--- title: "CLI v1.30.0: Error reporting, TLS-intercepting proxy support, and a username and password login deprecation" description: "The Cloudsmith CLI now sends anonymous reports of unexpected errors to Cloudsmith by default, so we can find and fix crashes without waiting for a support ticket. It also connects through Transport Layer Security (TLS) intercepting proxies without turning off certificate verification, and installs credential helpers where package-manager upgrades can't remove them. Username and password login with 'cloudsmith' login and 'cloudsmith token' is deprecated and stops working on November 20, 2026." canonical_url: "https://cloudsmith.com/changelog/cli-v1-30-0-error-reporting-tls-intercepting-proxy-support-and-a-username-and-password-login" last_updated: "2026-10-22T15:32:00.780Z" --- # CLI v1.30.0: Error reporting, TLS-intercepting proxy support, and a username and password login deprecation The Cloudsmith CLI now sends reports of unexpected errors to Cloudsmith by default, so we can find and fix crashes without waiting for a support ticket. It also connects through Transport Layer Security (TLS) intercepting proxies without turning off certificate verification, and installs credential helpers where package-manager upgrades can't remove them. Username and password login with `cloudsmith login` and** **`cloudsmith token` is deprecated and stops working on November 20, 2026. ## Error reporting When a command fails with an unexpected error, the CLI sends a report to Cloudsmith through [Sentry](https://sentry.io), an error-tracking service. Error reporting helps us find and fix CLI bugs, including ones nobody reports to support. New reports alert the Cloudsmith CLI team, who triage them as bugs. Usage errors, such as a missing argument, errors that the Cloudsmith API returns, and failed certificate checks are not reported. Reports aren't linked to you or your account, so for help with a specific problem, contact Cloudsmith support. A report contains: - **Error details**: the exception type, the error message, and the stack trace. - **Command**: the command name, without its arguments. - **Environment**: the CLI version and install method, the operating system, the CPU architecture, and the Python version. Before the CLI sends a report, it removes API keys, entitlement tokens, passwords, email addresses, IP addresses, file paths, your user and machine names, and host names that are not Cloudsmith hosts. The CLI never sends environment variables, local variables, or source code. The error message can include workspace, repository, and package names. Error reporting is on by default, including in CI. A failed command waits at most 2 seconds for its report to send. ### Turn off error reporting If you prefer not to send error reports, use any of the following: - **Environment variable**: set `CLOUDSMITH_NO_TELEMETRY=1`, or the cross-tool `DO_NOT_TRACK=1`. - **Config file**: set `telemetry = false` under `[default]` (or a profile) in `config.ini`. In a CI pipeline, set the variable for the whole job: ```json { "_key": "2d8a75edb3b9", "_type": "code", "code": "env:\n  CLOUDSMITH_NO_TELEMETRY: \"1\"", "filename": null, "language": null, "markDefs": null } ``` For more details, see [CLI telemetry](https://docs.cloudsmith.com/developer-tools/cli-telemetry) in the Cloudsmith documentation. ## Connect through TLS-intercepting proxies v1.30.0 adds `--without-ssl-verify-strict` for networks that inspect encrypted traffic with a TLS-intercepting proxy. Python 3.13 and later apply strict X.509 certificate checks by default, and the standalone binaries ship with the Python 3.14 runtime. Many intercepting proxies issue certificates that fail these checks, for example with `Basic Constraints of CA cert not marked critical`, so the CLI could not connect. The new option turns off only the strict checks. The CLI still verifies the certificate chain and the host name, unlike `-S`, which turns verification off completely. ```json { "_key": "a7cb7503608d", "_type": "code", "code": "cloudsmith check service --without-ssl-verify-strict", "filename": null, "language": null, "markDefs": null } ``` You can also set it once: - **Environment variable**: set `CLOUDSMITH_SSL_VERIFY_STRICT=0`. - **Config file**: set `ssl_verify_strict = false` under `[default]` in `config.ini`. The setting applies to API calls, single sign-on (SSO), uploads, downloads, the Model Context Protocol (MCP) server, and `cloudsmith update`. When a certificate check fails, the CLI now stops at once instead of retrying, and the error includes a hint with the cause. For a failed strict check, the hint names `--without-ssl-verify-strict`. For a certificate from a certificate authority (CA) that the CLI does not trust, the hint names `REQUESTS_CA_BUNDLE`, which points the CLI at a CA bundle that contains your proxy's CA. v1.30.0 also adds general names for the