--- title: "CLI v1.30.1 and v1.31.0: AI Skills Registry, Maven, Gradle, and sbt credential helpers, and warnings for renamed options" description: "The Cloudsmith CLI now manages AI Skills from the terminal. It also sets up Maven, Gradle, and sbt to get credentials from the CLI, so your build files no longer need a stored API key, warns when you use a deprecated option name, and remembers your workspace after a SAML login." canonical_url: "https://cloudsmith.com/changelog/cli-v1-30-1-and-v1-31-0-ai-skills-registry-maven-gradle-and-sbt-credential-helpers-and-warnings" last_updated: "2026-11-13T15:42:06.526Z" --- # CLI v1.30.1 and v1.31.0: AI Skills Registry, Maven, Gradle, and sbt credential helpers, and warnings for renamed options The Cloudsmith CLI now manages AI Skills from the terminal. It also sets up Maven, Gradle, and sbt to get credentials from the CLI, so your build files no longer need a stored API key, warns when you use a deprecated option name, and remembers your workspace after a SAML login. ## **Manage AI Skills upstreams and push skill folders (1.31.0)** Cache skills and plugins from a GitHub repository, and manage those upstreams from the terminal with `cloudsmith upstream skills` (`list`, `create`, `update`, and `delete)`. `cloudsmith push skills` also adds two options: - `--compress`: push a skill folder instead of a `.zip` archive. The CLI compresses the folder, then uploads it. The archive leaves out .git, .env, and operating system files such as .DS_Store, and a folder that contains a symbolic link gives a usage error. Without `--compress`, a folder gives a usage error. - `--changelog`: add release notes to the package. ```json { "_key": "bbb6b11314e4", "_type": "code", "code": "cloudsmith push skills WORKSPACE/REPOSITORY ./SKILL-FOLDER --compress --changelog \"RELEASE NOTES\"", "filename": null, "language": null, "markDefs": null } ``` The AI Skills Registry is in early access. To try it, [contact us](/company/contact-us). For more information, see [AI Skills registry](https://docs.cloudsmith.com/formats/ai-skills-registry) in the Cloudsmith documentation. ## **Authenticate Maven, Gradle, and sbt builds with the CLI (1.31.0)** Maven, Gradle, and sbt builds now get a short-lived credential from the CLI, so your `settings.xml`, `gradle.properties`, and `build.sbt` no longer need a stored API key. This works like the Docker, Cargo, pnpm, and Terraform credential helpers. Each install command sets up one of the Cloudsmith Maven tools: a Maven extension, a Gradle plugin, or an sbt plugin. At build time, the tool gets a credential from the CLI and sends it only to Cloudsmith hosts. ```json { "_key": "d975fc103e92", "_type": "code", "code": "cloudsmith credential-helper install maven\ncloudsmith credential-helper install gradle\ncloudsmith credential-helper install sbt", "filename": null, "language": null, "markDefs": null } ``` Each command downloads the newest release from the public [`cloudsmith/maven-tools`](https://broadcasts.cloudsmith.com/cloudsmith/maven-tools) repository and sets it up for all builds run by your user account: - **Maven**: the command puts the extension in the local repository that Maven reports (~/.m2/repository by default) and adds it to `~/.m2/extensions.xml`, which enables the plugin for every Maven build. - **Gradle**: the command writes an init script to init.d in the Gradle user home that Gradle reports (~/.gradle by default), which applies the plugin to every Gradle build. - **sbt**: the command writes a global plugin to the global plugins directory that sbt reports (~/.sbt/1.0/plugins by default), which enables the plugin to for every sbt build. Configuration is still required to point the build tools at your Cloudsmith repository. For example, for Maven this looks like the following: Configuration is still required to point the build tools at your Cloudsmith repository. For example, for Maven this looks like the following: ```json { "_key": "5482b4037d09", "_type": "code", "code": "\n  cloudsmith\n  https://dl.cloudsmith.io/basic/WORKSPACE/REPOSITORY/maven/\n", "filename": null, "language": null, "markDefs": null } ``` To remove a setup, run `cloudsmith credential-helper uninstall maven` (or `gradle`, or `sbt`). It removes only what `install` added. For more details, see [Resolve a credential for external tools](https://docs.cloudsmith.com/developer-tools/cli#resolve-a-credential-for-external-tools) in the Cloudsmith documentation. ## **Deprecation: Old names of options, environment variables, and config.ini keys** The old names of renamed options, environment variables, and `config.ini` keys are deprecated, and will be removed in a future release. Until then, they work as before. When you use one, the CLI prints a warning to stderr, once per run, that names the replacement: ```json { "_key": "e5bdee5ecfe7", "_type": "code", "code": "Warning: `--org` is deprecated and will be removed in version 2.0.0. Use `--workspace` instead.", "filename": null, "language": null, "markDefs": null } ``` ```json { "_key": "46265c24dda3", "_type": "tableBlock", "firstRowIsHeader": true, "markDefs": null, "table": { "rows": [ { "_key": "0eb00433-d2b0-4aba-8965-e82ab7bf7654", "_type": "tableRow", "cells": [ "Deprecated name", "Replacement" ] }, { "_key": "55eea615-514f-4b53-b541-c49c014ea437", "_type": "tableRow", "cells": [ "--org, --organization, --oidc-org, --owner, -o", "--workspace, -w" ] }, { "_key": "c13a4600-5c1e-4193-ac75-d60bc77edabd", "_type": "tableRow", "cells": [ "CLOUDSMITH_ORG", "CLOUDSMITH_WORKSPACE" ] }, { "_key": "239d63c4-10da-4af2-86ce-641830e3cf01", "_type": "tableRow", "cells": [ "org, organization, oidc_org in config.ini", "workspace" ] }, { "_key": "cdc62054-c61d-4f03-8038-e77361af14c2", "_type": "tableRow", "cells": [ "--without-api-ssl-verify, -S", "--without-ssl-verify" ] }, { "_key": "7f7a026a-ca46-461a-aafb-28e638667f4f", "_type": "tableRow", "cells": [ "CLOUDSMITH_WITHOUT_API_SSL_VERIFY", "CLOUDSMITH_SSL_VERIFY=0" ] }, { "_key": "dd6ebdb7-6913-4342-bf08-ed0d914a2d02", "_type": "tableRow", "cells": [ "api_ssl_verify in config.ini", "ssl_verify" ] }, { "_key": "cf97cab1-d967-407a-bd54-250d1bd45847", "_type": "tableRow", "cells": [ "--api-proxy", "--proxy" ] }, { "_key": "b1023204-77cc-40f6-b0a6-ce023546472b", "_type": "tableRow", "cells": [ "CLOUDSMITH_API_PROXY", "CLOUDSMITH_PROXY" ] }, { "_key": "908ac3d1-d33f-4f3e-afcc-1254919bdf43", "_type": "tableRow", "cells": [ "api_proxy in config.ini", "proxy" ] }, { "_key": "cce7c573-4ba5-45e5-ac46-6bf393ee6934", "_type": "tableRow", "cells": [ "--show-all", "--page-all" ] }, { "_key": "87c628aa-eaac-4664-b2c0-036f9fac8b97", "_type": "tableRow", "cells": [ "cloudsmith auth --token, --force", "cloudsmith auth --request-api-key" ] }, { "_key": "2ec40299-1dfe-46a0-999a-48e03b8d9f6c", "_type": "tableRow", "cells": [ "cloudsmith auth --json", "cloudsmith auth --output-format json" ] } ] } } ``` The CLI warns only when an old name has an effect. For example, it does not warn about `CLOUDSMITH_ORG` when `CLOUDSMITH_WORKSPACE` is also set. The credential helpers that Docker, Cargo, pnpm, and Terraform run do not print the warning. The old names no longer show in `--help`. When you give an old and a new option on the same command line, such as `--org a --workspace b`, the new option now wins. All deprecation warnings now start with `Warning:` instead of `DEPRECATION WARNING:`. ## `cloudsmith auth`** remembers your workspace** After a successful Security Assertion Markup Language (SAML) login, `cloudsmith auth` now saves the workspace to `config.ini` so later commands use it without `-w` (v.1.30.1). The CLI writes to the `[profile:NAME]` section when you select a profile with `-P` or `CLOUDSMITH_PROFILE`, and to `[default]` when you do not. It writes to the file that `--config-file` gives, or else to your user-level `config.ini,` and creates the file if it does not