---
title: "CircleCI Orb v2.0.0: OIDC, Zipapp, and full CLI access"
description: "We’ve released v2.0.0 of the Cloudsmith CircleCI Orb, bringing it to full feature parity with our GitHub Actions and Azure DevOps integrations. This update focuses on security through OIDC, improved reliability, and greater flexibility for your CI/CD workflows."
canonical_url: "https://cloudsmith.com/changelog/cloudsmith-circleci-orb-v2-0-0-oidc-zipapp-and-full-cli-access"
last_updated: "2026-04-07T17:03:28.855Z"
---
# CircleCI Orb v2.0.0: OIDC, Zipapp, and full CLI access

We’ve released **v2.0.0** of the Cloudsmith CircleCI Orb, bringing it to full feature parity with our GitHub Actions and Azure DevOps integrations. This update focuses on security through OIDC, improved reliability, and greater flexibility for your CI/CD workflows.

## Key highlights

**OIDC authentication:** Authenticate using OpenID Connect (OIDC) with the new `authenticate-with-oidc` step. This allows you to exchange short-lived tokens at runtime, eliminating the need to store long-lived API keys in CircleCI environment variables.

**Zipapp-based CLI install:** We’ve switched the default installation method from `pip` to a self-contained zipapp downloaded directly from `dl.cloudsmith.io`. This removes dependencies on the local Python environment and ensures a faster, more consistent setup.

**Full CLI access:** You are no longer limited to a subset of commands via an orb wrapper. The orb now installs the Cloudsmith CLI directly, allowing you to invoke any CLI command within your run steps.

**Updated default executor:** We have moved from the deprecated `circleci/python:3.7.4` image to the modern `cimg/python:3.10` image.

### Deprecations and breaking changes

```json
{
  "_key": "e402ae4a2a53",
  "_type": "callout",
  "content": [
    {
      "_key": "3bca39090c05",
      "_type": "block",
      "children": [
        {
          "_key": "5683425ad248",
          "_type": "span",
          "marks": [],
          "text": "This is a major version release. Please review the following before upgrading"
        }
      ],
      "markDefs": [],
      "style": "normal"
    }
  ],
  "markDefs": null,
  "variant": "warning"
}
```

- **`publish` command deprecated:** The `publish` command is now deprecated. We recommend using `install-cli` followed by `authenticate-with-oidc` (or `ensure-api-key`), then calling the Cloudsmith CLI directly.
- **CLI install method:** Installation defaults to **zipapp**. If your environment specifically requires a pip-based install, set `pip-install: true`.
- **Executor image:** The default executor has changed to `cimg/python:3.10`. Jobs relying on the legacy Python 3.7.4 image may need to explicitly pin the `tag` parameter.
- **Tagging convention:** Production releases now require a **v-prefixed** semver tag (e.g., v2.0.0).

### **Getting started**

You can find full usage examples and parameter references on the [CircleCI Orb Registry](https://circleci.com/developer/orbs/orb/cloudsmith/cloudsmith), or view the source code and contribute via [GitHub](https://github.com/cloudsmith-io/orb).