantly export supply chain data for use in analysis tools or alongside release documentation.

Previously, SBOMs generated by Cloudsmith were only accessible via the 

. Instead of scripting an API call to retrieve the manifest for a specific image, you can now grab the 

 file with a single click, making SBOMs accessible to a broader range of users.

Click the Actions menu → "Download SBOM"

Downloads are provided in CycloneDX format.

This feature applies only to SBOMs automatically generated by Cloudsmith during the container image synchronization process.

Cloudsmith automatically generates SBOMs for Docker V2 and OCI V1 images.

​​This feature is live and available immediately for all Docker images. If you have any questions or feedback, please 

Download SBOMs directly from the web app

 is “honesty and transparency.” To ensure we’re living up to that value, we’ve given the 

 an overhaul. When Cloudsmith services experience an incident, we want you to know exactly how it impacts your builds, your deployments, and your teams.

This update provides a more granular and organized view of system health from our customers’ perspective, aligning our status reporting directly with the specific workflows you run every day.

To provide a more accurate view of operations and make the impact of incidents easier to understand at a glance, we have made the following structural changes:

: We have updated component names to better reflect the actions occurring within the platform:

Package Upload Processing → Package Uploads

Package Distribution → Package Downloads

Client Logs / Audit Logs export → Audit & Client Log Exports

: We have added new service areas for Security Scanning, Continuous Security, Upstreams, Broadcasts, and Integrations.

: These are now separated into the Cloudsmith Web App (app.cloudsmith.com), Legacy Web App (cloudsmith.io), Broadcasts, Blog, and Help & Documentation.

 These are now grouped together for clarity, including Webhooks, Audit & Client Log Exports, Datadog, and OpenID Connect.

: Each component now features a hover description to explain its function.

Slack & RSS: Subscribers will continue receiving all notifications exactly as before.

Email: Subscriptions will work with the updated component names. However, because we have added new components, 

 to subscribe to these new areas (like Security Scanning) to ensure you receive alerts for them.

We’d love to hear your questions or comments about these changes - just 

Get a more granular view of incident impact with Cloudsmith’s reorganized Status Page

 to support native Azure DevOps OIDC authentication. You can now authenticate pipelines using the Azure DevOps built-in issuer, completely removing the dependency on Microsoft Entra (Azure AD) App Registrations.

OpenID Connect (OIDC) is the gold standard for pipeline security, utilizing short-lived tokens and granular claims. Previously, adopting OIDC in Azure DevOps was complex, requiring the creation of a Microsoft Entra App and the management of static secrets like client and tenant IDs. This dependency often blocked DevOps teams, forcing them to wait on elevated IT or security permissions just to configure a build pipeline.

This update removes that friction entirely. By leveraging the native Azure DevOps issuer, teams can now achieve a "zero-config" setup that bypasses Entra App Registrations. This restores autonomy to DevOps engineers, allowing them to self-serve secure authentication configurations directly within the pipeline while maintaining strict security standards.

To adopt the new flow, create an OIDC provider in Cloudsmith with the Provider URL 

Native OIDC authentication for Azure DevOps

 to capture error events, giving platform engineering teams the critical information needed to troubleshoot build issues on behalf of their teams.

 only displayed successful activity, so it could be challenging to manually piece together context when errors occurred. With this update, Cloudsmith provides more comprehensive observability into your software supply chain. By surfacing requests that result in an error alongside successful ones, your team gains a centralized view of system health, making it easier to spot trends and resolve issues quickly.

: In addition to the status code, logs capture key request details including method, path, timestamp, user agent, IP address, and location.

This feature is available now in the Cloudsmith web app for customers using 

. Error logs will also soon be available in your Cloudsmith client log exports; please 

Troubleshoot failed download requests with client error logs

, Cloudsmith will no longer store historical scan results from Trivy scans; only the latest scan results from Trivy scans for each package will be available.

This change affects historical data that is 

. Historical scan results are not displayed in the Cloudsmith web app. Usage analysis indicates that no customers currently access this historical data. If you interact with our vulnerability endpoints today, you are likely already focusing on the latest scan results, which will remain fully accessible.

We are removing this unused data to improve platform performance and prepare for upcoming security features.

 Historical scan data accounts for a large portion of our database size. By removing this unused historical data, we will improve response times for package search endpoints.

 This cleanup supports our transition to 

 in 2026. Continuous Security will replace Trivy scans with an hourly feed that automatically matches new threats to your artifacts, providing faster and more accurate security insights.

The vulnerability API endpoints listed below will remain active and still return a list. The only change in behavior is that the data returned will be the 

 scan result for a package, rather than historical scans.

https://docs.cloudsmith.com/api/vulnerabilities/namespace/list

https://docs.cloudsmith.com/api/vulnerabilities/package/list

https://docs.cloudsmith.com/api/vulnerabilities/read

https://docs.cloudsmith.com/api/vulnerabilities/repo/list

For more information on the upcoming Continuous Security features, please read our 

. If you have any questions or concerns about this upcoming change, please 

Accelerating delivery in APAC: Cloudsmith Tokyo is now live

What’s new

Other logs

CLI v1.10.1: Policy deny rules and usability improvements

Download SBOMs directly from the web app

Get a more granular view of incident impact with Cloudsmith’s reorganized Status Page

Native OIDC authentication for Azure DevOps

Troubleshoot failed download requests with client error logs

Deprecating historical scan results retention