Client log exports now contain the format-specific metadata requests your toolchain makes, so you can see the full request chain behind a download. 

Client logs in the web app already show these requests

Metadata requests use the existing log structure.

With format-specific metadata, export volume will increase. A single install can generate several metadata requests per package, so expect more rows than before. If you have questions about this change, 

Log exports are available on Ultra and Enterprise plans. For more details, see 

Exemptions defined in cooldown policies let specific packages skip the cooldown period and become available immediately, so a new release that fixes a vulnerability doesn’t have to wait. Exempt packages are still evaluated against your other active policies, and any action those policies define still applies.

Add exemptions in the cooldown policy’s Rego (the policy language used by Open Policy Agent) via the Cloudsmith web app, API, or Terraform provider. Each exemption applies to one format and matches by:

Existing policies will continue to work. To add exemptions to one:

 we’ve already migrated these to the new Rego template. Edit the policy in the web app to add exemptions.

Created via the API or Terraform provider:

 we haven’t migrated these to the new template, because doing so would break on the next 

 for Terraform-managed policies. To add exemptions, either delete the policy and recreate it from the updated template, including the policy action that sets the package state to 

, or contact us and we’ll help you migrate it. If you recreate it, do so straight away, because packages held in cooldown become available while no policy exists.

Exempt specific packages from your cooldown policies

Vulnerability records now show how likely each vulnerability is to be exploited, so you can order a backlog of High and Critical findings by what’s likely to be attacked, not just by severity.

The scores come from the Exploit Prediction Scoring System (EPSS), maintained by the Forum of Incident Response and Security Teams (

). EPSS estimates the probability of exploitation in the next 30 days. EPSS data was already available in Cloudsmith’s policies. It now also appears as a score and percentile in vulnerability records on the package 

tab of the Cloudsmith web app, and in the 

EPSS data is available on Ultra and Enterprise plans.

Prioritize vulnerabilities by likelihood of exploitation with EPSS scores

 checks every package against new vulnerability data as soon as it arrives, with no scheduled or manual rescans. It is powered by the 

 (OSV.dev) and has been generally available since August 2026. See 

We are switching Trivy scanning off in stages, starting on 2 November 2026 for workspaces that use it only for upload scans, manual rescans, or recurring scheduled scans. It will be off for all workspaces by 31 March 2027.

If you use Trivy only for upload scans, manual rescans, or recurring scheduled scans

: continuous risk detection covers these automatically. We will switch Trivy off for your workspace on 2 November 2026. No action is needed on your part.

 move your integrations to the OSV endpoints by 31 March 2027.

 data by 31 March 2027. For examples of how to use OSV data in policies, see the policy templates in the web app.

If you use standard vulnerability policies, Datadog security insights, or the 

 these features are moving to OSV.dev. We will be in touch with how to migrate them.

If you use any feature that needs migration, our Customer Success team will contact you to plan the migration and make sure it’s complete before Trivy is switched off for your workspace, no later than 31 March 2027. If you have questions before then, 

Deprecating Trivy vulnerability scanning

Cloudsmith’s npm client support now serves npm's attestations and signing keys APIs, so provenance verification works through Cloudsmith just as it does when connecting directly to the upstream registry.

npm packages can be published with signed provenance: a verifiable statement that a specific tarball was built from a specific source repository using a specific workflow. Clients verify this with 

, and pnpm 11 and later request them during dependency resolution.

While indexing an npm upstream, Cloudsmith stores the provenance attestations published alongside each package and serves them from the same endpoints npm clients already expect (

Verification remains client-side: your client checks provenance against Sigstore’s public trust root, and registry signatures against the signing keys Cloudsmith serves. Re-serving this data through Cloudsmith doesn’t change the trust model.

Verify npm provenance through your Cloudsmith registry

Two changes reduce the work involved in resolving npm packages: pnpm clients make fewer requests to Cloudsmith, and every npm repository makes fewer lookups to upstreams. No configuration changes are needed.

For each package downloaded, pnpm clients now make 40% fewer metadata requests and 92% fewer attestations requests. Installs finish faster and CI builds stay lighter, especially on fresh runners with no local cache.

More npm metadata served from Cloudsmith’s index

Cloudsmith indexes npm metadata as packages are requested, then serves it directly instead of calling the upstream each time, so resolution gets faster the more a repository is used. This means lower latency, faster installs, and less reliance on upstream availability.

npm installs are now faster, with fewer requests and lookups

The Cloudsmith CLI now sends reports of unexpected errors to Cloudsmith by default, so we can find and fix crashes without waiting for a support ticket. It also connects through Transport Layer Security (TLS) intercepting proxies without turning off certificate verification, and installs credential helpers where package-manager upgrades can't remove them. 

 is deprecated and stops working on November 20, 2026.