setting that turns certificate verification off, because it covers more than API calls: pass `--without-ssl-verify`, set `CLOUDSMITH_SSL_VERIFY=0`, or set `ssl_verify = false` in `config.ini`. Existing scripts and config files keep working: `-S`, `--without-api-ssl-verify`, `CLOUDSMITH_WITHOUT_API_SSL_VERIFY`, and `api_ssl_verify` are still accepted. For more details, see [Troubleshooting](https://docs.cloudsmith.com/developer-tools/cli#troubleshooting) in the Cloudsmith documentation. ## Credential helpers install to `~/.cloudsmith/bin` `cloudsmith credential-helper install` now puts the Docker, Cargo, and pnpm helpers in `~/.cloudsmith/bin` by default, instead of the directory that contains the `cloudsmith` executable. When the CLI is installed with a package manager such as Homebrew, that directory belongs to the package manager, so an upgrade could remove the helpers. If `~/.cloudsmith/bin` is not on your `PATH`, the Docker and Cargo install commands print the line to add to your shell profile. On Linux and macOS, add this line: ```json { "_key": "21fc6557b5a5", "_type": "code", "code": "export PATH=\"$PATH:$HOME/.cloudsmith/bin\"", "filename": null, "language": null, "markDefs": null } ``` - **Choose another directory**: pass `--bin-dir`. - **Terraform**: the Terraform helper keeps using Terraform's plugin directory. - **Helpers from earlier versions**: they stay where they were installed. To remove one with `cloudsmith credential-helper uninstall`, pass its directory with `--bin-dir`. For more details, see [Automatically discover Docker credentials](https://docs.cloudsmith.com/developer-tools/cli#automatically-discover-docker-credentials) in the Cloudsmith documentation. ## Domains come from your API host `cloudsmith domains list` and the credential helpers now get your workspace's domains, including custom domains, from the Cloudsmith API host that the CLI is configured to use, instead of a list built into the CLI. They now work with Cloudsmith deployments other than the default one. - `domains list`** output**: the JSON document keeps its version 1 shape. `primary` and `created_at` are now always `null`, because the API does not return them, and `domain_type` can also be `cloudsmith_api`. For more details, see [Custom domains](https://docs.cloudsmith.com/workspaces/custom-domains) in the Cloudsmith documentation. ## Send all CLI requests through one proxy v1.30.0 adds `--proxy`, which sends every HTTP request the CLI makes through one proxy. This includes API calls, uploads, downloads, the MCP server, `cloudsmith update` and the background update check, the credential helpers, OpenID Connect (OIDC) detection on Amazon Web Services (AWS) and Google Cloud, and error reports. `--api-proxy `covered only some of these connections. You can also set `CLOUDSMITH_PROXY`, or set `proxy` in `config.ini`. Existing scripts and config files keep working: `--api-proxy`, `CLOUDSMITH_API_PROXY`, and `api_proxy` are still accepted. `cloudsmith credential-helper install terraform` also saves the proxy in `~/.terraformrc`, so the helper uses it when Terraform runs it. A configured proxy now takes precedence over the `HTTPS_PROXY` and `HTTP_PROXY` environment variables. Without one, the CLI uses `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` as before. ## Username and password login is deprecated `cloudsmith login` and `cloudsmith token` are deprecated, and will stop working on November 20, 2026, when Cloudsmith disables username and password login. If you authenticate the CLI by running `cloudsmith login` or `cloudsmith token` with a username and password — including from scripts and CI jobs — you need to switch to an API key before that date. Until then, both commands work as before and print a deprecation warning to stderr. For more details, see the [deprecation changelog](https://cloudsmith.com/changelog/username-and-password-login-on-the-cloudsmith-cli-stops-working-on-november-20-2026). ## Requirement changes - The Python package now requires `requests` 2.32.5 or later. ## Other improvements - `cloudsmith credential-helper install terraform` now saves your workspace and API host in `~/.terraformrc`, so the helper finds the right domains when Terraform runs it, while existing entries that use `--org` keep working. - `cloudsmith download` now exits with code 1 when a file fails to download, so scripts and CI jobs can detect the failure. - `cloudsmith tokens create` now reports API errors and exits with a non-zero code, and `--save-config` no longer fails with JSON output or when you choose not to replace an existing token. - `cloudsmith credential-helper install cargo` now registers the credential provider on the first run when `~/.cargo/config.toml` exists but has no `[registry]` table. For a more detailed list of changes, see the [changelog on GitHub](https://github.com/cloudsmith-io/cloudsmith-cli/blob/master/CHANGELOG.md).