Every package in your workspace is now checked automatically against known vulnerabilities and malicious packages, with no scheduled or manual rescans required. This is powered by OSV.dev, which has driven policy evaluation since early access and now also replaces Trivy as the data source shown in the web app and API.
Detection runs automatically for every supported package format in your workspace, with no configuration required. Cloudsmith refreshes threat intelligence every 5 minutes, and whenever a new or updated record could affect packages already in your workspace, it checks for a match automatically, without requesting a rescan.
Packages are matched to advisories on a shared package URL (PURL). Cloudsmith supports SemVer and ecosystem-native version ranges when matching; see our earlier changelog on ecosystem-native OSV advisory support for more.
The same vulnerability often has multiple records from different upstream databases. Cloudsmith groups these and surfaces one primary record per vulnerability, so counts stay accurate and reviews stay focused. See the Cloudsmith documentation to learn how the primary record is selected.
Packages are sorted by severity, highest first: Malware, then Critical, High, Medium, Low, and Unknown.
Policies can act on this data automatically, quarantining or flagging a package the moment it matches, without manual review. This data has been actionable in policy management with policy as code since we first added it to the platform in early access, and nothing changes for policies you've already built. See the Cloudsmith documentation to learn more about defining policies against this data.
Trivy-based scan results remain available in the legacy web app and via existing API endpoints for now. Trivy will be deprecated in a future release; we'll share migration details ahead of that change.
For more details about continuous risk detection, see our documentation.
The policy editor now flags Rego problems as you write, so mistakes surface before you save rather than after. In the web app, errors appear inline in the editor and in the error panel; autocomplete also suggests schema fields as you type…
The Cloudsmith CLI now ships as a standalone, self-contained binary for Linux, macOS, and Windows. This eliminates its dependency on a local Python environment. The CLI includes a new one-line installer, a refreshed Homebrew tap and Docker image, and updated GitHub Actions, Azure DevOps, and CircleCI integrations…
At Cloudsmith, we recognize that security is a team sport. Meaningful improvements to our platform have come from researchers and security professionals who take the time to find issues and report them to us responsibly. Today, we're launching a new bug bounty platform - now live at bounties.cloudsmith.com - built to make it faster, clearer, and more rewarding to submit security-related bugs to Cloudsmith…
The Cloudsmith CLI now eliminates the need for static API keys in CI/CD pipelines by automatically discovering OpenID Connect (OIDC) credentials for all major CI/CD platforms and includes a Docker credential helper to automatically authenticate to Cloudsmith registries…
You can now apply cooldown policies to Maven packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny…
The new Hardened images tab lets you proxy and cache hardened, minimal container images without manual format/URL entry…