Client logs in the Cloudsmith web app now capture format-specific metadata across every package format Cloudsmith supports. This gives you complete visibility into the traffic being served across your workspace, including package metadata fetches across your toolchain, not just direct package downloads.

Format-specific metadata is currently available in client logs in the web app. Log exports will include this data from November 2026.

You can now see the full chain that led to a package download, including exactly which version a build pulled. For example, for the following npm install, the initial request results in two additional hops, all recorded and available in client logs:

Cloudsmith resolves the request to version 

 and returns a 307 redirect response to the download domain (

For more information about using client logs, see 

Client logs now show the full request chain behind a package download

Vulnerability and malicious package findings can now be exported as a JSON file directly from the web app. 

 tab to export a JSON file containing every vulnerability and malicious package record currently matched to that package.

Package vulnerability data is also available from the 

 API endpoint.

Vulnerability and malicious package detection is available on Ultra and Enterprise plans.

Download package vulnerability findings from the Cloudsmith web app

Workspace owners can grant each of the following privileges separately, without giving members the Manager or Owner role:

View workspace usage data, including artifact data and package delivery quotas

View workspace OpenID Connect (OIDC) settings

Only workspace managers and owners could previously view this data. Each privilege applies to all members of the workspace.

You can configure these in your workspace settings under 

Give members read-only access to billing, usage, and OIDC data

When an exposed Cloudsmith API key is detected in a GitHub repository, the email notification sent to the affected Cloudsmith user and workspace owners now lists every location the key was found in GitHub, with a direct link to each detection.

Pull request titles, descriptions, comments, and reviews

The Cloudsmith workspace audit log records an 

 event for each detection, with the masked key and detection location.

Exposure detection for Cloudsmith API keys in GitHub runs through the 

GitHub secret scanning notifications now link to each detection location

See how published packages are being consumed - downloads, entitlement token use, and client logs - without leaving the Broadcasts app.

See how many public, open source, and private packages are currently broadcasting and how many entitlement tokens (authentication tokens used to track and control package downloads, often issued per customer) have been active this billing cycle, alongside usage by repository and your most-downloaded packages.

An interactive world map shows download distribution, with a sortable table of usage and request counts by country. Filter by usage period, date range, country, and broadcast.

View a timestamped event stream of package requests, which you can filter by status code, package format, IP address, country, and more.

Track downloads, token use, and client logs in the Broadcasts app

Go upstreams can now point to any GOPROXY-compatible module proxy, in addition to the public mirror at 

. This lets you proxy and cache Go modules from private proxies, such as the Buf Schema Registry (BSR), giving you one place to manage, secure, and distribute these Go modules alongside the rest of your organization’s artifacts.

Configure Go upstreams for any GOPROXY-compatible proxy

The policy editor now flags Rego problems as you write, so mistakes surface before you save rather than after. In the web app, errors appear inline in the editor and in the error panel; autocomplete also suggests schema fields as you type.

When a policy is saved, the web app and API return errors for:

Type mismatches and incorrect argument counts

Restricted variables in index-applicable policies

The web app editor checks three additional things the API does not: a warning when a policy omits 

 or a match rule, inline highlighting for malformed Rego that doesn't block saving, and autocomplete for schema field names.

Catch policy errors before you save

, allowing Python package clients to fetch only metadata from the Simple API during dependency resolution.

Cloudsmith's Python Simple API index now includes .metadata links alongside package distribution files. When a compliant client like uv resolves dependencies, it fetches only the small metadata file for each candidate package rather than downloading the full archive. This allows the full dependency tree to be resolved efficiently upfront.

Previously, Python clients had to download entire packages just to read their dependency metadata. This put unnecessary strain on upstream caches and caused builds to be slow and unreliable.

Customers using Cloudsmith Python repositories with the Python Simple API enabled.

Speed up Python builds with PEP-658 support

Cloudsmith now handles authentication for Docker Hub and Docker Hardened Images (DHI) upstreams using a managed token, removing the need to supply your own credentials during setup. Authenticated requests receive a higher rate limit than anonymous access.

When a Docker Hub or DHI upstream is created without credentials, Cloudsmith uses a managed Docker Hub organization access token (OAT) to authenticate requests on your behalf. Workspace names are shared with Docker to attribute usage when the Cloudsmith-managed token is used.


A pre-configured DHI upstream is also available, so you can start proxying and caching images from the DHI Community tier immediately.


 are minimal, secure, and production-ready container base and application images maintained by Docker. Designed to reduce vulnerabilities and simplify compliance, DHI integrate easily into your existing Docker-based workflows with little to no retooling required.

To access the DHI Select or Enterprise tiers, you must configure the DHI registry as a private upstream with your Docker Hub credentials.

For more information about creating Docker Hub and DHI upstreams in Cloudsmith, see:

Set up Docker Hub and DHI upstreams with Cloudsmith-managed authentication 

Packages from Debian, Alpine, PyPI, and other ecosystems that use native version ranges are now matched against a broader set of OSV advisories, building on existing coverage for SemVer-based ranges.

Users with active vulnerability policies that use the 

 dataset may see more policy matches than before. This is expected: your policies are now being evaluated against a more complete set of advisories. It's broader coverage, not noise.

 for more information on how to access the OSV.dev dataset to create your vulnerability policies.

Cloudsmith Changelog