CLI v1.30.1 and v1.31.0: AI Skills Registry, Maven, Gradle, and sbt credential helpers, and warnings for renamed options

The Cloudsmith CLI now manages AI Skills from the terminal. It also sets up Maven, Gradle, and sbt to get credentials from the CLI, so your build files no longer need a stored API key, warns when you use a deprecated option name, and remembers your workspace after a SAML login.

Manage AI Skills upstreams and push skill folders (1.31.0)

Cache skills and plugins from a GitHub repository, and manage those upstreams from the terminal with cloudsmith upstream skills (list, create, update, and delete).

cloudsmith push skills also adds two options:

• --compress: push a skill folder instead of a .zip archive. The CLI compresses the folder, then uploads it. The archive leaves out .git, .env, and operating system files such as .DS_Store, and a folder that contains a symbolic link gives a usage error. Without --compress, a folder gives a usage error.
• --changelog: add release notes to the package.

cloudsmith push skills WORKSPACE/REPOSITORY ./SKILL-FOLDER --compress --changelog "RELEASE NOTES"

The AI Skills Registry is in early access. To try it, contact us. For more information, see AI Skills registry in the Cloudsmith documentation.

Authenticate Maven, Gradle, and sbt builds with the CLI (1.31.0)

Maven, Gradle, and sbt builds now get a short-lived credential from the CLI, so your settings.xml, gradle.properties, and build.sbt no longer need a stored API key. This works like the Docker, Cargo, pnpm, and Terraform credential helpers. Each install command sets up one of the Cloudsmith Maven tools: a Maven extension, a Gradle plugin, or an sbt plugin. At build time, the tool gets a credential from the CLI and sends it only to Cloudsmith hosts.

cloudsmith credential-helper install maven
cloudsmith credential-helper install gradle
cloudsmith credential-helper install sbt

Each command downloads the newest release from the public cloudsmith/maven-tools repository and sets it up for all builds run by your user account:

• Maven: the command puts the extension in the local repository that Maven reports (~/.m2/repository by default) and adds it to ~/.m2/extensions.xml, which enables the plugin for every Maven build.
• Gradle: the command writes an init script to init.d in the Gradle user home that Gradle reports (~/.gradle by default), which applies the plugin to every Gradle build.
• sbt: the command writes a global plugin to the global plugins directory that sbt reports (~/.sbt/1.0/plugins by default), which enables the plugin to for every sbt build.

Configuration is still required to point the build tools at your Cloudsmith repository. For example, for Maven this looks like the following:
Configuration is still required to point the build tools at your Cloudsmith repository. For example, for Maven this looks like the following:

<repository>
  <id>cloudsmith</id>
  <url>https://dl.cloudsmith.io/basic/WORKSPACE/REPOSITORY/maven/</url>
</repository>

To remove a setup, run cloudsmith credential-helper uninstall maven (or gradle, or sbt). It removes only what install added.

For more details, see Resolve a credential for external tools in the Cloudsmith documentation.

Deprecation: Old names of options, environment variables, and config.ini keys

The old names of renamed options, environment variables, and config.ini keys are deprecated, and will be removed in a future release. Until then, they work as before. When you use one, the CLI prints a warning to stderr, once per run, that names the replacement:

Warning: `--org` is deprecated and will be removed in version 2.0.0. Use `--workspace` instead.

The CLI warns only when an old name has an effect. For example, it does not warn about CLOUDSMITH_ORG when CLOUDSMITH_WORKSPACE is also set. The credential helpers that Docker, Cargo, pnpm, and Terraform run do not print the warning. The old names no longer show in --help.

When you give an old and a new option on the same command line, such as --org a --workspace b, the new option now wins. All deprecation warnings now start with Warning: instead of DEPRECATION WARNING:.

cloudsmith auth remembers your workspace

After a successful Security Assertion Markup Language (SAML) login, cloudsmith auth now saves the workspace to config.ini so later commands use it without -w (v.1.30.1). The CLI writes to the [profile:NAME] section when you select a profile with -P or CLOUDSMITH_PROFILE, and to [default] when you do not. It writes to the file that --config-file gives, or else to your user-level config.ini, and creates the file if it does not exist. Only the workspace line changes. If the CLI cannot write the file, it shows a warning and the login still succeeds.

For more details, see config.ini in the Cloudsmith documentation.

Credential helpers keep your config files intact

The credential helpers now leave content that they do not own alone:

• Files that do not parse: cloudsmith credential-helper install and uninstall stop with an error that names a Docker config.json or Cargo config.toml that does not parse, instead of writing over it. Correct or remove the file, then run the command again (v1.31.0).
• Unchanged files: the commands no longer rewrite a config file when its data does not change, so the formatting of a file such as Docker's tab-indented config.json stays as it is (v1.31.0).
• Cargo: install cargo keeps a credential-provider that you set on a Cloudsmith registry, and shows a warning that names the registry (v1.31.0).
• pnpm: install pnpm ends .npmrc with a newline, so a line that a script appends to the file no longer joins the tokenHelper line. To repair an existing .npmrc, run the install again (v1.30.1).
  
  Note: If a line is already joined, split it first, or the install removes the appended token.
  
• Docker: uninstall docker no longer creates ~/.docker/config.json when the file does not exist (v1.30.1).
• Terraform: install terraform now escapes the arguments it writes to ~/.terraformrc, so a Windows path in --config-file no longer makes Terraform reject the file. Run the install again to fix a file that an earlier version wrote (v1.31.0).

Security update: eMudhra certificate authority (CA) keys (CVE-2026-115557)

In response to the compromised eMudhra CA keys (CVE-2026-115557), the following updates shipped on 28 October 2026:

• The standalone binaries and the Docker image now ship with the Python 3.14.10 runtime (v1.30.1).
• The Python package now requires certifi 2026.10.23 or later (v1.30.1).

Other improvements

• OpenID Connect (OIDC) authentication now works when the CLI cannot create its config directory, for example in a continuous integration (CI) container with a read-only home directory (v1.30.1).
• API requests no longer wait without a limit: a request fails if it cannot connect in 30 seconds or gets no data for 90 seconds, and the CLI then retries it (v1.31.0).
• A mistyped API or proxy hostname now fails at once instead of after approximately 62 seconds of silent retries, and other retries print Request failed: retrying in N second(s) ... to stderr (v1.31.0).
• cloudsmith login, cloudsmith logout, and --save-config now set credentials.ini to mode 0600, so other members of your group can no longer read your API key (v1.31.0).
• A profile that you select with -P now keeps the telemetry, update check, and certificate verification settings of the [default] section of config.ini. Before, a profile that did not set them turned them back on (v1.31.0).
• cloudsmith vulnerabilities now shows an error and exits with a non-zero code when a package has no scan results, so a CI gate no longer treats an unscanned package as clean (v1.30.1).
• With -F json, list commands now give the correct meta.pagination.page_results_len, which was one less than the number of results on the page; scripts that added 1 to it must stop doing so (v1.30.1).
• cloudsmith copy, move, and resync with --skip-errors now print a skipped API error once and exit with code 0, the same as cloudsmith push (v1.31.0).
• On Windows, cloudsmith mcp configure, download, and update no longer fail when their output goes to a pipe or a file; their messages on every platform now use plain text instead of symbols such as ✓ (v1.30.1).

For a more detailed list of changes, see the changelog on GitHub.