The policy editor now flags Rego problems as you write, so mistakes surface before you save rather than after. In the web app, errors appear inline in the editor and in the error panel; autocomplete also suggests schema fields as you type.

When a policy is saved, the web app and API return errors for:

Type mismatches and incorrect argument counts

Restricted variables in index-applicable policies

The web app editor checks three additional things the API does not: a warning when a policy omits 

 or a match rule, inline highlighting for malformed Rego that doesn't block saving, and autocomplete for schema field names.

The Cloudsmith CLI now ships as a standalone, self-contained binary for Linux, macOS, and Windows. This eliminates its dependency on a local Python environment. The CLI includes a new one-line installer, a refreshed Homebrew tap and Docker image, and updated GitHub Actions, Azure DevOps, and CircleCI integrations.

The standalone binary bundles everything it needs at runtime. Installation is now a single download-and-verify step that behaves identically across platforms and CI providers.

Previously, the CLI was distributed primarily as a Python zipapp (

), which requires a compatible Python runtime on any machine and CI runner that uses it. The dependency on a local Python environment often creates extra setup steps, could slow down pipelines, and is susceptible to breaking when the runner's Python version changes.

For each CLI release, we now publish platform-specific binary archives with SHA-256 checksums, attached to a GitHub release and pushed to Cloudsmith. Linux archives also ship a detached GPG signature.

The standalone binaries replace the cloudsmith.pyz zipapp, which will be deprecated.

There are 4 supported installation methods:

 for Windows. The install script detects the platform, downloads the right archive, verifies its SHA-256 checksum, and installs the CLI atomically. Each release also attaches a SHA256SUMS file for verifying the scripts themselves. For reproducible CI builds, pin a specific version instead of latest.

: 
The tap now installs the standalone binary and no longer depends on Python. Existing installs upgrade transparently with 

brew install cloudsmith-io/cloudsmith-cli/cloudsmith

: 
The official cloudsmith/cloudsmith-cli 

 on Docker Hub now ships the standalone binary on a plain Alpine base.

 
If you prefer to run in your own Python environment, you still can do so, via 

Each CI/CD integration for the Cloudsmith CLI now installs the standalone CLI and supports API key and CLI-native OIDC authentication, with no Python or additional dependencies on the runner. 

For migration steps and examples, see the guide for your integration:

: 
Cloudsmith now publishes our CLI artifacts (binaries, Docker images, and Python wheels) to the 

 repository. We are deprecating the existing 

 repository, so you should update any tooling that pulls from the deprecated repository.


The new CI/CD integrations for GitHub Actions, Azure DevOps, and CircleCI orb are major releases with breaking changes. Update your integrations with the migration guide for each.


 handles the upgrade transition automatically. After upgrading, you may have an orphaned python@3.10 dependency, which you can remove with 

CLI 1.20.0 no longer requires Python

At Cloudsmith, we recognize that security is a team sport. Meaningful improvements to our platform have come from researchers and security professionals who take the time to find issues and report them to us responsibly.

Today, we're launching a new bug bounty platform - now live at 

 - built to make it faster, clearer, and more rewarding to submit security-related bugs to Cloudsmith.


Our responsible disclosure program is a cornerstone of how we protect our customers. External reports have helped us discover and remediate vulnerabilities we might otherwise have missed - and almost always before they could affect actual users. Strong security programs are proactive, collaborative, and grounded in a shared goal of keeping the software supply chain safe.

We’ve relied historically on email inboxes and ticket-based systems, but Cloudsmith now serves a far larger enterprise customer base than we did in our early days. It was time to upgrade the process of submitting and processing reports..

The new platform is made for security researchers

With our new platform, each submission flows through a dedicated site designed for speed and transparency, showing researchers where each report stands.

In conjunction with this platform upgrade, we've made a significant change to payout timing. Rewards are now issued once we’ve confirmed a qualifying defect, rather than waiting for a fix to be deployed.

Thank you to our security researcher partners

Security is a shared responsibility, and our program reflects our commitment. We hope our new platform also reflects our commitment to encouraging security researchers to work with Cloudsmith.

If you've found something, we want to hear from you. Learn more at our 

 page. Thank you for helping us keep Cloudsmith secure.

Strengthening security together: Updating our bug bounty platform

The Cloudsmith CLI now eliminates the need for static API keys in CI/CD pipelines by automatically discovering OpenID Connect (OIDC) credentials for all major CI/CD platforms and includes a Docker credential helper to automatically authenticate to Cloudsmith registries.

Static, long-lived API keys in CI/CD pipelines are a security liability and an operational burden: they need to be created, distributed as secrets, rotated, and revoked.

v1.18.0 introduced automatic OIDC credential discovery for AWS. v1.19.0 extends it to every major CI/CD platform, so pipelines can exchange their native workload identity token for a short-lived Cloudsmith token with zero stored secrets.

 in the pipeline, and the CLI does the rest: it detects which CI environment it’s running in, obtains the platform's native OIDC token, and exchanges it with Cloudsmith for a short-lived access token.

All detectors work out of the box with no additional Python dependencies. For fine-grained control, individual detectors can be disabled and the detection order overridden via environment variables, CLI options, or 

With the credential helper, Docker can automatically discover credentials from the CLI, including for custom registry domains. Previously, authenticating Docker against Cloudsmith registries required manual 

cloudsmith credential-helper install docker

 for Cloudsmith registry domains. Custom domains are discovered automatically via the Cloudsmith API and cached.

 against Cloudsmith registries authenticate with the CLI's existing credentials with no docker login.

Automatically discover Docker credentials

The official Docker image now runs as a non-root user

Vulnerable dependencies have been upgraded, resolving all open Dependabot alerts

A packaging fix ensures zipapp (.pyz) builds start correctly on macOS

For a full summary of changes, please visit the 

CLI v1.19.0: Authenticate automatically with OIDC and Docker credential discovery

You can now apply cooldown policies to Maven packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

This feature is available in Early Access for Ultra and Enterprise customers.

Cooldown policies are now supported for npm, Python, Go, Maven, and NuGet. For more information about using cooldown policies, see 

Cooldown policies now support Maven

 tab lets you proxy and cache hardened, minimal container images without manual format/URL entry.

Pre-configured upstreams are available for the DHI Community and Chainguard Containers Free tiers.

For paid tiers (DHI Select/Enterprise, Chainguard Containers, and WizOS), the proxy URL is pre-filled automatically. Just select the card, name your upstream, and add credentials where required.

For more information, see our integration guides for 

Hardened images tab for configuring upstreams

You can now apply cooldown policies to NuGet packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

This feature is available in early access for Ultra and Enterprise customers.


Cooldown policies are now supported for npm, Python, Go, and NuGet. For more information about using cooldown policies, see 

Catch policy errors before you save

Other logs

CLI 1.20.0 no longer requires Python

Strengthening security together: Updating our bug bounty platform

CLI v1.19.0: Authenticate automatically with OIDC and Docker credential discovery

Cooldown policies now support Maven

Hardened images tab for configuring upstreams

Cooldown policies now support NuGet