You can now apply cooldown policies to Maven packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

This feature is available in Early Access for Ultra and Enterprise customers.

Cooldown policies are now supported for npm, Python, Go, Maven, and NuGet. For more information about using cooldown policies, see 

 tab lets you proxy and cache hardened, minimal container images without manual format/URL entry.

Pre-configured upstreams are available for the DHI Community and Chainguard Containers Free tiers.

For paid tiers (DHI Select/Enterprise, Chainguard Containers, and WizOS), the proxy URL is pre-filled automatically. Just select the card, name your upstream, and add credentials where required.

For more information, see our integration guides for 

Hardened images tab for configuring upstreams

You can now apply cooldown policies to NuGet packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

This feature is available in early access for Ultra and Enterprise customers.


Cooldown policies are now supported for npm, Python, Go, and NuGet. For more information about using cooldown policies, see 

Cooldown policies now support NuGet

 partner program. This integration helps prevent unauthorized use of your API keys by automatically detecting exposed keys before they can be exploited.

Cloudsmith issues API keys with a unique prefix. That prefix is registered with GitHub's secret scanning infrastructure, so when a Cloudsmith API key appears in a repo – in source code, a config file, a committed 

, or anywhere else GitHub indexes – GitHub detects and flags it automatically.

If a leak occurs, Cloudsmith notifies the affected user and workspace owners directly to rotate the compromised key immediately.

Secret scanning runs automatically on public repositories for free. For more information about GitHub secret scanning for private repositories, see 

GitHub Docs: Secret scanning - How can I access this feature?

Cloudsmith API keys are now detectable by GitHub secret scanning

, allowing Python package clients to fetch only metadata from the Simple API during dependency resolution.

Cloudsmith's Python Simple API index now includes .metadata links alongside package distribution files. When a compliant client like uv resolves dependencies, it fetches only the small metadata file for each candidate package rather than downloading the full archive. This allows the full dependency tree to be resolved efficiently upfront.

Previously, Python clients had to download entire packages just to read their dependency metadata. This put unnecessary strain on upstream caches and caused builds to be slow and unreliable.

Customers using Cloudsmith Python repositories with the Python Simple API enabled.

Speed up Python builds with PEP-658 support

You can now apply cooldown policies to Go packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

For more information about using cooldown policies, see 

Cooldown policies now support Go

Cloudsmith now handles authentication for Docker Hub and Docker Hardened Images (DHI) upstreams using a managed token, removing the need to supply your own credentials during setup. Authenticated requests receive a higher rate limit than anonymous access.

When a Docker Hub or DHI upstream is created without credentials, Cloudsmith uses a managed Docker Hub organization access token (OAT) to authenticate requests on your behalf. Workspace names are shared with Docker to attribute usage when the Cloudsmith-managed token is used.


A pre-configured DHI upstream is also available, so you can start proxying and caching images from the DHI Community tier immediately.


 are minimal, secure, and production-ready container base and application images maintained by Docker. Designed to reduce vulnerabilities and simplify compliance, DHI integrate easily into your existing Docker-based workflows with little to no retooling required.

For more information about creating Docker Hub and DHI upstreams in Cloudsmith, see:

Cooldown policies now support Maven

Getting started

Other logs

Hardened images tab for configuring upstreams

Cooldown policies now support NuGet

Cloudsmith API keys are now detectable by GitHub secret scanning

Speed up Python builds with PEP-658 support

Cooldown policies now support Go

Set up Docker Hub and DHI upstreams with Cloudsmith-managed authentication