When a command fails with an unexpected error, the CLI sends a report to Cloudsmith through 

, an error-tracking service. Error reporting helps us find and fix CLI bugs, including ones nobody reports to support. New reports alert the Cloudsmith CLI team, who triage them as bugs. 

Usage errors, such as a missing argument, errors that the Cloudsmith API returns, and failed certificate checks are not reported. Reports aren't linked to you or your account, so for help with a specific problem, contact Cloudsmith support.

: the exception type, the error message, and the stack trace.

: the command name, without its arguments.

: the CLI version and install method, the operating system, the CPU architecture, and the Python version.

Before the CLI sends a report, it removes API keys, entitlement tokens, passwords, email addresses, IP addresses, file paths, your user and machine names, and host names that are not Cloudsmith hosts. The CLI never sends environment variables, local variables, or source code. The error message can include workspace, repository, and package names.

Error reporting is on by default, including in CI. A failed command waits at most 2 seconds for its report to send.

If you prefer not to send error reports, use any of the following:

In a CI pipeline, set the variable for the whole job:

 for networks that inspect encrypted traffic with a TLS-intercepting proxy. Python 3.13 and later apply strict X.509 certificate checks by default, and the standalone binaries ship with the Python 3.14 runtime. Many intercepting proxies issue certificates that fail these checks, for example with 

Basic Constraints of CA cert not marked critical

The new option turns off only the strict checks. The CLI still verifies the certificate chain and the host name, unlike 

, which turns verification off completely.

The setting applies to API calls, single sign-on (SSO), uploads, downloads, the Model Context Protocol (MCP) server, and 

When a certificate check fails, the CLI now stops at once instead of retrying, and the error includes a hint with the cause. For a failed strict check, the hint names 

. For a certificate from a certificate authority (CA) that the CLI does not trust, the hint names 

, which points the CLI at a CA bundle that contains your proxy's CA.

v1.30.0 also adds general names for the setting that turns certificate verification off, because it covers more than API calls: pass 

. Existing scripts and config files keep working: 

 now puts the Docker, Cargo, and pnpm helpers in 

 by default, instead of the directory that contains the 

 executable. When the CLI is installed with a package manager such as Homebrew, that directory belongs to the package manager, so an upgrade could remove the helpers.

, the Docker and Cargo install commands print the line to add to your shell profile. On Linux and macOS, add this line:

: the Terraform helper keeps using Terraform's plugin directory.

: they stay where they were installed. To remove one with 

Automatically discover Docker credentials

 and the credential helpers now get your workspace's domains, including custom domains, from the Cloudsmith API host that the CLI is configured to use, instead of a list built into the CLI. They now work with Cloudsmith deployments other than the default one.

: the JSON document keeps its version 1 shape. 

, because the API does not return them, and 

, which sends every HTTP request the CLI makes through one proxy. This includes API calls, uploads, downloads, the MCP server, 

 and the background update check, the credential helpers, OpenID Connect (OIDC) detection on Amazon Web Services (AWS) and Google Cloud, and error reports. 

cloudsmith credential-helper install terraform

, so the helper uses it when Terraform runs it.

A configured proxy now takes precedence over the 

 environment variables. Without one, the CLI uses 

Username and password login is deprecated

 are deprecated, and will stop working on November 20, 2026, when Cloudsmith disables username and password login. If you authenticate the CLI by running 

 with a username and password — including from scripts and CI jobs — you need to switch to an API key before that date.

Until then, both commands work as before and print a deprecation warning to stderr. For more details, see the 

 now saves your workspace and API host in 

, so the helper finds the right domains when Terraform runs it, while existing entries that use 

 now exits with code 1 when a file fails to download, so scripts and CI jobs can detect the failure.

 now reports API errors and exits with a non-zero code, and 

 no longer fails with JSON output or when you choose not to replace an existing token.

cloudsmith credential-helper install cargo

 now registers the credential provider on the first run when 

For a more detailed list of changes, see the 

Client log exports now include metadata requests, not just downloads

Other logs

Exempt specific packages from your cooldown policies

Prioritize vulnerabilities by likelihood of exploitation with EPSS scores

Deprecating Trivy vulnerability scanning

Verify npm provenance through your Cloudsmith registry

npm installs are now faster, with fewer requests and lookups

CLI v1.30.0: Error reporting, TLS-intercepting proxy support, and a username and password login deprecation