exist. Only the workspace line changes. If the CLI cannot write the file, it shows a warning and the login still succeeds. For more details, see [config.ini](https://docs.cloudsmith.com/developer-tools/cli#configini) in the Cloudsmith documentation. ## **Credential helpers keep your config files intact** The credential helpers now leave content that they do not own alone: - **Files that do not parse**: `cloudsmith credential-helper install` and `uninstall` stop with an error that names a Docker `config.json` or Cargo `config.toml` that does not parse, instead of writing over it. Correct or remove the file, then run the command again (v1.31.0). - **Unchanged files**: the commands no longer rewrite a config file when its data does not change, so the formatting of a file such as Docker's tab-indented `config.json` stays as it is (v1.31.0). - **Cargo**: `install cargo` keeps a `credential-provider` that you set on a Cloudsmith registry, and shows a warning that names the registry (v1.31.0). - **pnpm**: `install pnpm` ends `.npmrc` with a newline, so a line that a script appends to the file no longer joins the `tokenHelper` line. To repair an existing `.npmrc`, run the install again (v1.30.1). **Note: **If a line is already joined, split it first, or the install removes the appended token. - **Docker**: `uninstall docker` no longer creates `~/.docker/config.json` when the file does not exist (v1.30.1). - **Terraform**: `install terraform` now escapes the arguments it writes to `~/.terraformrc`, so a Windows path in `--config-file` no longer makes Terraform reject the file. Run the install again to fix a file that an earlier version wrote (v1.31.0). ## **Security update: eMudhra certificate authority (CA) keys (CVE-2026-115557)** In response to the compromised eMudhra CA keys (CVE-2026-115557), the following updates shipped on 28 October 2026: - The standalone binaries and the Docker image now ship with the Python 3.14.10 runtime (v1.30.1). - The Python package now requires `certifi` 2026.10.23 or later (v1.30.1). ## **Other improvements** - OpenID Connect (OIDC) authentication now works when the CLI cannot create its config directory, for example in a continuous integration (CI) container with a read-only home directory (v1.30.1). - API requests no longer wait without a limit: a request fails if it cannot connect in 30 seconds or gets no data for 90 seconds, and the CLI then retries it (v1.31.0). - A mistyped API or proxy hostname now fails at once instead of after approximately 62 seconds of silent retries, and other retries print `Request failed: retrying in N second(s) ...` to stderr (v1.31.0). - `cloudsmith login`, `cloudsmith logout`, and `--save-config` now set `credentials.ini` to mode `0600`, so other members of your group can no longer read your API key (v1.31.0). - A profile that you select with -P now keeps the telemetry, update check, and certificate verification settings of the [default] section of config.ini. Before, a profile that did not set them turned them back on (v1.31.0). - `cloudsmith vulnerabilities` now shows an error and exits with a non-zero code when a package has no scan results, so a CI gate no longer treats an unscanned package as clean (v1.30.1). - With `-F json`, list commands now give the correct `meta.pagination.page_results_len`, which was one less than the number of results on the page; scripts that added 1 to it must stop doing so (v1.30.1). - `cloudsmith copy`, `move`, and `resync` with `--skip-errors` now print a skipped API error once and exit with code 0, the same as `cloudsmith push` (v1.31.0). - On Windows, `cloudsmith mcp configure`, `download`, and `update` no longer fail when their output goes to a pipe or a file; their messages on every platform now use plain text instead of symbols such as `✓` (v1.30.1). For a more detailed list of changes, see the [changelog on GitHub](https://github.com/cloudsmith-io/cloudsmith-cli/blob/master/CHANGELOG.md).